MAGETWO-98235: Incorrect customer html address template

- Updated personal info and address templates

Author: Hwashiang Yu

app/code/Magento/Customer/view/adminhtml/templates/tab/view/personal_info.phtml

@@ -15,6 +15,9 @@ $lastLoginDateStore = $block->getStoreLastLoginDate();
 
 $createDateAdmin = $block->getCreateDate();
 $createDateStore = $block->getStoreCreateDate();
+$allowedAddressHtmlTags = ['abbr', 'b', 'blockquote', 'br', 'code', 'dd', 'del', 'dl', 'dt', 'em',
+    'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'kbd', 'li', 'ol', 'p', 'pre', 's', 'strike',
+    'strong', 'sub', 'sup', 'ul'];
 ?>
 
 <div class="fieldset-wrapper customer-information">
@@ -65,7 +68,7 @@ $createDateStore = $block->getStoreCreateDate();
     <address>
         <strong><?php echo $block->escapeHtml(__('Default Billing Address')) ?></strong>
         <br/>
-        <?php echo $block->getBillingAddressHtml() ?>
+        <?php echo $block->escapeHtml($block->getBillingAddressHtml(), $allowedAddressHtmlTags) ?>
     </address>
 
 </div>

app/code/Magento/Sales/view/adminhtml/templates/order/view/info.phtml

@@ -24,6 +24,9 @@ $orderStoreDate = $block->formatDate(
     true,
     $block->getTimezoneForStore($order->getStore())
 );
+$allowedAddressHtmlTags = ['abbr', 'b', 'blockquote', 'br', 'code', 'dd', 'del', 'dl', 'dt', 'em',
+    'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'kbd', 'li', 'ol', 'p', 'pre', 's', 'strike',
+    'strong', 'sub', 'sup', 'ul'];
 ?>
 
 <section class="admin__page-section order-view-account-information">
@@ -168,7 +171,7 @@ $orderStoreDate = $block->formatDate(
                 <span class="title"><?php echo $block->escapeHtml(__('Billing Address')) ?></span>
                 <div class="actions"><?php /* @noEscape */ echo $block->getAddressEditLink($order->getBillingAddress()); ?></div>
             </div>
-            <address class="admin__page-section-item-content"><?php /* @noEscape */ echo $block->getFormattedAddress($order->getBillingAddress()); ?></address>
+            <address class="admin__page-section-item-content"><?php echo $block->escapeHtml($block->getFormattedAddress($order->getBillingAddress()), $allowedAddressHtmlTags); ?></address>
         </div>
         <?php if (!$block->getOrder()->getIsVirtual()): ?>
             <div class="admin__page-section-item order-shipping-address">
@@ -177,7 +180,7 @@ $orderStoreDate = $block->formatDate(
                     <span class="title"><?php echo $block->escapeHtml(__('Shipping Address')) ?></span>
                     <div class="actions"><?php /* @noEscape */ echo $block->getAddressEditLink($order->getShippingAddress()); ?></div>
                 </div>
-                <address class="admin__page-section-item-content"><?php /* @noEscape */ echo $block->getFormattedAddress($order->getShippingAddress()); ?></address>
+                <address class="admin__page-section-item-content"><?php echo $block->escapeHtml($block->getFormattedAddress($order->getShippingAddress()), $allowedAddressHtmlTags); ?></address>
             </div>
         <?php endif; ?>
     </div>