Merge branch 'MC-29420' of https://github.com/magento-qwerty/magento2ce into MC-33823

� Conflicts:
�	app/code/Magento/Analytics/Test/Unit/Block/Adminhtml/System/Config/SubscriptionStatusLabelTest.php
�	app/code/Magento/Analytics/Test/Unit/Block/Adminhtml/System/Config/VerticalTest.php
�	app/code/Magento/Bundle/Test/Unit/Block/Adminhtml/Catalog/Product/Composite/Fieldset/Options/Type/CheckboxTest.php
�	app/code/Magento/Bundle/Test/Unit/Block/Adminhtml/Catalog/Product/Composite/Fieldset/Options/Type/MultiTest.php
�	app/code/Magento/Bundle/Test/Unit/Block/Adminhtml/Catalog/Product/Composite/Fieldset/Options/Type/RadioTest.php
�	app/code/Magento/Bundle/Test/Unit/Block/Adminhtml/Catalog/Product/Composite/Fieldset/Options/Type/SelectTest.php
�	app/code/Magento/Config/Test/Unit/Block/System/Config/Form/Field/ImageTest.php
�	app/code/Magento/Config/Test/Unit/Block/System/Config/Form/Field/Select/AllowspecificTest.php
�	app/code/Magento/Config/Test/Unit/Block/System/Config/Form/FieldTest.php
�	app/code/Magento/Config/Test/Unit/Block/System/Config/Form/Fieldset/Modules/DisableOutputTest.php
�	app/code/Magento/Config/Test/Unit/Block/System/Config/Form/FieldsetTest.php
�	app/code/Magento/Customer/Block/Form/Register.php
�	app/code/Magento/Developer/Test/Unit/Model/TemplateEngine/Decorator/DebugHintsTest.php
�	app/code/Magento/Integration/Test/Unit/Block/Adminhtml/Widget/Grid/Column/Renderer/ButtonTest.php
�	app/code/Magento/OfflineShipping/Test/Unit/Block/Adminhtml/Form/Field/ImportTest.php
�	app/code/Magento/Paypal/Test/Unit/Block/Adminhtml/System/Config/Field/CountryTest.php
�	app/code/Magento/Paypal/Test/Unit/Block/Adminhtml/System/Config/Field/Enable/AbstractEnableTest.php
�	app/code/Magento/Paypal/Test/Unit/Block/Adminhtml/System/Config/Fieldset/GroupTest.php
�	app/code/Magento/Paypal/Test/Unit/Block/Adminhtml/System/Config/Fieldset/PaymentTest.php
�	dev/tests/integration/testsuite/Magento/Payment/Block/Transparent/IframeTest.php
�	lib/internal/Magento/Framework/View/Test/Unit/Helper/JsTest.php

Author: Oleksandr Gorkun

app/code/Magento/AdminAnalytics/view/adminhtml/templates/notification.phtml

@@ -4,13 +4,21 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+
+/** @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer */
 ?>
 
-<script>
+<?php
+$isAnaliticsVisible = $block->getNotification()->isAnalyticsVisible() ? 1 : 0;
+$isReleaseVisible = $block->getNotification()->isReleaseVisible() ? 1 : 0;
+$scriptString = <<<script
     define('analyticsPopupConfig', function () {
         return {
-            analyticsVisible: <?= $block->getNotification()->isAnalyticsVisible() ? 1 : 0; ?>,
-            releaseVisible: <?= $block->getNotification()->isReleaseVisible() ? 1 : 0; ?>,
+            analyticsVisible: {$isAnaliticsVisible},
+            releaseVisible: {$isReleaseVisible},
         }
     });
-</script>
+script
+?>
+
+<?= /* @noEscape */ $secureRenderer->renderTag('script', [], $scriptString, false); ?>

app/code/Magento/AdminAnalytics/view/adminhtml/templates/tracking.phtml

@@ -3,13 +3,28 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+
+/**
+ * @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer
+ */
 ?>
 
