Additional escaping

Author: jissereitsma

view/adminhtml/templates/form/field_type/select.phtml

@@ -45,7 +45,7 @@ $fieldType = $field->getFieldType();
         ) ?>
     <?php endif; ?>
     <?php foreach ($options->toOptionArray() as $option) : ?>
-        <?= $option['level'] = 0; ?>
+        <?php $option['level'] = 0; ?>
         <?= /* @noEscape */ $templateRenderer->html(
             $block,
             'Loki_AdminComponents::form/field_type/select/option.phtml',

view/adminhtml/templates/form/field_type/select/option.phtml

@@ -13,9 +13,9 @@ use Loki\Components\Util\Block\TemplateRenderer;
 $option = $block->getOption();
 ?>
 <?php if (is_array($option['value'])): ?>
-    <optgroup label="<?= $escaper->escapeHtml(str_repeat('&nbsp;', $option['level'])) ?><?= $option['label'] ?>"></optgroup>
+    <optgroup label="<?= $escaper->escapeHtml(str_repeat('&nbsp;', $option['level'])) ?><?= $escaper->escapeHtml($option['label']) ?>"></optgroup>
     <?php foreach ($option['value'] as $suboption): ?>
-        <?= $suboption['level'] = $option['level'] + 1; ?>
+        <?php $suboption['level'] = $option['level'] + 1; ?>
         <?= /* @noEscape */ $templateRenderer->html(
             $block,
             'Loki_AdminComponents::form/field_type/select/option.phtml',
@@ -25,6 +25,6 @@ $option = $block->getOption();
 <?php else: ?>
     <option value="<?= $option['value'] ?>">
         <?= $escaper->escapeHtml(str_repeat('&nbsp;', $option['level'])) ?>
-        <?= $option['label'] ?>
+        <?= $escaper->escapeHtml($option['label']) ?>
     </option>
 <?php endif; ?>

view/adminhtml/templates/grid/cell/customer_id.phtml

@@ -15,4 +15,4 @@ $customerViewModel = $viewModelFactory->create(Customer::class);
 $customerId = (int)$block->getValue();
 $customer = $customerViewModel->getById($customerId);
 ?>
-<span><?= $escaper->escapeHtml($customerId) ?> (<?= $customer?->getEmail() ?>)</span>
+<span><?= $escaper->escapeHtml($customerId) ?> (<?= $escaper->escapeHtml($customer?->getEmail()) ?>)</span>