Multi-line TEXT attribute size is not checked

If a TEXT attribute is defined as multi-line, e.g. Rows: 10, Display Size: 40, Maximum length = 400, the character-checking javascript will limit the number of characters input to the maximum length if javascript is enabled (duh) and the customer has keyed-in the characters.

I've seen at least one site where some kiddies are ***pasting ***over-sized contents (like 8MB of gibberish) into the TEXT attribute. This yields an error from the javascript, but the text-size is not reduced ... leading to false out-of-memory logs being issued within the shopping cart page.

As a pro-active measure, I created an extra_cart_action script containing:

<?php
// -----
// Extra-cart-action to detect (and remove) any TEXT attributes that are longer than the allowable value.  This is usually
// caused by script-kiddies pasting large amounts of data into a TEXT-attribute's textarea box.
//
if (isset ($_GET['action']) && $_GET['action'] == 'add_product' && isset ($_POST['id']) && is_array ($_POST['id'])) {
  foreach ($_POST['id'] as $key => $value) {
    $debug = '';
    if (strpos ($key, TEXT_PREFIX) === 0) {
      $check = $db->Execute ("SELECT products_options_length FROM " . TABLE_PRODUCTS_OPTIONS . " WHERE products_options_id = " . (int)str_replace (TEXT_PREFIX, '', $key) . " LIMIT 1");
      if ($check->EOF || strlen ($value) > $check->fields['products_options_length']) {
        unset ($_POST['id'][$key]);
        
      }
    }
  }
  reset ($_POST['id']);
}

Note that I "killed" the attribute value rather than truncating it to the proper length because my feeling is/was that the only reason that this overage should occur is when the form's being fussed with.

A good point!

@lat9, can you submit this as a PR to v160?

Perhaps call the extra_cart_actions file something like prevent_invalid_textarea_attribute_content.php (or is that too verbose? lol)

Also, in the comments part of the code, please mention that this is to catch cases where the javascript doesn't fire client-side. (you already implied this in your existing comments, but didn't mention the javascript/client-side part specifically and I think it's important to make the connection in case someone goes hunting for this to change it for their specific needs)

Will do, DrByte!

Update: The filename I used (also longish) is add_cart_check_text_attribute_size.php.

There's still something going on, though, as I'm still seeing the out-of-memory logs in the shopping-cart page; I'll post when I figure out what the heck is going on there!

As far as out-of-memory is concerned, it's worth investigating the max-post-size and max-upload-size and memory_limit settings in PHP. These are all revealed in the top of the Admin->Tools->Server Info screen.

DrByte, regarding the PR: My feeling is that this functionality should be in the shopping-cart class itself, in either the add_cart or ***actionAddProduct ***function.

Having the processing as an extra-cart-action worked well on the site where I've implemented this (no additional extra-cart-actions, no observers that might "steal" the add_product action). If the new validation is in an extra-cart-action, it might not be run first -- those files are loaded/run via dir-class processing which loads in "the order in which they are stored in the filesystem" SIZE=1[/SIZE].

Good point