Skip to content

Commit b75b442

Browse files
davemacaulaydavemacaulay
committed
MC-16618: Eliminate @escapeNotVerified in Sales-related Modules
- Resolve admin CR comments
1 parent 7e3dd61 commit b75b442

File tree

11 files changed

+25
-22
lines changed

11 files changed

+25
-22
lines changed

‎app/code/Magento/Sales/view/adminhtml/templates/order/create/coupons/form.phtml

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,7 @@
55
*/
66
?>
77
<?php
8-
/**
9-
* \Magento\Sales\Block\Adminhtml\Order\Create\Coupons
10-
*
11-
*/
8+
/* @var \Magento\Sales\Block\Adminhtml\Order\Create\Coupons $block */
129
?>
1310
<div class="admin__field field-apply-coupon-code">
1411
<label class="admin__field-label"><span><?= $block->escapeHtml(__('Apply Coupon Code')) ?></span></label>
@@ -18,7 +15,7 @@
1815
<?php if ($block->getCouponCode()) : ?>
1916
<p class="added-coupon-code">
2017
<span><?= $block->escapeHtml($block->getCouponCode()) ?></span>
21-
<a href="#" onclick="order.applyCoupon(''); return false;" title="<?= $block->escapeHtml(__('Remove Coupon Code')) ?>"
18+
<a href="#" onclick="order.applyCoupon(''); return false;" title="<?= $block->escapeHtmlAttr(__('Remove Coupon Code')) ?>"
2219
class="action-remove"><span><?= $block->escapeHtml(__('Remove')) ?></span></a>
2320
</p>
2421
<?php endif; ?>

‎app/code/Magento/Sales/view/adminhtml/templates/order/create/form/address.phtml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
44
* See COPYING.txt for license details.
55
*/
66

7+
/** @var \Magento\Sales\Block\Adminhtml\Order\Create\Form\Address $block */
8+
79
/**
810
* @var \Magento\Customer\Model\ResourceModel\Address\Collection $addressCollection
911
*/
@@ -66,7 +68,7 @@ endif; ?>
6668
<?php $_id = $block->getForm()->getHtmlIdPrefix() . 'customer_address_id' ?>
6769
<div class="admin__field-control">
6870
<select id="<?= $block->escapeHtmlAttr($_id) ?>"
69-
name="<?= $block->getForm()->getHtmlNamePrefix() ?>[customer_address_id]"
71+
name="<?= $block->escapeHtmlAttr($block->getForm()->getHtmlNamePrefix()) ?>[customer_address_id]"
7072
onchange="order.selectAddress(this, '<?= $block->escapeJs($_fieldsContainerId) ?>')"
7173
class="admin__control-select">
7274
<option value=""><?= $block->escapeHtml(__('Add New Address')) ?></option>
@@ -85,8 +87,8 @@ endif; ?>
8587
<?= $block->getForm()->toHtml() ?>
8688

8789
<div class="admin__field admin__field-option order-save-in-address-book">
88-
<input name="<?= $block->getForm()->getHtmlNamePrefix() ?>[save_in_address_book]" type="checkbox" id="<?= $block->getForm()->getHtmlIdPrefix() ?>save_in_address_book" value="1"<?php if (!$block->getDontSaveInAddressBook()) : ?> checked="checked"<?php endif; ?> class="admin__control-checkbox"/>
89-
<label for="<?= $block->getForm()->getHtmlIdPrefix() ?>save_in_address_book"
90+
<input name="<?= $block->escapeHtmlAttr($block->getForm()->getHtmlNamePrefix()) ?>[save_in_address_book]" type="checkbox" id="<?= $block->escapeHtmlAttr($block->getForm()->getHtmlIdPrefix()) ?>save_in_address_book" value="1"<?php if (!$block->getDontSaveInAddressBook()) : ?> checked="checked"<?php endif; ?> class="admin__control-checkbox"/>
91+
<label for="<?= $block->escapeHtmlAttr($block->getForm()->getHtmlIdPrefix()) ?>save_in_address_book"
9092
class="admin__field-label"><?= $block->escapeHtml(__('Save in address book')) ?></label>
9193
</div>
9294
</div>

