Legacy Image field ignores the maximum selection limit

Summary

When a PPOM Image field uses the legacy view with multiple selection enabled, customers can select more images than the field's configured maximum. The visible choices are expected to remain within the configured limit, but additional choices remain selected, allowing an invalid option combination that can disrupt conditional product fields.

Customer context

• Product / area: PPOM Image field on a WooCommerce product page
• Version: Not provided; inspected source is v34.0.8 plus one commit
• Environment: WooCommerce site; further environment details were not provided
• Integration / third party: PPOM conditional-field rules
• Reported error / symptom: A field intended to allow one sticker choice permits both choices
• Impact: Mutually exclusive sticker configurations can remain selected, so dependent conditional fields may not represent a valid product configuration

Reproduction notes

Reported workflow: configure an Image field so one sticker type may be selected, open the associated product page, and select both displayed sticker choices. Source-derived focused reproduction: enable Legacy View, enable multiple selection, set Max Image Select to 1, and click two image choices. Runtime reproduction was not performed; the customer's field export and exact PPOM version were not provided.

Diagnosis

Conclusion

The defect is confirmed for the reachable legacy Image-field path. With legacy view and multiple selection enabled, the renderer emits checkboxes carrying data-max-selected, while a repository-wide source search found no code that reads that attribute. The modern Image-field path has separate click handling, so the confirmed scope is the legacy view rather than every Image-field configuration.

Where this likely occurs

• Product-page Image-field rendering: templates/frontend/inputs/image.php — image template, lines 53–152. The legacy branch renders each choice independently.
• Selection markup: templates/frontend/inputs/image.php — image template, lines 115–129. Multiple selection produces checkboxes and line 127 emits data-max-selected; this is the attribute's only occurrence in the repository.
• Modern-path comparison: js/ppom.inputs.js — ppom_init_js_for_ppom_fields() lines 268–329. Its .ppom-image-select listener reads data-max-selection and limits tracked selections, but it targets the modern container rendered outside the legacy branch.
• Settings reachability: classes/inputs/input.image.php — NM_Image_wooproduct::get_settings() approx. lines 111–147. Image fields expose multiple-selection, minimum, maximum, and legacy-view settings.
• Relevant history: generalized image maximum handling was introduced in 66bf9e84f558c30125cc92427d4dfe378a88276b and adjusted in a094b6ccaaee5c0b5997255b4190fec76d45599a, 5c26dd91b546ec860ae438e3cdb75125c96ddd74, and 37efca50def2ac0203d201b83cecdab5142ce308. Closed Pro issue #477 covered a 2024 generalized regression, but no open issue specific to the current legacy path was found.

Engineering notes

The affected markup belongs to the free/core repository even when PPOM Pro is active. The Pro imageselect add-on is a distinct single-select field and does not expose these minimum/maximum settings. Server-side count validation exists in src/Support/Helpers.php — Helpers::posted_field_max_min_value_validation() lines 2833–2898, but it does not provide the reported product-page mutual exclusivity, and the transcript does not establish whether submission was attempted. The customer's exact field export, legacy-view setting, plugin version, client-validation mode, and conditional-rule configuration are unavailable.

Test coverage status

No relevant Image-field limit coverage was found during inspection. tests/unit/test-validation-and-pricing.php — testCheckValidationRejectsCheckboxSelectionsBelowMinChecked() and testCheckValidationRejectsCheckboxSelectionsAboveMaxChecked() lines 561–635 cover generic checkbox fields, not Image-field frontend behavior. The Pro tests/e2e/specs/image-dropdown.spec.js suite covers the separate Image Dropdown field without minimum, maximum, or exclusivity assertions.

What to verify or explore next

• Reproduce with an Image field configured with legacy view enabled, multiple selection enabled, and maximum selection set to 1, then select two choices.
• Compare the same field with legacy view disabled to confirm the scope boundary.
• Check product-page behavior with client validation enabled and disabled, including whether add-to-cart rejects the excess selection.
• Exercise conditional rules driven by the two image choices to confirm the reported downstream impact.
• Run the applicable PHPUnit validation suite and a focused product-page browser scenario if a reproducible fixture is available.

Unknowns / follow-up

The customer's current PPOM version and whether the affected field has legacy view enabled are unknown. The report does not demonstrate a separate minimum-selection failure, so only the observed maximum-selection behavior is confirmed.

Confidence

Confidence: 94/100

Current source at v34.0.8 confirms that the reachable legacy Image-field renderer exposes checkbox choices with a configured maximum but no frontend consumer enforces that value; focused regression coverage and an open duplicate were not found.

---

Source: HelpScout #3421699226
Generated by bug-report-triage (ID: bug-report-triage_6a835a4a9bac61.47495852)

Start with templates/frontend/inputs/image.php, especially the legacy multiple-selection markup, then compare its data-max-selected attribute with the handling in js/ppom.inputs.js. Reproduce the configured maximum of 1 with two legacy image choices, compare legacy and modern views, and run the applicable PHPUnit suite plus a focused product-page browser scenario. Done means the legacy path respects the configured maximum without changing the modern path.