From f0ac15fe3a773eab1e137acbbe24a99c2d39b208 Mon Sep 17 00:00:00 2001
From: Iryna Stiahailo <irynastagaylo@gmail.com>
Date: Wed, 13 Jun 2018 12:08:03 +0300
Subject: [PATCH 1/2] Fix "escapeNotVerified".

---
 .../templates/items/column/name.phtml         | 26 ++++++++--------
 .../templates/items/column/qty.phtml          | 30 +++++++++----------
 2 files changed, 29 insertions(+), 27 deletions(-)

diff --git a/app/code/Magento/Sales/view/adminhtml/templates/items/column/name.phtml b/app/code/Magento/Sales/view/adminhtml/templates/items/column/name.phtml
index 27b8ca86b1681..a3be23b55c4ae 100644
--- a/app/code/Magento/Sales/view/adminhtml/templates/items/column/name.phtml
+++ b/app/code/Magento/Sales/view/adminhtml/templates/items/column/name.phtml
@@ -14,32 +14,34 @@
 ?>
 
 <?php if ($_item = $block->getItem()): ?>
-    <div id="order_item_<?= /* @escapeNotVerified */ $_item->getId() ?>_title"
+    <div id="order_item_<?= $block->escapeHtml($_item->getId()) ?>_title"
          class="product-title">
         <?= $block->escapeHtml($_item->getName()) ?>
     </div>
-
     <div class="product-sku-block">
-        <span><?= /* @escapeNotVerified */ __('SKU') ?>:</span> <?= implode('<br />', $this->helper('Magento\Catalog\Helper\Data')->splitSku($block->escapeHtml($block->getSku()))) ?>
+        <span><?= $block->escapeHtml(__('SKU'))?>:</span> <?= implode('<br />', $this->helper('Magento\Catalog\Helper\Data')->splitSku($block->escapeHtml($block->getSku()))) ?>
     </div>
 
     <?php if ($block->getOrderOptions()): ?>
         <dl class="item-options">
             <?php foreach ($block->getOrderOptions() as $_option): ?>
-                <dt><?= /* @escapeNotVerified */ $_option['label'] ?>:</dt>
+                <dt><?= $block->escapeHtml($_option['label']) ?>:</dt>
                 <dd>
                     <?php if (isset($_option['custom_view']) && $_option['custom_view']): ?>
-                        <?= /* @escapeNotVerified */ $block->getCustomizedOptionValue($_option) ?>
+                        <?= $block->escapeHtml($block->getCustomizedOptionValue($_option)) ?>
                     <?php else: ?>
                         <?php $_option = $block->getFormattedOption($_option['value']); ?>
-                        <?= /* @escapeNotVerified */ $_option['value'] ?><?php if (isset($_option['remainder']) && $_option['remainder']): ?><span id="<?= /* @escapeNotVerified */ $_dots = 'dots' . uniqid() ?>"> ...</span><span id="<?= /* @escapeNotVerified */ $_id = 'id' . uniqid() ?>"><?= /* @escapeNotVerified */ $_option['remainder'] ?></span>
+                        <?php $dots = 'dots' . uniqid(); ?>
+                        <?= $block->escapeHtml($_option['value']) ?><?php if (isset($_option['remainder']) && $_option['remainder']): ?> <span id="<?= /* @noEscape */ $dots; ?>"> ...</span>
+                            <?php  $id = 'id' . uniqid(); ?>
+                            <span id="<?= /* @noEscape */ $id; ?>"><?= $block->escapeHtml($_option['remainder']) ?></span>
                             <script>
-                                require(['prototype'], function() {
-                                    $('<?= /* @escapeNotVerified */ $_id ?>').hide();
-                                    $('<?= /* @escapeNotVerified */ $_id ?>').up().observe('mouseover', function(){$('<?= /* @escapeNotVerified */ $_id ?>').show();});
-                                    $('<?= /* @escapeNotVerified */ $_id ?>').up().observe('mouseover', function(){$('<?= /* @escapeNotVerified */ $_dots ?>').hide();});
-                                    $('<?= /* @escapeNotVerified */ $_id ?>').up().observe('mouseout',  function(){$('<?= /* @escapeNotVerified */ $_id ?>').hide();});
-                                    $('<?= /* @escapeNotVerified */ $_id ?>').up().observe('mouseout',  function(){$('<?= /* @escapeNotVerified */ $_dots ?>').show();});
+                                require(['prototype'], function() { 
+                                    $('<?= /* @noEscape */ $id; ?>').hide();
+                                    $('<?= /* @noEscape */ $id; ?>').up().observe('mouseover', function(){$('<?= /* @noEscape */ $id; ?>').show();});
+                                    $('<?= /* @noEscape */ $id; ?>').up().observe('mouseover', function(){$('<?= /* @noEscape */ $dots; ?>').hide();});
+                                    $('<?= /* @noEscape */ $id; ?>').up().observe('mouseout',  function(){$('<?= /* @noEscape */ $id; ?>').hide();});
+                                    $('<?= /* @noEscape */ $id; ?>').up().observe('mouseout',  function(){$('<?= /* @noEscape */ $dots; ?>').show();});
                                 });
                             </script>
                         <?php endif; ?>
diff --git a/app/code/Magento/Sales/view/adminhtml/templates/items/column/qty.phtml b/app/code/Magento/Sales/view/adminhtml/templates/items/column/qty.phtml
index faa49dca3a8eb..9bf4856795197 100644
--- a/app/code/Magento/Sales/view/adminhtml/templates/items/column/qty.phtml
+++ b/app/code/Magento/Sales/view/adminhtml/templates/items/column/qty.phtml
@@ -7,38 +7,38 @@
 // @codingStandardsIgnoreFile
 
