AC-10528:Fix for Order Invoice Comment

Author: Devika-GL

app/code/Magento/Sales/Helper/Admin.php

@@ -201,7 +201,7 @@ public function escapeHtmlWithLinks($data, $allowedTags = null)
             $result = mb_decode_numericentity(
                 // phpcs:ignore Magento2.Functions.DiscouragedFunction
                 html_entity_decode(
-                    $domDocument->saveHTML(),
+                    htmlentities($domDocument->saveHTML()),
                     ENT_QUOTES|ENT_SUBSTITUTE,
                     'UTF-8'
                 ),

app/code/Magento/Sales/view/adminhtml/templates/order/comments/view.phtml

@@ -5,14 +5,13 @@
  */
 
 /** @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer */
-/** @var \Magento\Framework\Escaper $escaper */
 ?>
 <?php if ($_entity = $block->getEntity()): ?>
 <div id="comments_block" class="edit-order-comments">
     <div class="order-history-block">
         <div class="admin__field field-row">
             <label class="admin__field-label"
-                   for="history_comment"><?= $escaper->escapeHtml(__('Comment Text')) ?></label>
+                   for="history_comment"><?= $block->escapeHtml(__('Comment Text')) ?></label>
             <div class="admin__field-control">
                 <textarea name="comment[comment]"
                           class="admin__control-textarea"
@@ -31,7 +30,7 @@
                                id="history_notify"
                                value="1" />
                         <label class="admin__field-label"
-                               for="history_notify"><?= $escaper->escapeHtml(__('Notify Customer by Email')) ?></label>
+                               for="history_notify"><?= $block->escapeHtml(__('Notify Customer by Email')) ?></label>
                     </div>
                 <?php endif; ?>
                 <div class="admin__field admin__field-option">
@@ -41,7 +40,7 @@
                            class="admin__control-checkbox"
                            value="1" />
                     <label class="admin__field-label"
-                           for="history_visible"> <?= $escaper->escapeHtml(__('Visible on Storefront')) ?></label>
+                           for="history_visible"> <?= $block->escapeHtml(__('Visible on Storefront')) ?></label>
                 </div>
             </div>
             <div class="order-history-comments-actions">
@@ -60,20 +59,17 @@
                     <?= /* @noEscape */ $block->formatTime($_comment->getCreatedAt(), \IntlDateFormatter::MEDIUM) ?>
                 </span>
                 <span class="note-list-customer">
-                    <?= $escaper->escapeHtml(__('Customer')) ?>
+                    <?= $block->escapeHtml(__('Customer')) ?>
                     <?php if ($_comment->getIsCustomerNotified()): ?>
-                        <span class="note-list-customer-notified"><?= $escaper->escapeHtml(__('Notified')) ?></span>
+                        <span class="note-list-customer-notified"><?= $block->escapeHtml(__('Notified')) ?></span>
                     <?php else: ?>
                         <span class="note-list-customer-not-notified">
-                            <?= $escaper->escapeHtml(__('Not Notified')) ?>
+                            <?= $block->escapeHtml(__('Not Notified')) ?>
                         </span>
                     <?php endif; ?>
                 </span>
                 <div class="note-list-comment">
-                    <?= /* @noEscape */ nl2br($escaper->escapeHtml(
-                        $_comment->getComment(),
-                        ['b', 'br', 'strong', 'i', 'u', 'a']
-                    ))?>
+                    <?= $block->escapeHtml($_comment->getComment(), ['b', 'br', 'strong', 'i', 'u', 'a']) ?>
                 </div>
             </li>
         <?php endforeach; ?>
@@ -82,7 +78,7 @@
     <?php $scriptString = <<<script
 require(['prototype'], function(){
     submitComment = function() {
-        submitAndReloadArea($('comments_block').parentNode, '{$escaper->escapeJs($block->getSubmitUrl())}')
+        submitAndReloadArea($('comments_block').parentNode, '{$block->escapeJs($block->getSubmitUrl())}')
     };
     if ($('submit_comment_button')) {
         $('submit_comment_button').observe('click', submitComment);