I have a task to add a WYSIWYG editor on the admin order comments.
So far so good. I was able to make it work.
But I have a concern. By default order comments are escaped when listed and only a few tags are allowed on the backend.

echo $this->escapeHtml($_item->getComment(), array('b','br','strong','i','u')); //backend
echo $this->escapeHtml($_historyItem->getComment());  //frontend

Also when sending the e-mail all tags are stripped.

$comment = trim(strip_tags($data['comment']));

I changed that to allow all HTML tags and it seams to work just fine, but who else writes these comments?

What I know so far is:

  1. The admins, manually - and I trust them
  2. Online payment methods when sending a payment update - and I trust them.

Should I look at something else?

I realized from the comments below that I may have not made this clear.
Everything seams to work ok, I don't have comments appearing out of nowhere, I'm just concerned if this is a good practice or should I be careful of something else that might post order comments.

  • Do you have anywhere in your site where the customer can add comments to orders? – jharrison.au Jul 3 '14 at 6:42
  • @jharrison.au Oh. I realize from your comment that maybe I asked the question wrong. I don't have comments appearing out of nowhere. I'm just concerned if what I did is a good idea or there are security issues with it. The website is a standard magento 1.7 with some extensions, but none of them touch the orders. Maybe the Ogone payment but that one I trust. – Marius Jul 3 '14 at 6:45
  • yes I understood, just making sure that users can't generate comments as well. I can't think of anything else that would be creating order comments, I would go for it – jharrison.au Jul 3 '14 at 6:52
  • To expand on @jharrison.au: if I as a customer can generate an order comment in checkout or customer account order view, then I can attack your backend. – Melvyn Jul 3 '14 at 7:04
  • @Melvyn. please don't attack my backend :)). No The customers can't write comments on their orders. Not even gift messages. – Marius Jul 3 '14 at 7:05

If in doubt about 3rd party comments, why not just wrap the method in a conditional statement.

Assuming that only your admin users need access to WYSIWIG/HTML comment support, then you could ensure it is only enabled for such. For API based comments (eg. Payment gateway notifications), then escape the HTML as normal.

I wouldn't trust any 3rd party to have unescaped HTML control over the comments (why expose the risk?).

It seems simple, trust no-one but your admin staff, only permit unescaped comments from those entering them via the admin (not via API).

  • Doh! I feel all Homer Simpson about this. Of course this is the obvious thing to do. And I implemented it this way, partially.To my surprise only the admin comments are not escaped when adding them in the way I implemented this. The only thing that is missing is differentiating between comments from admins and other ones for displaying them on frontend (escaped or raw). And I can just add a flag on the sales_flat_order_status_history table to make the difference. Thanks!. – Marius Jul 3 '14 at 8:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.