From 2e844fa78eba46f6b776a0cdc7ca92e51a037047 Mon Sep 17 00:00:00 2001
From: Chris Snedaker <df2002@gmail.com>
Date: Mon, 14 Jan 2019 00:42:43 -0500
Subject: [PATCH 1/2] Missing echo of php vars in widget template file -
 tabshoriz.phtml

---
 .../Backend/view/adminhtml/templates/widget/tabshoriz.phtml     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/code/Magento/Backend/view/adminhtml/templates/widget/tabshoriz.phtml b/app/code/Magento/Backend/view/adminhtml/templates/widget/tabshoriz.phtml
index 062528e742201..7b68a379caae9 100644
--- a/app/code/Magento/Backend/view/adminhtml/templates/widget/tabshoriz.phtml
+++ b/app/code/Magento/Backend/view/adminhtml/templates/widget/tabshoriz.phtml
@@ -18,7 +18,7 @@
     <?php $_tabType = (!preg_match('/\s?ajax\s?/', $_tabClass) && $block->getTabUrl($_tab) != '#') ? 'link' : '' ?>
     <?php $_tabHref = $block->getTabUrl($_tab) == '#' ? '#' . $block->getTabId($_tab) . '_content' : $block->getTabUrl($_tab) ?>
     <li>
-        <a href="<?= /* @escapeNotVerified */ $_tabHref ?>" id="<?= /* @escapeNotVerified */ $block->getTabId($_tab) ?>" title="<?= /* @escapeNotVerified */ $block->getTabTitle($_tab) ?>" class="<?php $_tabClass ?>" data-tab-type="<?php $_tabType ?>">
+        <a href="<?= /* @escapeNotVerified */ $_tabHref ?>" id="<?= /* @escapeNotVerified */ $block->getTabId($_tab) ?>" title="<?= /* @escapeNotVerified */ $block->getTabTitle($_tab) ?>" class="<?= $_tabClass ?>" data-tab-type="<?= $_tabType ?>">
             <span>
                 <span class="changed" title="<?= /* @escapeNotVerified */ __('The information in this tab has been changed.') ?>"></span>
                 <span class="error" title="<?= /* @escapeNotVerified */ __('This tab contains invalid data. Please resolve this before saving.') ?>"></span>

From cf0d2598ada2ac2e3f42a73c28096a04160dbdf7 Mon Sep 17 00:00:00 2001
From: Chris Snedaker <df2002@gmail.com>
Date: Mon, 14 Jan 2019 02:29:49 -0500
Subject: [PATCH 2/2] Escaped output of html attributes

---
 .../Backend/view/adminhtml/templates/widget/tabshoriz.phtml     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/code/Magento/Backend/view/adminhtml/templates/widget/tabshoriz.phtml b/app/code/Magento/Backend/view/adminhtml/templates/widget/tabshoriz.phtml
index 7b68a379caae9..c76f10da0f927 100644
--- a/app/code/Magento/Backend/view/adminhtml/templates/widget/tabshoriz.phtml
+++ b/app/code/Magento/Backend/view/adminhtml/templates/widget/tabshoriz.phtml
@@ -18,7 +18,7 @@
     <?php $_tabType = (!preg_match('/\s?ajax\s?/', $_tabClass) && $block->getTabUrl($_tab) != '#') ? 'link' : '' ?>
     <?php $_tabHref = $block->getTabUrl($_tab) == '#' ? '#' . $block->getTabId($_tab) . '_content' : $block->getTabUrl($_tab) ?>
     <li>
-        <a href="<?= /* @escapeNotVerified */ $_tabHref ?>" id="<?= /* @escapeNotVerified */ $block->getTabId($_tab) ?>" title="<?= /* @escapeNotVerified */ $block->getTabTitle($_tab) ?>" class="<?= $_tabClass ?>" data-tab-type="<?= $_tabType ?>">
+        <a href="<?= $block->escapeHtmlAttr($_tabHref) ?>" id="<?= $block->escapeHtmlAttr($block->getTabId($_tab)) ?>" title="<?= $block->escapeHtmlAttr($block->getTabTitle($_tab)) ?>" class="<?= $block->escapeHtmlAttr($_tabClass) ?>" data-tab-type="<?= $block->escapeHtmlAttr($_tabType) ?>">
             <span>
                 <span class="changed" title="<?= /* @escapeNotVerified */ __('The information in this tab has been changed.') ?>"></span>
                 <span class="error" title="<?= /* @escapeNotVerified */ __('This tab contains invalid data. Please resolve this before saving.') ?>"></span>