From bb6d95d18b3f4ef41fb1f15084fee73f90aa320b Mon Sep 17 00:00:00 2001
From: vrielsa <sarah.vrielinck@phpro.be>
Date: Tue, 20 Apr 2021 19:46:43 +0200
Subject: [PATCH 1/2] Fix Massaction extended template

---
 .../templates/product/grid/massaction_extended.phtml      | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/code/Magento/Catalog/view/adminhtml/templates/product/grid/massaction_extended.phtml b/app/code/Magento/Catalog/view/adminhtml/templates/product/grid/massaction_extended.phtml
index 3ba507d2b3ebb..7668ad416d26e 100644
--- a/app/code/Magento/Catalog/view/adminhtml/templates/product/grid/massaction_extended.phtml
+++ b/app/code/Magento/Catalog/view/adminhtml/templates/product/grid/massaction_extended.phtml
@@ -75,19 +75,19 @@ script;
         $scriptString .= <<<script
                 case 'selectAll':
                     return {$block->escapeJs($block->getJsObjectName())}.selectAll();
-                    break
+                    break;
                 case 'unselectAll':
                     return {$block->escapeJs($block->getJsObjectName())}.unselectAll();
-                    break
+                    break;
 script;
     endif;
     $scriptString .= <<<script
                 case 'selectVisible':
                     return {$block->escapeJs($block->getJsObjectName())}.selectVisible();
-                    break
+                    break;
                 case 'unselectVisible':
                     return {$block->escapeJs($block->getJsObjectName())}.unselectVisible();
-                    break
+                    break;
             }
             this.blur();
         });

From ee427b25e8f29c710cfcfae939b1d2b36a2e6250 Mon Sep 17 00:00:00 2001
From: vrielsa <sarah.vrielinck@phpro.be>
Date: Tue, 20 Apr 2021 19:49:28 +0200
Subject: [PATCH 2/2] Use escaper

---
 .../product/grid/massaction_extended.phtml    | 22 +++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/app/code/Magento/Catalog/view/adminhtml/templates/product/grid/massaction_extended.phtml b/app/code/Magento/Catalog/view/adminhtml/templates/product/grid/massaction_extended.phtml
index 7668ad416d26e..94a2ee31b2e48 100644
--- a/app/code/Magento/Catalog/view/adminhtml/templates/product/grid/massaction_extended.phtml
+++ b/app/code/Magento/Catalog/view/adminhtml/templates/product/grid/massaction_extended.phtml
@@ -42,22 +42,22 @@
     </div>
 
     <div class="mass-select-wrap">
-        <select id="<?= $block->escapeHtmlAttr($block->getHtmlId()) ?>-mass-select" data-menu="grid-mass-select">
-            <optgroup label="<?= $block->escapeHtmlAttr(__('Mass Actions')) ?>">
+        <select id="<?= $escaper->escapeHtmlAttr($block->getHtmlId()) ?>-mass-select" data-menu="grid-mass-select">
+            <optgroup label="<?= $escaper->escapeHtmlAttr(__('Mass Actions')) ?>">
                 <option disabled selected></option>
                 <?php if ($block->getUseSelectAll()):?>
                     <option value="selectAll">
-                        <?= $block->escapeHtml(__('Select All')) ?>
+                        <?= $escaper->escapeHtml(__('Select All')) ?>
                     </option>
                     <option value="unselectAll">
-                        <?= $block->escapeHtml(__('Unselect All')) ?>
+                        <?= $escaper->escapeHtml(__('Unselect All')) ?>
                     </option>
                 <?php endif; ?>
                 <option value="selectVisible">
-                    <?= $block->escapeHtml(__('Select Visible')) ?>
+                    <?= $escaper->escapeHtml(__('Select Visible')) ?>
                 </option>
                 <option value="unselectVisible">
-                    <?= $block->escapeHtml(__('Unselect Visible')) ?>
+                    <?= $escaper->escapeHtml(__('Unselect Visible')) ?>
                 </option>
             </optgroup>
         </select>
@@ -74,19 +74,19 @@ script;
     if ($block->getUseSelectAll()):
         $scriptString .= <<<script
                 case 'selectAll':
-                    return {$block->escapeJs($block->getJsObjectName())}.selectAll();
+                    return {$escaper->escapeJs($block->getJsObjectName())}.selectAll();
                     break;
                 case 'unselectAll':
-                    return {$block->escapeJs($block->getJsObjectName())}.unselectAll();
+                    return {$escaper->escapeJs($block->getJsObjectName())}.unselectAll();
                     break;
 script;
     endif;
     $scriptString .= <<<script
                 case 'selectVisible':
-                    return {$block->escapeJs($block->getJsObjectName())}.selectVisible();
+                    return {$escaper->escapeJs($block->getJsObjectName())}.selectVisible();
                     break;
                 case 'unselectVisible':
-                    return {$block->escapeJs($block->getJsObjectName())}.unselectVisible();
+                    return {$escaper->escapeJs($block->getJsObjectName())}.unselectVisible();
                     break;
             }
             this.blur();
@@ -95,7 +95,7 @@ script;
     });
 script;
     if (!$block->getParentBlock()->canDisplayContainer()):
-        $scriptString .= $block->escapeJs($block->getJsObjectName()) . ".setGridIds('" .
+        $scriptString .= $escaper->escapeJs($block->getJsObjectName()) . ".setGridIds('" .
             /* @noEscape */ $block->getGridIdsJson() . "');";
     endif;
     ?>