From a2a5db890113b3b7045d82c7a0c0fd98c62a01d0 Mon Sep 17 00:00:00 2001
From: objecttothis <17935339+objecttothis@users.noreply.github.com>
Date: Fri, 13 Mar 2020 16:32:39 +0400
Subject: [PATCH 1/2] Correct a bug causing & to break in POST

See #2758 for details
---
 application/views/attributes/form.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/application/views/attributes/form.php b/application/views/attributes/form.php
index bbd7fc4b9..4db7c447a 100644
--- a/application/views/attributes/form.php
+++ b/application/views/attributes/form.php
@@ -157,7 +157,7 @@ $(document).ready(function()
 			}
 			else
 			{
-				$.post('<?php echo site_url("attributes/save_attribute_value/");?>' + value, {definition_id: definition_id});
+				$.post('<?php echo site_url("attributes/save_attribute_value/");?>' + escape(value), {definition_id: definition_id});
 			}
 		}
 

From ecb21d2d5ec9c567315152b178e371f62d825673 Mon Sep 17 00:00:00 2001
From: objecttothis <17935339+objecttothis@users.noreply.github.com>
Date: Fri, 13 Mar 2020 16:38:18 +0400
Subject: [PATCH 2/2] Same correction for removing attribute value

---
 application/views/attributes/form.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/application/views/attributes/form.php b/application/views/attributes/form.php
index 4db7c447a..da1222889 100644
--- a/application/views/attributes/form.php
+++ b/application/views/attributes/form.php
@@ -128,7 +128,7 @@ $(document).ready(function()
 		}
 		else
 		{
-			$.post('<?php echo site_url($controller_name . "/delete_attribute_value/");?>' + value, {definition_id: definition_id});
+			$.post('<?php echo site_url($controller_name . "/delete_attribute_value/");?>' + escape(value), {definition_id: definition_id});
 		}
 		$(this).parents("li").remove();
 	};