Skip to content

Chore: Tax - Replace Block Escaping with Escaper #37165

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

Chore: Tax - Replace Block Escaping with Escaper #37165

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
14ca2ce
Chore: Tax - Replace Block Escaping with Escaper
pykettk Mar 9, 2023
d1754f4
Merge branch '2.4-develop' into tax-escaper
pykettk Mar 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 9 additions & 6 deletions app/code/Magento/Tax/view/adminhtml/templates/items/price/row.phtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,26 +3,29 @@
* Copyright © Magento, Inc. All rights reserved.
* See COPYING.txt for license details.
*/
declare(strict_types=1);

// phpcs:disable Magento2.Templates.ThisInTemplate
?>
<?php
/** @var \Magento\Tax\Block\Adminhtml\Items\Price\Renderer $block */
use Magento\Framework\Escaper;
use Magento\Tax\Block\Adminhtml\Items\Price\Renderer;

/** @var Escaper $escaper */
/** @var Renderer $block */
$_item = $block->getItem();

// phpcs:disable Magento2.Templates.ThisInTemplate
?>
<?php if ($block->displayBothPrices() || $block->displayPriceExclTax()) : ?>
<div class="price-excl-tax">
<?php if ($block->displayBothPrices()) : ?>
<span class="label"><?= $block->escapeHtml(__('Excl. Tax')) ?>:</span>
<span class="label"><?= $escaper->escapeHtml(__('Excl. Tax')) ?>:</span>
<?php endif; ?>
<?= /* @noEscape */ $block->displayPrices($_item->getBaseRowTotal(), $_item->getRowTotal()) ?>
</div>
<?php endif; ?>
<?php if ($block->displayBothPrices() || $block->displayPriceInclTax()) : ?>
<div class="price-incl-tax">
<?php if ($block->displayBothPrices()) : ?>
<span class="label"><?= $block->escapeHtml(__('Incl. Tax')) ?>:</span>
<span class="label"><?= $escaper->escapeHtml(__('Incl. Tax')) ?>:</span>
<?php endif; ?>
<?php $_incl = $this->helper(\Magento\Checkout\Helper\Data::class)->getSubtotalInclTax($_item); ?>
<?php $_baseIncl = $this->helper(\Magento\Checkout\Helper\Data::class)->getBaseSubtotalInclTax($_item); ?>
Expand Down
16 changes: 9 additions & 7 deletions app/code/Magento/Tax/view/adminhtml/templates/items/price/unit.phtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,19 +3,21 @@
* Copyright © Magento, Inc. All rights reserved.
* See COPYING.txt for license details.
*/
declare(strict_types=1);

// phpcs:disable Magento2.Templates.ThisInTemplate
?>
<?php
/** @var \Magento\Tax\Block\Adminhtml\Items\Price\Renderer $block */
use Magento\Framework\Escaper;
use Magento\Tax\Block\Adminhtml\Items\Price\Renderer;

/** @var Escaper $escaper */
/** @var Renderer $block */
$_item = $block->getItem();
?>

// phpcs:disable Magento2.Templates.ThisInTemplate
?>
<?php if ($this->helper(\Magento\Tax\Helper\Data::class)->displaySalesBothPrices() || $this->helper(\Magento\Tax\Helper\Data::class)->displaySalesPriceExclTax()) : ?>
<div class="price-excl-tax">
<?php if ($this->helper(\Magento\Tax\Helper\Data::class)->displaySalesBothPrices()) : ?>
<span class="label"><?= $block->escapeHtml(__('Excl. Tax')) ?>:</span>
<span class="label"><?= $escaper->escapeHtml(__('Excl. Tax')) ?>:</span>
<?php endif; ?>

<?= /* @noEscape */ $block->displayPrices($_item->getBasePrice(), $_item->getPrice()) ?>
Expand All @@ -24,7 +26,7 @@ $_item = $block->getItem();
<?php if ($this->helper(\Magento\Tax\Helper\Data::class)->displaySalesBothPrices() || $this->helper(\Magento\Tax\Helper\Data::class)->displaySalesPriceInclTax()) : ?>
<div class="price-incl-tax">
<?php if ($this->helper(\Magento\Tax\Helper\Data::class)->displaySalesBothPrices()) : ?>
<span class="label"><?= $block->escapeHtml(__('Incl. Tax')) ?>:</span>
<span class="label"><?= $escaper->escapeHtml(__('Incl. Tax')) ?>:</span>
<?php endif; ?>
<?php $_incl = $this->helper(\Magento\Checkout\Helper\Data::class)->getPriceInclTax($_item); ?>
<?php $_baseIncl = $this->helper(\Magento\Checkout\Helper\Data::class)->getBasePriceInclTax($_item); ?>
Expand Down
15 changes: 9 additions & 6 deletions app/code/Magento/Tax/view/adminhtml/templates/order/create/items/price/row.phtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,25 +3,28 @@
* Copyright © Magento, Inc. All rights reserved.
* See COPYING.txt for license details.
*/
declare(strict_types=1);

