From 1189a53427e428438f019764e4f2ee05c8a2a956 Mon Sep 17 00:00:00 2001
From: rGaillard <remi.gaillard@prestashop.com>
Date: Tue, 23 Oct 2012 13:04:27 +0000
Subject: [PATCH] [-] FO: Fix #PSCFV-5061

git-svn-id: http://dev.prestashop.com/svn/v1/branches/1.5.x@17924 b9a71923-0436-4b27-9f14-aed3839534dd
---
 .../template/controllers/customer_threads/message.tpl    | 2 +-
 controllers/front/OrderDetailController.php              | 9 +++++----
 themes/default/order-detail.tpl                          | 2 +-
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/admin-dev/themes/default/template/controllers/customer_threads/message.tpl b/admin-dev/themes/default/template/controllers/customer_threads/message.tpl
index a7360e528..6464a3b3a 100644
--- a/admin-dev/themes/default/template/controllers/customer_threads/message.tpl
+++ b/admin-dev/themes/default/template/controllers/customer_threads/message.tpl
@@ -152,7 +152,7 @@
 		</dl>
 		<dl>
 			<dt>{l s='Message:'}</dt>
-			<dd>{$message.message|nl2br}</dd>
+			<dd>{$message.message|escape:'htmlall':'UTF-8'|nl2br}</dd>
 		</dl>
 	</div>
 
diff --git a/controllers/front/OrderDetailController.php b/controllers/front/OrderDetailController.php
index 5433f1fb0..c6b466992 100644
--- a/controllers/front/OrderDetailController.php
+++ b/controllers/front/OrderDetailController.php
@@ -51,13 +51,13 @@ class OrderDetailControllerCore extends FrontController
 		if (Tools::isSubmit('submitMessage'))
 		{
 			$idOrder = (int)(Tools::getValue('id_order'));
-			$msgText = htmlentities(Tools::getValue('msgText'), ENT_COMPAT, 'UTF-8');
+			$msgText = Tools::getValue('msgText');
 
 			if (!$idOrder || !Validate::isUnsignedId($idOrder))
 				$this->errors[] = Tools::displayError('Order is no longer valid');
-			else if (empty($msgText))
+			elseif (empty($msgText))
 				$this->errors[] = Tools::displayError('Message cannot be blank');
-			else if (!Validate::isMessage($msgText))
+			elseif (!Validate::isMessage($msgText))
 				$this->errors[] = Tools::displayError('Message is invalid (HTML is not allowed)');
 			if (!count($this->errors))
 			{
@@ -86,7 +86,7 @@ class OrderDetailControllerCore extends FrontController
 					else
 						$ct = new CustomerThread((int)$id_customer_thread);
 					$cm->id_customer_thread = $ct->id;
-					$cm->message = Tools::htmlentitiesutf8($msgText);
+					$cm->message = $msgText;
 					$cm->ip_address = ip2long($_SERVER['REMOTE_ADDR']);
 					$cm->add();
 
@@ -196,6 +196,7 @@ class OrderDetailControllerCore extends FrontController
 					'customizedDatas' => $customizedDatas
 					/* DEPRECATED: customizedDatas @since 1.5 */
 				));
+
 				if ($carrier->url && $order->shipping_number)
 					$this->context->smarty->assign('followup', str_replace('@', $order->shipping_number, $carrier->url));
 				$this->context->smarty->assign('HOOK_ORDERDETAILDISPLAYED', Hook::exec('displayOrderDetail', array('order' => $order)));
diff --git a/themes/default/order-detail.tpl b/themes/default/order-detail.tpl
index b0f08517b..5ed0bb5fa 100644
--- a/themes/default/order-detail.tpl
+++ b/themes/default/order-detail.tpl
@@ -381,7 +381,7 @@
 						<br />
 						{dateFormat date=$message.date_add full=1}
 					</td>
-					<td>{$message.message|nl2br}</td>
+					<td>{$message.message|escape:'htmlall':'UTF-8'|nl2br}</td>
 				</tr>
 			{/foreach}
 			</tbody>