|
31 | 31 | use Magento\Quote\Model\QuoteIdMaskFactory; |
32 | 32 | use Magento\Store\Model\ScopeInterface; |
33 | 33 | use Magento\Ui\Component\Form\Element\Multiline; |
| 34 | +use Magento\Framework\Escaper; |
34 | 35 |
|
35 | 36 | /** |
36 | 37 | * Default Config Provider for checkout |
@@ -191,6 +192,11 @@ class DefaultConfigProvider implements ConfigProviderInterface |
191 | 192 | */ |
192 | 193 | private $configPostProcessor; |
193 | 194 |
|
| 195 | + /** |
| 196 | + * @var Escaper |
| 197 | + */ |
| 198 | + private $escaper; |
| 199 | + |
194 | 200 | /** |
195 | 201 | * @param CheckoutHelper $checkoutHelper |
196 | 202 | * @param Session $checkoutSession |
@@ -222,6 +228,7 @@ class DefaultConfigProvider implements ConfigProviderInterface |
222 | 228 | * @param AddressMetadataInterface $addressMetadata |
223 | 229 | * @param AttributeOptionManagementInterface $attributeOptionManager |
224 | 230 | * @param CustomerAddressDataProvider|null $customerAddressData |
| 231 | + * @param Escaper|null $escaper |
225 | 232 | * @codeCoverageIgnore |
226 | 233 | * @SuppressWarnings(PHPMD.ExcessiveParameterList) |
227 | 234 | */ |
@@ -255,7 +262,8 @@ public function __construct( |
255 | 262 | CaptchaConfigPostProcessorInterface $configPostProcessor, |
256 | 263 | AddressMetadataInterface $addressMetadata = null, |
257 | 264 | AttributeOptionManagementInterface $attributeOptionManager = null, |
258 | | - CustomerAddressDataProvider $customerAddressData = null |
| 265 | + CustomerAddressDataProvider $customerAddressData = null, |
| 266 | + Escaper $escaper = null |
259 | 267 | ) { |
260 | 268 | $this->checkoutHelper = $checkoutHelper; |
261 | 269 | $this->checkoutSession = $checkoutSession; |
@@ -289,6 +297,7 @@ public function __construct( |
289 | 297 | $this->customerAddressData = $customerAddressData ?: |
290 | 298 | ObjectManager::getInstance()->get(CustomerAddressDataProvider::class); |
291 | 299 | $this->configPostProcessor = $configPostProcessor; |
| 300 | + $this->escaper = $escaper ?? ObjectManager::getInstance()->get(Escaper::class); |
292 | 301 | } |
293 | 302 |
|
294 | 303 | /** |
@@ -343,6 +352,7 @@ public function getConfig() |
343 | 352 | 'shipping/shipping_policy/shipping_policy_content', |
344 | 353 | ScopeInterface::SCOPE_STORE |
345 | 354 | ); |
| 355 | + $policyContent = $this->escaper->escapeHtml($policyContent); |
346 | 356 | $output['shippingPolicy'] = [ |
347 | 357 | 'isEnabled' => $this->scopeConfig->isSetFlag( |
348 | 358 | 'shipping/shipping_policy/enable_shipping_policy', |
|
0 commit comments