 ?>
-<?php if ($_item = $block->getItem()): ?>
+<?php if ($item = $block->getItem()): ?>
 <table class="qty-table">
     <tr>
-        <th><?= /* @escapeNotVerified */ __('Ordered') ?></th>
-        <td><?= /* @escapeNotVerified */ $_item->getQtyOrdered()*1 ?></td>
+        <th><?= $block->escapeHtml(__('Ordered')); ?></th>
+        <td><?= /* @noEscape */  $item->getQtyOrdered()*1 ?></td>
     </tr>
 
-    <?php if ((float) $_item->getQtyInvoiced()): ?>
+    <?php if ((float) $item->getQtyInvoiced()): ?>
         <tr>
-            <th><?= /* @escapeNotVerified */ __('Invoiced') ?></th>
-            <td><?= /* @escapeNotVerified */ $_item->getQtyInvoiced()*1 ?></td>
+            <th><?= $block->escapeHtml(__('Invoiced')); ?></th>
+            <td><?= /* @noEscape */  $item->getQtyInvoiced()*1 ?></td>
         </tr>
     <?php endif; ?>
 
-    <?php if ((float) $_item->getQtyShipped()): ?>
+    <?php if ((float) $item->getQtyShipped()): ?>
         <tr>
-            <th><?= /* @escapeNotVerified */ __('Shipped') ?></th>
-            <td><?= /* @escapeNotVerified */ $_item->getQtyShipped()*1 ?></td>
+            <th><?= $block->escapeHtml(__('Shipped')); ?></th>
+            <td><?= /* @noEscape */  $item->getQtyShipped()*1 ?></td>
         </tr>
     <?php endif; ?>
 
-    <?php if ((float) $_item->getQtyRefunded()): ?>
+    <?php if ((float) $item->getQtyRefunded()): ?>
         <tr>
-            <th><?= /* @escapeNotVerified */ __('Refunded') ?></th>
-            <td><?= /* @escapeNotVerified */ $_item->getQtyRefunded()*1 ?></td>
+            <th><?= $block->escapeHtml(__('Refunded')); ?></th>
+            <td><?= /* @noEscape */ $item->getQtyRefunded()*1 ?></td>
         </tr>
     <?php endif; ?>
 
-    <?php if ((float) $_item->getQtyCanceled()): ?>
+    <?php if ((float) $item->getQtyCanceled()): ?>
         <tr>
-            <th><?= /* @escapeNotVerified */ __('Canceled') ?></th>
-            <td><?= /* @escapeNotVerified */ $_item->getQtyCanceled()*1 ?></td>
+            <th><?= $block->escapeHtml(__('Canceled')); ?></th>
+            <td><?= /* @noEscape */ $item->getQtyCanceled()*1 ?></td>
         </tr>
     <?php endif; ?>
 

From 997b259026512449795d8acda467d496d928a07b Mon Sep 17 00:00:00 2001
From: Iryna Stiahailo <irynastagaylo@gmail.com>
Date: Wed, 13 Jun 2018 16:25:53 +0300
Subject: [PATCH 2/2]  Replaced @escapeNotVerified annotations

---
 .../view/adminhtml/templates/items/column/name.phtml      | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/app/code/Magento/Sales/view/adminhtml/templates/items/column/name.phtml b/app/code/Magento/Sales/view/adminhtml/templates/items/column/name.phtml
index a3be23b55c4ae..ebdf79fe7f008 100644
--- a/app/code/Magento/Sales/view/adminhtml/templates/items/column/name.phtml
+++ b/app/code/Magento/Sales/view/adminhtml/templates/items/column/name.phtml
@@ -31,12 +31,14 @@
                         <?= $block->escapeHtml($block->getCustomizedOptionValue($_option)) ?>
                     <?php else: ?>
                         <?php $_option = $block->getFormattedOption($_option['value']); ?>
-                        <?php $dots = 'dots' . uniqid(); ?>
-                        <?= $block->escapeHtml($_option['value']) ?><?php if (isset($_option['remainder']) && $_option['remainder']): ?> <span id="<?= /* @noEscape */ $dots; ?>"> ...</span>
+                        <?= $block->escapeHtml($_option['value']) ?>
+                        <?php if (isset($_option['remainder']) && $_option['remainder']): ?>
+                            <?php $dots = 'dots' . uniqid(); ?>
+                            <span id="<?= /* @noEscape */ $dots; ?>"> ...</span>
                             <?php  $id = 'id' . uniqid(); ?>
                             <span id="<?= /* @noEscape */ $id; ?>"><?= $block->escapeHtml($_option['remainder']) ?></span>
                             <script>
-                                require(['prototype'], function() { 
+                                require(['prototype'], function(){
                                     $('<?= /* @noEscape */ $id; ?>').hide();
                                     $('<?= /* @noEscape */ $id; ?>').up().observe('mouseover', function(){$('<?= /* @noEscape */ $id; ?>').show();});
                                     $('<?= /* @noEscape */ $id; ?>').up().observe('mouseover', function(){$('<?= /* @noEscape */ $dots; ?>').hide();});