escape download handler URLs
esc_url_raw to readfile home_url()
esc_url applied to readfile home_url()

This should fix it.

Thank you Mike for the info on esc_html.
Introduce woocommerce_pay_order_button_text and woocommerce_pay_order_button_html filters
Finnish with corrections, for WC 2.0.20
Set price slider min to min price. Closes #4183
Move sample tax rates Closes #4264
Inconsistent return types: TODOs
Suggested code changes in #4266
Clean up cancel_order and filter cancelable order status Closes #4257
Fixed faulty double return
Prevent error if variation doesn't exist.
Merge pull request #4260 from arhipaiva/master

Finnish with corrections, for WC 2.0.20
Merge pull request #4214 from toddlahman/master

escape download handler URLs
Esnure cron is scheduled for midnight Closes #4267
Use function for lost password url
Merge pull request #4242 from ragulka/pay-order-button-filter

Allow filtering Pay for order button text and html
removing unnecessary index.php file
Merge pull request #4274 from BFTrick/remove-index

Removing Unnecessary index.php File
Show names and urls for emails in plain text Closes #4259