-<script src="<?= $block->escapeUrl($block->getTrackingUrl()) ?>" async></script>
-<script>
+<?= /* @noEscape */ $secureRenderer->renderTag(
+    'script',
+    [
+        'src' => '"' . $block->escapeJs($block->getTrackingUrl()) .'"',
+        'async' => true,
+    ],
+    '&nbsp;',
+    false
+) ?>
+
+<?php $scriptString = '
     var adminAnalyticsMetadata = {
-        "version": "<?= $block->escapeJs($block->getMetadata()->getMagentoVersion()) ?>",
-        "user": "<?= $block->escapeJs($block->getMetadata()->getCurrentUser()) ?>",
-        "mode": "<?= $block->escapeJs($block->getMetadata()->getMode()) ?>"
+        "version": "' . $block->escapeJs($block->getMetadata()->getMagentoVersion()) . '",
+        "user": "' . $block->escapeJs($block->getMetadata()->getCurrentUser()) . '",
+        "mode": "' . $block->escapeJs($block->getMetadata()->getMode()) . '"
     };
-</script>
+';
+?>
+<?= /* @noEscape */ $secureRenderer->renderTag('script', [], $scriptString, false); ?>

app/code/Magento/AdminNotification/view/adminhtml/templates/notification/window.phtml

@@ -6,10 +6,10 @@
 
 /**
  * @see \Magento\AdminNotification\Block\Window
+ * @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer
  */
 ?>
 <ul class="message-system-list"
-    style="display: none;"
     data-mage-init='{
         "Magento_Ui/js/modal/modal": {
             "autoOpen": true,
@@ -25,3 +25,4 @@
         </a>
     </li>
 </ul>
+<?= /* @noEscape */ $secureRenderer->renderStyleAsTag('display:none', '.message-system-list'); ?>

app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages/popup.phtml

@@ -5,18 +5,20 @@
  */
 
 /** @var $block \Magento\AdminNotification\Block\System\Messages\UnreadMessagePopup */
+/** @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer */
 ?>
 
-<div style="display:none" id="system_messages_list" data-role="system_messages_list"
+<div id="system_messages_list" data-role="system_messages_list"
      title="<?= $block->escapeHtmlAttr($block->getPopupTitle()) ?>">
     <ul class="message-system-list messages">
-        <?php foreach ($block->getUnreadMessages() as $message) : ?>
+        <?php foreach ($block->getUnreadMessages() as $message): ?>
             <li class="message message-warning <?= $block->escapeHtmlAttr($block->getItemClass($message)) ?>">
                 <?= $block->escapeHtml($message->getText()) ?>
             </li>
         <?php endforeach;?>
     </ul>
 </div>
+<?= /* @noEscape */ $secureRenderer->renderStyleAsTag('display:none', '#system_messages_list'); ?>
 
 <script type="text/x-magento-init">
     {

app/code/Magento/AuthorizenetAcceptjs/view/adminhtml/templates/payment/script.phtml

@@ -0,0 +1,24 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+/** @var Magento\AuthorizenetAcceptjs\Block\Payment $block */
+?>
+<script>
+    //<![CDATA[
+    require(
+        [
+            'Magento_AuthorizenetAcceptjs/js/authorizenet',
+            'jquery',
+            'domReady!'
+        ], function(AuthorizenetAcceptjs, $) {
+            var config = <?= /* @noEscape */ $block->getPaymentConfig() ?>,
+                form = $('#payment_form_<?= /* @noEscape */ $block->escapeJs($block->escapeHtml($block->getMethodCode())) ?>');
+
+            config.active = form.length > 0 && !form.is(':hidden');
+            new AuthorizenetAcceptjs(config);
+        });
+    //]]>
+</script>

app/code/Magento/Backend/Block/Template.php

@@ -8,6 +8,10 @@
 
 namespace Magento\Backend\Block;
 
