Use maxlength instead of max for extra option length on upsell page

[adrian-ionescu-dev]

Problem

cart/upsell.template.html uses the max attribute to apply an extra option's configured character limit:

<textarea ... max="[@length@]" cols="20">[@currentextra@]</textarea>
<input type="text" ... max="[@length@]" value="[@currentextra@]">

max only applies to numeric and date input types. It has no effect on <input type="text">, and it is not a valid <textarea> attribute at all. The character limit configured against a product's extra option is therefore not enforced anywhere on the upsell page, in either branch of the [%if [@length@] > '100'%] condition.

The same [@length@] value is applied correctly as maxlength elsewhere in the theme:

Template	Line	Attribute
products/includes/buying_options.template.html	66	maxlength="[@length@]" ✅
products/includes/components.template.html	122	maxlength="[@length@]" ✅
cart/upsell.template.html	49, 51	max="[@length@]" ❌

So the product page enforces the limit and the upsell page silently does not. A customer editing a gift message, engraving, or other extra option from the upsell step can exceed the configured length.

Fix

Changed max to maxlength on both inputs:

-<textarea class="inputtext form-control" ... max="[@length@]" cols="20">[@currentextra@]</textarea>
+<textarea class="inputtext form-control" ... maxlength="[@length@]" cols="20">[@currentextra@]</textarea>

-<input type="text" class="form-control" ... max="[@length@]" value="[@currentextra@]">
+<input type="text" class="form-control" ... maxlength="[@length@]" value="[@currentextra@]">

This brings the upsell page in line with how the same value is already handled on the product page.

How to reproduce on a dev site

1. Configure a product with a text extra option and set a character limit (e.g. 20).

2. Enable checkout_upsell_extra in the checkout settings so the upsell page renders the extra-options editor.

3. Add the product to cart and navigate to the upsell step.

4. Inspect the extra option field.

   Before: renders max="120" — the browser applies no limit, and you can type well past 20 characters.
   After: renders maxlength="120" — input stops at 20 characters, matching the product page.