// phpcs:disable Magento2.Templates.ThisInTemplate
?>
<?php
/** @var \Magento\Tax\Block\Adminhtml\Items\Price\Renderer $block */
use Magento\Framework\Escaper;
use Magento\Tax\Block\Adminhtml\Items\Price\Renderer;

/** @var Escaper $escaper */
/** @var Renderer $block */
$_item = $block->getItem();

// phpcs:disable Magento2.Templates.ThisInTemplate
?>

<?php if ($block->displayPriceExclTax() || $block->displayBothPrices()) : ?>
<?php if ($block->displayBothPrices($block->getStore())) : ?>
<span class="label"><?= $block->escapeHtml(__('Excl. Tax')) ?>:</span>
<span class="label"><?= $escaper->escapeHtml(__('Excl. Tax')) ?>:</span>
<?php endif; ?>
<?= /* @noEscape */ $block->formatPrice($_item->getRowTotal()) ?>
<?php endif; ?>

<?php if ($block->displayPriceInclTax() || $block->displayBothPrices()) : ?>
<?php if ($block->displayBothPrices()) : ?>
<br /><span class="label"><?= $block->escapeHtml(__('Incl. Tax')) ?>:</span>
<br /><span class="label"><?= $escaper->escapeHtml(__('Incl. Tax')) ?>:</span>
<?php endif; ?>
<?php $_incl = $this->helper(\Magento\Checkout\Helper\Data::class)->getSubtotalInclTax($_item); ?>
<?= /* @noEscape */ $block->formatPrice($_incl) ?>
Expand Down
14 changes: 8 additions & 6 deletions app/code/Magento/Tax/view/adminhtml/templates/order/create/items/price/total.phtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,25 +3,27 @@
* Copyright © Magento, Inc. All rights reserved.
* See COPYING.txt for license details.
*/
?>
<?php
/** @var \Magento\Tax\Block\Adminhtml\Items\Price\Renderer $block */
declare(strict_types=1);

use Magento\Framework\Escaper;
use Magento\Tax\Block\Adminhtml\Items\Price\Renderer;

/** @var Escaper $escaper */
/** @var Renderer $block */
$_item = $block->getItem();
?>

<?php if ($block->displayPriceExclTax() || $block->displayBothPrices()) : ?>
<?php $_rowTotalWithoutDiscount = $_item->getRowTotal() - $_item->getTotalDiscountAmount(); ?>
<?php if ($block->displayBothPrices()) : ?>
<span class="label"><?= $block->escapeHtml(__('Excl. Tax')) ?>:</span>
<span class="label"><?= $escaper->escapeHtml(__('Excl. Tax')) ?>:</span>
<?php endif; ?>
<?= /* @noEscape */ $block->formatPrice(max(0, $_rowTotalWithoutDiscount)) ?>
<?php endif; ?>


<?php if ($block->displayPriceInclTax() || $block->displayBothPrices()) : ?>
<?php if ($block->displayBothPrices($block->getStore())) : ?>
<br /><span class="label"><?= $block->escapeHtml(__('Incl. Tax')) ?>:</span>
<br /><span class="label"><?= $escaper->escapeHtml(__('Incl. Tax')) ?>:</span>
<?php endif; ?>
<?php $_incl = $block->getTotalAmount($_item); ?>
<?= /* @noEscape */ $block->formatPrice($_incl) ?>
Expand Down
15 changes: 9 additions & 6 deletions app/code/Magento/Tax/view/adminhtml/templates/order/create/items/price/unit.phtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,26 +3,29 @@
* Copyright © Magento, Inc. All rights reserved.
* See COPYING.txt for license details.
*/
declare(strict_types=1);

// phpcs:disable Magento2.Templates.ThisInTemplate
?>
<?php
/** @var \Magento\Tax\Block\Adminhtml\Items\Price\Renderer $block */
use Magento\Framework\Escaper;
use Magento\Tax\Block\Adminhtml\Items\Price\Renderer;

/** @var Escaper $escaper */
/** @var Renderer $block */
$_item = $block->getItem();

