diff options
| author | Jérémy DECOOL <[email protected]> | 2017-02-12 11:01:36 +0100 |
|---|---|---|
| committer | Jérémy DECOOL <[email protected]> | 2017-02-12 11:01:36 +0100 |
| commit | ba2853caac636d2ae596d74561fa0233567242d4 (patch) | |
| tree | 9e46eabafcddd2e76cd0c8fc4c1498d0b1858757 /classes | |
| parent | 2187322caee25756d28983f069e291612023c6dc (diff) | |
Prevent target='_blank' vulnerability on dynamic link
Diffstat (limited to 'classes')
| -rwxr-xr-x | classes/feeds.php | 12 | ||||
| -rw-r--r-- | classes/pref/prefs.php | 4 |
2 files changed, 8 insertions, 8 deletions
diff --git a/classes/feeds.php b/classes/feeds.php index a41109383..6b96d8364 100755 --- a/classes/feeds.php +++ b/classes/feeds.php @@ -398,7 +398,7 @@ class Feeds extends Handler_Protected { alt=\"Publish article\" onclick='togglePub($id)'>"; } -# $content_link = "<a target=\"_blank\" href=\"".$line["link"]."\">" . +# $content_link = "<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"".$line["link"]."\">" . # $line["title"] . "</a>"; # $content_link = "<a @@ -616,7 +616,7 @@ class Feeds extends Handler_Protected { class=\"titleWrap $hlc_suffix\"> <a class=\"title $hlc_suffix\" title=\"".htmlspecialchars($line["title"])."\" - target=\"_blank\" href=\"". + target=\"_blank\" rel=\"noopener noreferrer\" href=\"". htmlspecialchars($line["link"])."\">". $line["title"] . "</a> <span class=\"author\">$entry_author</span>"; @@ -691,13 +691,13 @@ class Feeds extends Handler_Protected { $tmp_line = $this->dbh->fetch_assoc($tmp_result); - $reply['content'] .= "<a target='_blank' + $reply['content'] .= "<a target='_blank' rel='noopener noreferrer' href=' " . htmlspecialchars($tmp_line['site_url']) . "'>" . $tmp_line['title'] . "</a>"; $reply['content'] .= " "; - $reply['content'] .= "<a target='_blank' href='" . htmlspecialchars($tmp_line['feed_url']) . "'>"; + $reply['content'] .= "<a target='_blank' rel='noopener noreferrer' href='" . htmlspecialchars($tmp_line['feed_url']) . "'>"; $reply['content'] .= "<img title='".__('Feed URL')."'class='tinyFeedIcon' src='images/pub_unset.png'></a>"; $reply['content'] .= "</div>"; @@ -746,12 +746,12 @@ class Feeds extends Handler_Protected { $comments_url = htmlspecialchars($line["link"]); } $entry_comments = "<a class=\"postComments\" - target='_blank' href=\"$comments_url\">$num_comments ". + target='_blank' rel='noopener noreferrer' href=\"$comments_url\">$num_comments ". _ngettext("comment", "comments", $num_comments)."</a>"; } else { if ($line["comments"] && $line["link"] != $line["comments"]) { - $entry_comments = "<a class=\"postComments\" target='_blank' href=\"".htmlspecialchars($line["comments"])."\">".__("comments")."</a>"; + $entry_comments = "<a class=\"postComments\" target='_blank' rel='noopener noreferrer' href=\"".htmlspecialchars($line["comments"])."\">".__("comments")."</a>"; } } diff --git a/classes/pref/prefs.php b/classes/pref/prefs.php index 9a7ab55a0..ece9e8078 100644 --- a/classes/pref/prefs.php +++ b/classes/pref/prefs.php @@ -776,7 +776,7 @@ class Pref_Prefs extends Handler_Protected { print "<td><label><img src='images/$plugin_icon' alt=''> $name</label></td>"; print "<td>" . htmlspecialchars($about[1]); if (@$about[4]) { - print " — <a target=\"_blank\" class=\"visibleLink\" + print " — <a target=\"_blank\" rel=\"noopener noreferrer\" class=\"visibleLink\" href=\"".htmlspecialchars($about[4])."\">".__("more info")."</a>"; } print "</td>"; @@ -835,7 +835,7 @@ class Pref_Prefs extends Handler_Protected { print "<td><label for='FPCHK-$name'><img src='images/$plugin_icon' alt=''> $name</label></td>"; print "<td><label for='FPCHK-$name'>" . htmlspecialchars($about[1]) . "</label>"; if (@$about[4]) { - print " — <a target=\"_blank\" class=\"visibleLink\" + print " — <a target=\"_blank\" rel=\"noopener noreferrer\" class=\"visibleLink\" href=\"".htmlspecialchars($about[4])."\">".__("more info")."</a>"; } print "</td>"; |