[minorgod]

In the XCart 4.1.x branch you can also add the "product" field to the $trusted_post_variables array in the following files to stop tags from being stripped from the product title. You simply need to modify the following files:

/xcart/provider/product_modify.php
/xcart/admin/product_modify.php

Near the top of each of those files is a line that looks like:

PHP Code:

$trusted_post_variables = array("product_lng","product_new_descr","product_new_full_descr","descr","fulldescr","posted_data","js_code","efields"); 


Simply add the "product" field to the array definition like so:

PHP Code:

$trusted_post_variables = array("product","product_lng","product_new_descr","product_new_full_descr","descr","fulldescr","posted_data","js_code","efields"); 


I do not know what security holes this could open up other than possibly making it easy for unscrupulous providers to create some kind of script attack via the product title field.