// phpcs:disable Magento2.Templates.ThisInTemplate
?>

<?php if ($block->displayPriceExclTax() || $block->displayBothPrices()) : ?>
<?php if ($block->displayBothPrices()) : ?>
<span class="label"><?= $block->escapeHtml(__('Excl. Tax')) ?>:</span>
<span class="label"><?= $escaper->escapeHtml(__('Excl. Tax')) ?>:</span>
<?php endif; ?>
<?= /* @noEscape */ $block->formatPrice($_item->getCalculationPrice()) ?>
<?php endif; ?>


<?php if ($block->displayPriceInclTax() || $block->displayBothPrices()) : ?>
<?php if ($block->displayBothPrices()) : ?>
<br /><span class="label"><?= $block->escapeHtml(__('Incl. Tax')) ?>:</span>
<br /><span class="label"><?= $escaper->escapeHtml(__('Incl. Tax')) ?>:</span>
<?php endif; ?>
<?php $_incl = $this->helper(\Magento\Checkout\Helper\Data::class)->getPriceInclTax($_item); ?>
<?= /* @noEscape */ $block->formatPrice($_incl) ?>
Expand Down
13 changes: 9 additions & 4 deletions app/code/Magento/Tax/view/adminhtml/templates/rate/title.phtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,29 +3,34 @@
* Copyright © Magento, Inc. All rights reserved.
* See COPYING.txt for license details.
*/
declare(strict_types=1);

use Magento\Framework\Escaper;

/** @var Escaper $escaper */
?>
<fieldset id="tax-rate-titles-table" class="admin__fieldset">
<?php $_labels = $block->getTitles() ?>
<?php foreach ($block->getStores() as $_store) : ?>
<div class="admin__field">
<label class="admin__field-label">
<span><?= $block->escapeHtml($_store->getName()) ?></span>
<span><?= $escaper->escapeHtml($_store->getName()) ?></span>
</label>
<div class="admin__field-control">
<input
class="admin__control-text<?php if ($_store->getId() == 0) : ?> required-entry<?php endif; ?>"
type="text"
name="title[<?= (int) $_store->getId() ?>]"
value="<?= $block->escapeHtmlAttr($_labels[(int) $_store->getId()]) ?>" />
value="<?= $escaper->escapeHtmlAttr($_labels[(int) $_store->getId()]) ?>" />
</div>
</div>
<?php endforeach; ?>

<div class="messages">
<div class="message message-notice">
<div>
<strong><?= $block->escapeHtml(__('Note:')) ?></strong>
<?= $block->escapeHtml(__('Leave this field empty if you wish to use the tax identifier.')) ?>
<strong><?= $escaper->escapeHtml(__('Note:')) ?></strong>
<?= $escaper->escapeHtml(__('Leave this field empty if you wish to use the tax identifier.')) ?>
</div>
</div>
</div>
Expand Down
44 changes: 26 additions & 18 deletions app/code/Magento/Tax/view/adminhtml/templates/rule/edit.phtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,21 @@
* Copyright © Magento, Inc. All rights reserved.
* See COPYING.txt for license details.
*/
declare(strict_types=1);

/** @var $block \Magento\Tax\Block\Adminhtml\Rule\Edit\Form */
/** @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer */
?>
<?php $formElementId = /* @noEscape */ \Magento\Tax\Block\Adminhtml\Rate\Form::FORM_ELEMENT_ID;
use Magento\Framework\Escaper;
use Magento\Framework\View\Helper\SecureHtmlRenderer;
use Magento\Tax\Block\Adminhtml\Rule\Edit\Form;

/** @var Escaper $escaper */
/** @var Form $block */
/** @var SecureHtmlRenderer $secureRenderer */

$formElementId = /* @noEscape */ \Magento\Tax\Block\Adminhtml\Rate\Form::FORM_ELEMENT_ID;
$jsId = /* @noEscape */ $block->getJsId();

