Lack of escaping in javascript causes page errors
-
Looks like the pintrest plugin when adding pintrk calls, doesn’t escape the product name and if it contains ‘ then it generates invalid javascript. I’m using Version 1.2.16.
Problematic code is in Tracking.src :: get_add_to_cart_snippet_product$tracking = <<< JS
jQuery( function( $ ) {
$( document.body ).on( ‘added_to_cart’, function( e, fragments, cart_hash, thisbutton ) {
var quantity = document.querySelector( ‘input.qty[name=”quantity”]’ ).value;
pintrk( ‘track’, ‘AddToCart’, {
‘product_id’: ‘{$product_id}’,
‘product_name’: ‘{$product_name}’, <— here
‘value’: {$product_price} * quantity,
‘order_quantity’: quantity,
‘currency’: ‘{$wc_currency}’
} );
} );
} );
- The topic ‘Lack of escaping in javascript causes page errors’ is closed to new replies.