Merge remote-tracking branch 'origin/MC-16421' into 2.2.9-develop-pr97

zakdma · zakdma · commit 8bb6add8718b · 2019-05-20T18:11:15.000+03:00
diff --git a/app/code/Magento/Sales/Helper/Admin.php b/app/code/Magento/Sales/Helper/Admin.php
@@ -165,6 +165,7 @@ public function escapeHtmlWithLinks($data, $allowedTags = null)
 
             $internalErrors = libxml_use_internal_errors(true);
 
+            $data = mb_convert_encoding($data, 'HTML-ENTITIES', 'UTF-8');
             $domDocument->loadHTML(
                 '<html><body id="' . $wrapperElementId . '">' . $data . '</body></html>'
             );
diff --git a/dev/tests/integration/testsuite/Magento/Sales/Helper/AdminTest.php b/dev/tests/integration/testsuite/Magento/Sales/Helper/AdminTest.php
@@ -52,6 +52,13 @@ public function escapeHtmlWithLinksDataProvider(): array
                 '&lt;a&gt;some text in tags&lt;/a&gt;',
                 'allowedTags' => null,
             ],
+            [
+                // @codingStandardsIgnoreStart
+                'Authorized amount of €30.00. Transaction ID: "<a target="_blank" href="https://www.sandbox.paypal.com/cgi-bin/webscr?cmd=_view-a-trans&id=123456789QWERTY">123456789QWERTY</a>"',
+                'Authorized amount of €30.00. Transaction ID: &quot;<a href="https://www.sandbox.paypal.com/cgi-bin/webscr?cmd=_view-a-trans&amp;id=123456789QWERTY">123456789QWERTY</a>&quot;',
+                // @codingStandardsIgnoreEnd
+                'allowedTags' => ['b', 'br', 'strong', 'i', 'u', 'a'],
+            ],
             [
                 'Transaction ID: "<a target="_blank" href="https://www.paypal.com/?id=XX123XX">XX123XX</a>"',
                 'Transaction ID: &quot;<a href="https://www.paypal.com/?id=XX123XX">XX123XX</a>&quot;',