‎app/code/Magento/Sales/view/adminhtml/templates/order/create/sidebar.phtml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
<?php foreach ($block->getLayout()->getChildBlocks($block->getNameInLayout()) as $_alias => $_child) : ?>
1414
<?php if ($_alias != 'top_button' && $_alias != 'bottom_button') : ?>
1515
<?php if ($block->canDisplay($_child)) : ?>
16-
<div class="order-sidebar-block" id="order-sidebar_<?= /* @noEscape */ $_alias ?>">
16+
<div class="order-sidebar-block" id="order-sidebar_<?= $block->escapeHtmlAttr($_alias) ?>">
1717
<?= $block->getChildHtml($_alias) ?>
1818
</div>
1919
<?php endif; ?>

‎app/code/Magento/Sales/view/adminhtml/templates/order/create/sidebar/items.phtml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -90,14 +90,14 @@
9090
<a href="#"
9191
class="icon icon-configure"
9292
title="<?= $block->escapeHtml(__('Configure and Add to Order')) ?>"
93-
onclick="order.sidebarConfigureProduct('<?= 'sidebar_wishlist' ?>', <?= (int) $block->getProductId($_item) ?>, <?= (int) $block->getItemId($_item) ?>); return false;">
93+
onclick="order.sidebarConfigureProduct('sidebar_wishlist', <?= (int) $block->getProductId($_item) ?>, <?= (int) $block->getItemId($_item) ?>); return false;">
9494
<span><?= $block->escapeHtml(__('Configure and Add to Order')) ?></span>
9595
</a>
9696
<?php elseif ($block->isConfigurationRequired($_item->getTypeId())) : ?>
9797
<a href="#"
9898
class="icon icon-configure"
9999
title="<?= $block->escapeHtml(__('Configure and Add to Order')) ?>"
100-
onclick="order.sidebarConfigureProduct('<?= 'sidebar' ?>', <?= (int) $block->getProductId($_item) ?>); return false;">
100+
onclick="order.sidebarConfigureProduct('sidebar', <?= (int) $block->getProductId($_item) ?>); return false;">
101101
<span><?= $block->escapeHtml(__('Configure and Add to Order')) ?></span>
102102
</a>
103103
<?php else : ?>

‎app/code/Magento/Sales/view/adminhtml/templates/order/creditmemo/create/totals/adjustments.phtml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
<td>
1212
<input type="text"
1313
name="creditmemo[shipping_amount]"
14-
value="<?= /* @noEscape */ $block->getShippingAmount() ?>"
14+
value="<?= $block->escapeHtmlAttr($block->getShippingAmount()) ?>"
1515
class="input-text admin__control-text not-negative-amount"
1616
id="shipping_amount" />
1717
</td>
@@ -21,7 +21,7 @@
2121
<td>
2222
<input type="text"
2323
name="creditmemo[adjustment_positive]"
24-
value="<?= /* @noEscape */ $_source->getBaseAdjustmentPositive() ?>"
24+
value="<?= $block->escapeHtmlAttr($_source->getBaseAdjustmentPositive()) ?>"
2525
class="input-text admin__control-text not-negative-amount"
2626
id="adjustment_positive" />
2727
</td>
@@ -31,15 +31,15 @@
3131
<td>
3232
<input type="text"
3333
name="creditmemo[adjustment_negative]"
34-
value="<?= /* @noEscape */ $_source->getBaseAdjustmentNegative() ?>"
34+
value="<?= $block->escapeHtmlAttr($_source->getBaseAdjustmentNegative()) ?>"
3535
class="input-text admin__control-text not-negative-amount"
3636
id="adjustment_negative"/>
3737
<script>
3838
require(['prototype'], function(){
3939

4040
//<![CDATA[
4141
Validation.addAllThese([
42-
['not-negative-amount', '<?= $block->escapeHtml(__('Please enter a positive number in this field.')) ?>', function(v) {
42+
['not-negative-amount', '<?= $block->escapeJs(__('Please enter a positive number in this field.')) ?>', function(v) {
4343
if(v.length)
4444
return /^\s*\d+([,.]\d+)*\s*%?\s*$/.test(v);
4545
else

‎app/code/Magento/Sales/view/adminhtml/templates/order/invoice/create/form.phtml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ require(['prototype'], function(){
9191
}
9292