//phpcs:ignore Magento2.SQL.RawQuery

$scriptString = <<<script
require([
'jquery',
Expand Down Expand Up @@ -83,7 +91,7 @@ require([
$.ajax({
type: "POST",
data: {id:id},
url: '{$block->escapeJs($block->getTaxRateLoadUrl())}',
url: '{$escaper->escapeJs($block->getTaxRateLoadUrl())}',
success: function(result, status) {
$('body').trigger('processStop');
if (result.success) {
Expand All @@ -100,14 +108,14 @@ require([
});
else
alert({
content: '{$block->escapeJs(__('An error occurred'))}'
content: '{$escaper->escapeJs(__('An error occurred'))}'
});
}
},
error: function () {
$('body').trigger('processStop');
alert({
content: '{$block->escapeJs(__('An error occurred'))}'
content: '{$escaper->escapeJs(__('An error occurred'))}'
});
},
dataType: "json"
Expand All @@ -118,9 +126,9 @@ require([
var options = {
mselectContainer: '#tax_rate + section.mselect-list',
toggleAddButton:false,
addText: '{$block->escapeJs(__('Add New Tax Rate'))}',
addText: '{$escaper->escapeJs(__('Add New Tax Rate'))}',
parse: null,
nextPageUrl: '{$block->escapeJs($block->getTaxRatesPageUrl())}',
nextPageUrl: '{$escaper->escapeJs($block->getTaxRatesPageUrl())}',
selectedValues: this.settings.selected_values,
mselectInputSubmitCallback: function (value, options) {
var select = $('#tax_rate');
Expand Down Expand Up @@ -177,7 +185,7 @@ script;
rateValue = that.parent().find('input[type="checkbox"]').val();

confirm({
content: '{$block->escapeJs(__('Do you really want to delete this tax rate?'))}',
content: '{$escaper->escapeJs(__('Do you really want to delete this tax rate?'))}',
actions: {
/**
* Confirm action.
Expand All @@ -191,7 +199,7 @@ script;
form_key: $('input[name="form_key"]').val()
},
dataType: 'json',
url: '{$block->escapeJs($block->getTaxRateDeleteUrl())}',
url: '{$escaper->escapeJs($block->getTaxRateDeleteUrl())}',
success: function(result, status) {
$('body').trigger('processStop');
if (result.success) {
Expand All @@ -209,14 +217,14 @@ script;
});
else
alert({
content: '{$block->escapeJs(__('An error occurred'))}'
content: '{$escaper->escapeJs(__('An error occurred'))}'
});
}
},
error: function () {
$('body').trigger('processStop');
alert({
content: '{$block->escapeJs(__('An error occurred'))}'
content: '{$escaper->escapeJs(__('An error occurred'))}'
});
}
};
Expand All @@ -239,15 +247,15 @@ script;
taxRateFormElement.mage('form').mage('validation');

taxRateForm.dialogRates({
title: '{$block->escapeJs(__('Tax Rate'))}',
title: '{$escaper->escapeJs(__('Tax Rate'))}',
type: 'slide',
id: '{$jsId}',
modalClass: 'tax-rate-popup',
closed: function () {
taxRateFormElement.data('validation').clearError();
},
buttons: [{
text: '{$block->escapeJs(__('Save'))}',
text: '{$escaper->escapeJs(__('Save'))}',
'class': 'action-save action-primary',
click: function() {
this.updateItemRate();
Expand All @@ -272,7 +280,7 @@ $scriptString.= <<<script
type: 'POST',
data: itemRateData,
dataType: 'json',
url: '{$block->escapeJs($block->getTaxRateSaveUrl())}',
url: '{$escaper->escapeJs($block->getTaxRateSaveUrl())}',
success: function(result, status) {
$('body').trigger('processStop');
if (result.success) {
Expand All @@ -297,14 +305,14 @@ $scriptString.= <<<script
});
else
alert({
content: '{$block->escapeJs(__('An error occurred'))}'
content: '{$escaper->escapeJs(__('An error occurred'))}'
});
}
},
error: function () {
$('body').trigger('processStop');
alert({
content: '{$block->escapeJs(__('An error occurred'))}'
content: '{$escaper->escapeJs(__('An error occurred'))}'
});
}
};
Expand Down
11 changes: 8 additions & 3 deletions app/code/Magento/Tax/view/adminhtml/templates/rule/rate/form.phtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,14 +3,19 @@
* Copyright © Magento, Inc. All rights reserved.
* See COPYING.txt for license details.
*/
/* @var $block \Magento\Tax\Block\Adminhtml\Rate\Form */
?>
declare(strict_types=1);

use Magento\Framework\Escaper;
use Magento\Tax\Block\Adminhtml\Rate\Form;

/** @var Escaper $escaper */
/** @var Form $block */
?>
<div data-role="spinner" class="grid-loading-mask">
<div class="grid-loader"></div>
</div>

<div class="form-inline no-display" id="<?= $block->escapeHtmlAttr($block->getNameInLayout()) ?>">
<div class="form-inline no-display" id="<?= $escaper->escapeHtmlAttr($block->getNameInLayout()) ?>">
<?= $block->getFormHtml() ?>
<?= $block->getChildHtml('form_after') ?>
</div>
Loading