+use Magento\Framework\App\ObjectManager;
+use Magento\Framework\Json\Helper\Data as JsonHelper;
+use Magento\Directory\Helper\Data as DirectoryHelper;
+
 /**
  * Standard admin block. Adds admin-specific behavior and event.
  * Should be used when you declare a block in admin layout handle.
@@ -60,15 +64,23 @@ class Template extends \Magento\Framework\View\Element\Template
     /**
      * @param \Magento\Backend\Block\Template\Context $context
      * @param array $data
+     * @param JsonHelper|null $jsonHelper
+     * @param DirectoryHelper|null $directoryHelper
      */
-    public function __construct(\Magento\Backend\Block\Template\Context $context, array $data = [])
-    {
+    public function __construct(
+        \Magento\Backend\Block\Template\Context $context,
+        array $data = [],
+        ?JsonHelper $jsonHelper = null,
+        ?DirectoryHelper $directoryHelper = null
+    ) {
         $this->_localeDate = $context->getLocaleDate();
         $this->_authorization = $context->getAuthorization();
         $this->mathRandom = $context->getMathRandom();
         $this->_backendSession = $context->getBackendSession();
         $this->formKey = $context->getFormKey();
         $this->nameBuilder = $context->getNameBuilder();
+        $data['jsonHelper'] = $jsonHelper ?? ObjectManager::getInstance()->get(JsonHelper::class);
+        $data['directoryHelper']= $directoryHelper ?? ObjectManager::getInstance()->get(DirectoryHelper::class);
         parent::__construct($context, $data);
     }
 

app/code/Magento/Backend/Block/Widget/Form/Container.php

@@ -5,6 +5,10 @@
  */
 namespace Magento\Backend\Block\Widget\Form;
 
+use Magento\Backend\Block\Widget\Context;
+use Magento\Framework\App\ObjectManager;
+use Magento\Framework\View\Helper\SecureHtmlRenderer;
+
 /**
  * Backend form container block
  *
@@ -39,7 +43,7 @@ class Container extends \Magento\Backend\Block\Widget\Container
      * @var string
      */
     protected $_blockGroup = 'Magento_Backend';
-    
+
     /**
      *  @var string
      */
@@ -55,6 +59,25 @@ class Container extends \Magento\Backend\Block\Widget\Container
      */
     protected $_template = 'Magento_Backend::widget/form/container.phtml';
 
+    /**
+     * @var SecureHtmlRenderer
+     */
+    private $secureRenderer;
+
+    /**
+     * @param Context $context
+     * @param array $data
+     * @param SecureHtmlRenderer|null $secureRenderer
+     */
+    public function __construct(
+        Context $context,
+        array $data = [],
+        ?SecureHtmlRenderer $secureRenderer = null
+    ) {
+        $this->secureRenderer = $secureRenderer ?? ObjectManager::getInstance()->get(SecureHtmlRenderer::class);
+        parent::__construct($context, $data);
+    }
+
     /**
      * Initialize form.
      *
@@ -205,8 +228,14 @@ public function getFormHtml()
     public function getFormInitScripts()
     {
         if (!empty($this->_formInitScripts) && is_array($this->_formInitScripts)) {
-            return '<script>' . implode("\n", $this->_formInitScripts) . '</script>';
+            return $this->secureRenderer->renderTag(
+                'script',
+                [],
+                implode("\n", $this->_formInitScripts),
+                false
+            );
         }
+
         return '';
     }
 
@@ -218,8 +247,14 @@ public function getFormInitScripts()
     public function getFormScripts()
     {
         if (!empty($this->_formScripts) && is_array($this->_formScripts)) {
-            return '<script>' . implode("\n", $this->_formScripts) . '</script>';
+            return $this->secureRenderer->renderTag(
+                'script',
+                [],
+                implode("\n", $this->_formScripts),
+                false
+            );
         }
+
         return '';
     }
 

app/code/Magento/Backend/Block/Widget/Form/Element/Dependence.php

@@ -6,6 +6,9 @@
 
 namespace Magento\Backend\Block\Widget\Form\Element;
 
