Merge commit from fork

* Escape Admin Notification Labels

* Fix hard coded js reference to notification url

* Added escape to massaction template

* Removed escape from _prepareMassaction

Author: Judx

app/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Actions.php

@@ -21,28 +21,33 @@ class Mage_Adminhtml_Block_Notification_Grid_Renderer_Actions extends Mage_Admin
      */
     public function render(Varien_Object $row)
     {
-        $readDetailsHtml = ($row->getUrl())
-            ? '<a target="_blank" href="' . $row->getUrl() . '">' .
-                Mage::helper('adminnotification')->__('Read Details') . '</a> | '
+        $escapedRowUrl =  $this->escapeUrl($row->getUrl());
+        $readDetailsHtml = ($escapedRowUrl)
+            ? '<a target="_blank" href="' . $escapedRowUrl . '">' .
+                $this->escapeHtml(Mage::helper('adminnotification')->__('Read Details')) . '</a> | '
             : '';
 
         $markAsReadHtml = (!$row->getIsRead())
             ? '<a href="' . $this->getUrl('*/*/markAsRead/', ['_current' => true, 'id' => $row->getId()]) . '">' .
-                Mage::helper('adminnotification')->__('Mark as Read') . '</a> | '
+                $this->escapeHtml(Mage::helper('adminnotification')->__('Mark as Read')) . '</a> | '
             : '';
 
+        $deleteConfirmHtml = sprintf("deleteConfirm('%s', this.href)",
+            Mage::helper('core')->jsQuoteEscape(Mage::helper('adminnotification')->__('Are you sure?')),
+        );
+
         /** @var Mage_Core_Helper_Url $helper */
         $helper = $this->helper('core/url');
         return sprintf(
-            '%s%s<a href="%s" onClick="deleteConfirm(\'%s\', this.href); return false;">%s</a>',
+            '%s%s<a href="%s" onClick="%s; return false;">%s</a>',
             $readDetailsHtml,
             $markAsReadHtml,
             $this->getUrl('*/*/remove/', [
                 '_current' => true,
                 'id' => $row->getId(),
                 Mage_Core_Controller_Front_Action::PARAM_NAME_URL_ENCODED => $helper->getEncodedUrl()]),
-            Mage::helper('adminnotification')->__('Are you sure?'),
-            Mage::helper('adminnotification')->__('Remove'),
+            $deleteConfirmHtml,
+            $this->escapeHtml(Mage::helper('adminnotification')->__('Remove')),
         );
     }
 }

app/design/adminhtml/default/default/template/widget/grid/massaction.phtml

@@ -38,13 +38,13 @@
                                 <?php foreach($this->getGroupedItems() as $key => $group): ?>
                                     <?php if ($key === 'default'): ?>
                                         <?php foreach($group as $_item): ?>
-                                            <option value="<?php echo $_item->getId() ?>"<?php echo ($_item->getSelected() ? ' selected="selected"' : '')?>><?php echo $_item->getLabel() ?></option>
+                                            <option value="<?php echo $_item->getId() ?>"<?php echo ($_item->getSelected() ? ' selected="selected"' : '')?>><?php echo $this->escapeHtml($_item->getLabel()) ?></option>
                                         <?php endforeach ?>
                                     <?php elseif ($key === 'grouped'): ?>
                                         <?php foreach($group as $label => $_massGroup): ?>
                                             <optgroup label="<?php echo $this->quoteEscape($label); ?>">
                                                 <?php foreach($_massGroup as $_item): ?>
-                                                    <option value="<?php echo $_item->getId() ?>"<?php echo ($_item->getSelected() ? ' selected="selected"' : '')?>><?php echo $_item->getLabel() ?></option>
+                                                    <option value="<?php echo $_item->getId() ?>"<?php echo ($_item->getSelected() ? ' selected="selected"' : '')?>><?php echo $this->escapeHtml($_item->getLabel()) ?></option>
                                                 <?php endforeach ?>
                                             </optgroup>
                                         <?php endforeach ?>