I have a task to add a WYSIWYG editor on the admin order comments.
So far so good. I was able to make it work.
But I have a concern. By default order comments are escaped when listed and only a few tags are allowed on the backend.
echo $this->escapeHtml($_item->getComment(), array('b','br','strong','i','u')); //backend echo $this->escapeHtml($_historyItem->getComment()); //frontend
Also when sending the e-mail all tags are stripped.
$comment = trim(strip_tags($data['comment']));
I changed that to allow all HTML tags and it seams to work just fine, but who else writes these comments?
What I know so far is:
- The admins, manually - and I trust them
- Online payment methods when sending a payment update - and I trust them.
Should I look at something else?
I realized from the comments below that I may have not made this clear.
Everything seams to work ok, I don't have comments appearing out of nowhere, I'm just concerned if this is a good practice or should I be careful of something else that might post order comments.