Bug 908546 - Disallow injected cart values

[merge]