Merge branch 'develop' into 4.3

# Conflicts: # CHANGELOG.md
craftcms · Sep 13, 2023 · e427677 · e427677
2 parents e08e474 + 3127d34
commit e427677
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 4 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -39,6 +39,7 @@
 - Added `craft\commerce\models\Discount::hasBillingAddressCondition()`.
 - Added `craft\commerce\models\Discount::hasShippingAddressCondition()`.
 - Deprecated `craft\commerce\elements\Order::setEmail()`. `Order::setCustomer()` should be used instead.
+- Fixed an XSS vulnerability.
 
 ## 4.2.11 - 2023-06-05
 

diff --git a/src/elements/Product.php b/src/elements/Product.php
@@ -1398,7 +1398,7 @@ protected function tableAttributeHtml(string $attribute): string
         switch ($attribute) {
             case 'type':
             {
-                return Craft::t('site', $productType->name);
+                return Craft::t('site', Html::encode($productType->name));
             }
             case 'defaultSku':
             {
@@ -1412,13 +1412,13 @@ protected function tableAttributeHtml(string $attribute): string
             {
                 $taxCategory = $this->getTaxCategory();
 
-                return Craft::t('site', $taxCategory->name);
+                return Craft::t('site', Html::encode($taxCategory->name));
             }
             case 'shippingCategory':
             {
                 $shippingCategory = $this->getShippingCategory();
 
-                return Craft::t('site', $shippingCategory->name);
+                return Craft::t('site', Html::encode($shippingCategory->name));
             }
             case 'defaultPrice':
             {

diff --git a/src/services/Emails.php b/src/services/Emails.php
@@ -891,7 +891,7 @@ private function _createEmailQuery(): Query
                 'emails.to',
                 'emails.uid',
             ])
-            ->orderBy('name')
+            ->orderBy('emails.name')
             ->from([Table::EMAILS . ' emails']);
     }