From c3a9c027b923f9bb96bb814867f4fa8e886b57c5 Mon Sep 17 00:00:00 2001
From: Gerhard <potgieterg@gmail.com>
Date: Fri, 13 Mar 2015 08:35:33 +0200
Subject: [PATCH] Reverse html encoding and pass through strip tags as tiptip
 runs encoded html, avoids xss

---
 includes/admin/class-wc-admin-post-types.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/includes/admin/class-wc-admin-post-types.php b/includes/admin/class-wc-admin-post-types.php
index 8ca6e5a1927..6d924a97464 100644
--- a/includes/admin/class-wc-admin-post-types.php
+++ b/includes/admin/class-wc-admin-post-types.php
@@ -477,9 +477,8 @@ class WC_Admin_Post_Types {
 
 			break;
 			case 'customer_message' :
-
 				if ( $the_order->customer_message ) {
-					echo '<span class="note-on tips" data-tip="' . esc_attr( $the_order->customer_message ) . '">' . __( 'Yes', 'woocommerce' ) . '</span>';
+					echo '<span class="note-on tips" data-tip="' . esc_attr( strip_tags( html_entity_decode( $the_order->customer_message ) ) ) . '">' . __( 'Yes', 'woocommerce' ) . '</span>';
 				} else {
 					echo '<span class="na">&ndash;</span>';
 				}
@@ -536,7 +535,8 @@ class WC_Admin_Post_Types {
 				if ( $post->comment_count ) {
 
 					// check the status of the post
-					$status       = ( 'trash' !== $post->post_status ) ? '' : 'post-trashed';
+					( $post->post_status !== 'trash' ) ? $status = '' : $status = 'post-trashed';
+
 					$latest_notes = get_comments( array(
 						'post_id'   => $post->ID,
 						'number'    => 1,