Custom link to uploaded file not displayed correctly in shopping cart

DrByte:

The information is sanitized before display so that customers and hackers cannot inject rogue content into your site and end up exploiting your store.

This line in includes/modules/pages/shopping_cart/header_php.php handles that:```
$attrArray[$option]['products_options_values_name'] = zen_output_string_protected($attr_value) ;

> 
> If you wish to retain the security protection, then you'll need to find a different way to supply a link to the uploaded file.


Hi!

Thanks for your reply, but I don't quite understand.
If I was just to output <a>test</a>, that would also not work on the server and it would be output as "<a>test</a>". 
Doe the line you described really do *that*?

Thanks

- Paul

All of the attribute description content is being converted to its html-encoded equivalents. This prevents customers from entering <script> and other rogue hacker-like things into descriptions and attribute values etc.
So, yes, <a>Test</a> will show up literally.

Aah, thanks, that makes sense!

Is there a way to easily disable this?

I mean if I limit users to only upload files that aren't directly readeable by the page that can't do any harm, right?

Thanks a lot!

• Paul

zen_output_string_protected() is what's doing the conversion.

feel free to change that to zen_output_string() if you dare and understand the risks