MC-14826: Incorrect customer html address template

- Updated personal info and address templates

Author: Hwashiang Yu

app/code/Magento/Customer/view/adminhtml/templates/tab/view/personal_info.phtml

@@ -13,6 +13,9 @@ $lastLoginDateStore = $block->getStoreLastLoginDate();
 
 $createDateAdmin = $block->getCreateDate();
 $createDateStore = $block->getStoreCreateDate();
+$allowedAddressHtmlTags = ['abbr', 'b', 'blockquote', 'br', 'code', 'dd', 'del', 'dl', 'dt', 'em',
+    'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'kbd', 'li', 'ol', 'p', 'pre', 's', 'strike',
+    'strong', 'sub', 'sup', 'ul'];
 ?>
 <div class="fieldset-wrapper customer-information">
     <div class="fieldset-wrapper-title">
@@ -61,7 +64,7 @@ $createDateStore = $block->getStoreCreateDate();
     </table>
     <address>
         <strong><?= $block->escapeHtml(__('Default Billing Address')) ?></strong><br/>
-        <?= $block->getBillingAddressHtml() ?>
+        <?= $block->escapeHtml($block->getBillingAddressHtml(), $allowedAddressHtmlTags) ?>
     </address>
 
 </div>

app/code/Magento/Sales/view/adminhtml/templates/order/view/info.phtml

@@ -26,6 +26,9 @@ $orderStoreDate = $block->formatDate(
 );
 
 $customerUrl = $block->getCustomerViewUrl();
+$allowedAddressHtmlTags = ['abbr', 'b', 'blockquote', 'br', 'code', 'dd', 'del', 'dl', 'dt', 'em',
+    'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'kbd', 'li', 'ol', 'p', 'pre', 's', 'strike',
+    'strong', 'sub', 'sup', 'ul'];
 ?>
 
 <section class="admin__page-section order-view-account-information">
@@ -171,7 +174,7 @@ $customerUrl = $block->getCustomerViewUrl();
                 <span class="title"><?= $block->escapeHtml(__('Billing Address')) ?></span>
                 <div class="actions"><?= /* @noEscape */ $block->getAddressEditLink($order->getBillingAddress()); ?></div>
             </div>
-            <address class="admin__page-section-item-content"><?= /* @noEscape */ $block->getFormattedAddress($order->getBillingAddress()); ?></address>
+            <address class="admin__page-section-item-content"><?= $block->escapeHtml($block->getFormattedAddress($order->getBillingAddress()), $allowedAddressHtmlTags); ?></address>
         </div>
         <?php if (!$block->getOrder()->getIsVirtual()): ?>
             <div class="admin__page-section-item order-shipping-address">
@@ -180,7 +183,7 @@ $customerUrl = $block->getCustomerViewUrl();
                     <span class="title"><?= $block->escapeHtml(__('Shipping Address')) ?></span>
                     <div class="actions"><?= /* @noEscape */ $block->getAddressEditLink($order->getShippingAddress()); ?></div>
                 </div>
-                <address class="admin__page-section-item-content"><?= /* @noEscape */ $block->getFormattedAddress($order->getShippingAddress()); ?></address>
+                <address class="admin__page-section-item-content"><?= $block->escapeHtml($block->getFormattedAddress($order->getShippingAddress()), $allowedAddressHtmlTags); ?></address>
             </div>
         <?php endif; ?>
     </div>