Security fix: Escape html entities before passing to WP/photoswipe

[timbocode]

Backport of security update to includes/wc-template-functions.php from woocommerce/woocommerce@ffa230d

See also #214

Files changed

includes/wc-template-functions.php

[codecov-io]

Codecov Report

Merging #219 into master will decrease coverage by <.01%.
The diff coverage is 0%.

@@             Coverage Diff              @@
##             master     #219      +/-   ##
============================================
- Coverage     40.82%   40.82%   -0.01%     
  Complexity    13447    13447              
============================================
  Files           367      367              
  Lines         51277    51285       +8     
============================================
  Hits          20936    20936              
- Misses        30341    30349       +8

Impacted Files	Coverage Δ	Complexity Δ
includes/wc-template-functions.php	7.67% <0%> (-0.06%)	0 <0> (ø)
...shipping/flat-rate/includes/settings-flat-rate.php	97.95% <0%> (-2.05%)	0% <0%> (ø)
includes/class-wc-tax.php	79.67% <0%> (+0.27%)	130% <0%> (ø)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 548ee48...353fc76. Read the comment docs.

[nylen]

@bahiirwa it's a good idea to explain what was tested/reviewed, we shouldn't just check the "approved" box with no context.

See also #214 (comment) - we should probably make sure we agree on the approach we are using to review and approve these changes.

[timbocode]

Testing

• Manually checked the operation of Photoswipe. All seems to be OK.

[bahiirwa]

Testing

* Manually checked the operation of Photoswipe. All seems to be OK.

Same checks done. Manual testing as ordinary user.

[nylen]

I compared the changes here against woocommerce/woocommerce@ffa230d. This looks good 👍

[nylen]

This PR also effectively includes woocommerce/woocommerce@9eb31f5 and whatever later commit reformatted this code. I think this is ok, just noting for tracking purposes (#226).