+use Magento\Framework\App\ObjectManager;
+use Magento\Framework\View\Helper\SecureHtmlRenderer;
+
 /**
  * Form element dependencies mapper
  * Assumes that one element may depend on other element values.
@@ -52,21 +55,29 @@ class Dependence extends \Magento\Backend\Block\AbstractBlock
      */
     protected $_jsonEncoder;
 
+    /**
+     * @var SecureHtmlRenderer
+     */
+    protected $secureRenderer;
+
     /**
      * @param \Magento\Backend\Block\Context $context
      * @param \Magento\Framework\Json\EncoderInterface $jsonEncoder
      * @param \Magento\Config\Model\Config\Structure\Element\Dependency\FieldFactory $fieldFactory
      * @param array $data
+     * @param SecureHtmlRenderer|null $secureRenderer
      */
     public function __construct(
         \Magento\Backend\Block\Context $context,
         \Magento\Framework\Json\EncoderInterface $jsonEncoder,
         \Magento\Config\Model\Config\Structure\Element\Dependency\FieldFactory $fieldFactory,
-        array $data = []
+        array $data = [],
+        ?SecureHtmlRenderer $secureRenderer = null
     ) {
         $this->_jsonEncoder = $jsonEncoder;
         $this->_fieldFactory = $fieldFactory;
         parent::__construct($context, $data);
+        $this->secureRenderer = $secureRenderer ?? ObjectManager::getInstance()->get(SecureHtmlRenderer::class);
     }
 
     /**
@@ -131,11 +142,11 @@ protected function _toHtml()
             $params .= ', ' .  $this->_jsonEncoder->encode($this->_configOptions);
         }
 
-        return "<script>
-require(['mage/adminhtml/form'], function(){
-    new FormElementDependenceController({$params});
-});
-</script>";
+        $scriptString = 'require([\'mage/adminhtml/form\'], function(){
+    new FormElementDependenceController(' . $params . ');
+});';
+
+        return /* @noEscape */ $this->secureRenderer->renderTag('script', [], $scriptString, false);
     }
 
     /**

app/code/Magento/Backend/Block/Widget/Form/Element/Gallery.php

@@ -6,7 +6,10 @@
 
 namespace Magento\Backend\Block\Widget\Form\Element;
 
+use Magento\Framework\App\ObjectManager;
 use Magento\Framework\Data\Form\Element\AbstractElement;
+use Magento\Framework\Json\Helper\Data as JsonHelper;
+use Magento\Backend\Block\Template\Context;
 
 /**
  * Backend image gallery item renderer
@@ -27,6 +30,18 @@ class Gallery extends \Magento\Backend\Block\Template implements
     protected $_template = 'Magento_Backend::widget/form/element/gallery.phtml';
 
     /**
+     * @param Context $context
+     * @param array $data
+     */
+    public function __construct(Context $context, array $data = [])
+    {
+        $data['jsonHelper'] = ObjectManager::getInstance()->get(JsonHelper::class);
+        parent::__construct($context, $data);
+    }
+
+    /**
+     * Renderer.
+     *
      * @param AbstractElement $element
      * @return string
      */
@@ -37,6 +52,8 @@ public function render(AbstractElement $element)
     }
 
     /**
+     * Set element.
+     *
      * @param AbstractElement $element
      * @return $this
      */
@@ -47,6 +64,8 @@ public function setElement(AbstractElement $element)
     }
 
     /**
+     * Get element.
+     *
      * @return AbstractElement|null
      */
     public function getElement()
@@ -55,6 +74,8 @@ public function getElement()
     }
 
     /**
+     * Get value.
+     *
      * @return array
      */
     public function getValues()
@@ -63,7 +84,7 @@ public function getValues()
     }
 
     /**
-     * {@inheritdoc}
+     * @inheritdoc
      */
     protected function _prepareLayout()
     {
@@ -82,6 +103,8 @@ protected function _prepareLayout()
     }
 
     /**
+     * Return add button.
+     *
      * @return string
      */
     public function getAddButtonHtml()
@@ -90,6 +113,8 @@ public function getAddButtonHtml()
     }
 
     /**
+     * Return delete button.
+     *
      * @param string $image
      * @return string|string[]
      */