ENGCOM-6223: remove script tag #25418

Author: VladimirZaets

app/code/Magento/Sales/Block/Order/Item/Renderer/DefaultRenderer.php

@@ -182,7 +182,7 @@ public function getFormatedOptionValue($optionValue)
 
         if ($this->string->strlen($optionValue) > 55) {
             $result['value'] = $result['value']
-                . ' <a href="#" class="dots tooltip toggle" onclick="return false">...</a>';
+                . ' ...';
             $optionValue = nl2br($optionValue);
             $result = array_merge($result, ['full_view' => $optionValue]);
         }

app/code/Magento/Sales/view/frontend/templates/order/creditmemo/items/renderer/default.phtml

@@ -17,7 +17,7 @@
                 <?php if (!$block->getPrintStatus()) : ?>
                     <?php $_formatedOptionValue = $block->getFormatedOptionValue($_option) ?>
                     <dd<?= (isset($_formatedOptionValue['full_view']) ? ' class="tooltip wrapper"' : '') ?>>
-                        <?= $block->escapeHtml($_formatedOptionValue['value']) ?>
+                        <?= $block->escapeHtml($_formatedOptionValue['value'], ['a', 'img']) ?>
                         <?php if (isset($_formatedOptionValue['full_view'])) : ?>
                         <div class="tooltip content">
                             <dl class="item options">

app/code/Magento/Sales/view/frontend/templates/order/invoice/items/renderer/default.phtml

@@ -17,7 +17,7 @@
                 <?php if (!$block->getPrintStatus()) : ?>
                     <?php $_formatedOptionValue = $block->getFormatedOptionValue($_option) ?>
                     <dd<?= (isset($_formatedOptionValue['full_view']) ? ' class="tooltip wrapper"' : '') ?>>
-                        <?= $block->escapeHtml($_formatedOptionValue['value']) ?>
+                        <?= $block->escapeHtml($_formatedOptionValue['value'], ['a', 'img']) ?>
                         <?php if (isset($_formatedOptionValue['full_view'])) : ?>
                             <div class="tooltip content">
                                 <dl class="item options">

app/code/Magento/Sales/view/frontend/templates/order/items/renderer/default.phtml

@@ -16,17 +16,19 @@ $_item = $block->getItem();
                 <dt><?= $block->escapeHtml($_option['label']) ?></dt>
                 <?php if (!$block->getPrintStatus()) : ?>
                     <?php $_formatedOptionValue = $block->getFormatedOptionValue($_option) ?>
-                    <dd>
+                    <dd<?= (isset($_formatedOptionValue['full_view']) ? ' class="tooltip wrapper"' : '') ?>>
+                        <?= $block->escapeHtml($_formatedOptionValue['value'], ['a', 'img']) ?>
                         <?php if (isset($_formatedOptionValue['full_view'])) : ?>
-                            <?= $block->escapeHtml($_formatedOptionValue['full_view'], ['a']) ?>
-                        <?php else : ?>
-                            <?=$block->escapeHtml($_formatedOptionValue['value'], ['a']) ?>
+                            <div class="tooltip content">
+                                <dl class="item options">
+                                    <dt><?= $block->escapeHtml($_option['label']) ?></dt>
+                                    <dd><?= $block->escapeHtml($_formatedOptionValue['full_view']) ?></dd>
+                                </dl>
+                            </div>
                         <?php endif; ?>
                     </dd>
                 <?php else : ?>
-                    <dd>
-                        <?= /* @noEscape */ nl2br($block->escapeHtml($_option['print_value'] ?? $_option['value'])) ?>
-                    </dd>
+                    <dd><?= $block->escapeHtml((isset($_option['print_value']) ? $_option['print_value'] : $_option['value'])) ?></dd>
                 <?php endif; ?>
             <?php endforeach; ?>
             </dl>

app/code/Magento/Sales/view/frontend/templates/order/shipment/items/renderer/default.phtml

@@ -16,7 +16,7 @@
                 <?php if (!$block->getPrintStatus()) : ?>
                     <?php $_formatedOptionValue = $block->getFormatedOptionValue($_option) ?>
                     <dd<?= (isset($_formatedOptionValue['full_view']) ? ' class="tooltip wrapper"' : '') ?>>
-                        <?= $block->escapeHtml($_formatedOptionValue['value']) ?>
+                        <?= $block->escapeHtml($_formatedOptionValue['value'], ['a', 'img']) ?>
                         <?php if (isset($_formatedOptionValue['full_view'])) : ?>
                         <div class="tooltip content">
                             <dl class="item options">