9393
/*forced creating of shipment*/
94-
var forcedShipmentCreate = <?= /* @noEscape */ $block->getForcedShipmentCreate() ?>;
94+
var forcedShipmentCreate = <?= (int) $block->getForcedShipmentCreate() ?>;
9595
var shipmentElement = $('invoice_do_shipment');
9696
if (forcedShipmentCreate && shipmentElement) {
9797
shipmentElement.checked = true;

‎app/code/Magento/Sales/view/adminhtml/templates/order/totals/item.phtml

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,14 @@
1111
<tr>
1212
<td class="label">
1313
<?php if ($block->getStrong()) : ?>
14-
<strong><?php endif; ?><?= $block->escapeHtml(__($block->getLabel())) ?><?php if ($block->getStrong()) : ?></strong>
14+
<strong>
15+
<?php endif; ?>
16+
<?= $block->escapeHtml(__($block->getLabel())) ?>
17+
<?php if ($block->getStrong()) : ?>
18+
</strong>
1519
<?php endif; ?>
1620
</td>
17-
<td <?= $block->getHtmlClass() ? ('class="' . $block->getHtmlClass() . '"') : '' ?>>
21+
<td <?= $block->getHtmlClass() ? ('class="' . $block->escapeHtmlAttr($block->getHtmlClass()) . '"') : '' ?>>
1822
<?php if ($block->getStrong()) : ?><strong><?php endif; ?>
1923
<?= /* @noEscape */ $block->displayPriceAttribute($block->getSourceField()) ?>
2024
<?php if ($block->getStrong()) : ?></strong><?php endif; ?>

‎app/code/Magento/Sales/view/adminhtml/templates/order/view/giftmessage.phtml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
?>
99
<?php if ($block->canDisplayGiftmessage()) : ?>
1010
<?php $_required = $block->getMessage()->getMessage() != '' ?>
11-
<div id="<?= $block->getHtmlId() ?>" class="admin__page-section-content giftmessage-whole-order-container">
11+
<div id="<?= $block->escapeHtmlAttr($block->getHtmlId()) ?>" class="admin__page-section-content giftmessage-whole-order-container">
1212
<form class="entry-edit form-inline" id="<?= $block->escapeHtmlAttr($block->getFieldId('form')) ?>" action="<?= $block->escapeUrl($block->getSaveUrl()) ?>">
1313
<fieldset class="admin__fieldset">
1414
<legend class="admin__legend"><span><?= $block->escapeHtml(__('Gift Message for the Entire Order')) ?></span></legend>

‎app/code/Magento/Sales/view/adminhtml/templates/order/view/history.phtml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
<div class="admin__field-control">
1616
<select name="history[status]" id="history_status" class="admin__control-select">
1717
<?php foreach ($block->getStatuses() as $_code => $_label) : ?>
18-
<option value="<?= $block->escapeHtml($_code) ?>"<?php if ($_code == $block->getOrder()->getStatus()) : ?> selected="selected"<?php endif; ?>><?= $block->escapeHtml($_label) ?></option>
18+
<option value="<?= $block->escapeHtmlAttr($_code) ?>"<?php if ($_code == $block->getOrder()->getStatus()) : ?> selected="selected"<?php endif; ?>><?= $block->escapeHtml($_label) ?></option>
1919
<?php endforeach; ?>
2020
</select>
2121
</div>

‎app/code/Magento/Sales/view/adminhtml/templates/order/view/items.phtml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ $_order = $block->getOrder() ?>
1717
$lastItemNumber = count($columns) ?>
1818
<?php foreach ($columns as $columnName => $columnTitle) : ?>
1919
<?php $i++; ?>
20-
<th class="col-<?= /* @noEscape */ $columnName ?><?= /* @noEscape */ ($i === $lastItemNumber ? ' last' : '') ?>"><span><?= $block->escapeHtml($columnTitle) ?></span></th>
20+
<th class="col-<?= $block->escapeHtmlAttr($columnName) ?><?= /* @noEscape */ ($i === $lastItemNumber ? ' last' : '') ?>"><span><?= $block->escapeHtml($columnTitle) ?></span></th>
2121
<?php endforeach; ?>
2222
</tr>
2323
</thead>

0 commit comments

Comments
 (0)