diff options
| author | Andrew Dolgov <[email protected]> | 2017-02-08 15:07:05 +0300 |
|---|---|---|
| committer | Andrew Dolgov <[email protected]> | 2017-02-08 15:07:05 +0300 |
| commit | 829d478f1b054c8ce1eeb4f15170dc4a1abb3e47 (patch) | |
| tree | 799d6af792c6062b1b46ef1ef746e46159a6894e /js/viewfeed.js | |
| parent | 23c8ef7e360816f6e6d03965303e6a26b54f2287 (diff) | |
add some protection against opener attacks if external site is opened via window.open()
Diffstat (limited to 'js/viewfeed.js')
| -rwxr-xr-x | js/viewfeed.js | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/js/viewfeed.js b/js/viewfeed.js index 1f597e226..dfbf8bced 100755 --- a/js/viewfeed.js +++ b/js/viewfeed.js @@ -1729,7 +1729,10 @@ function hlClicked(event, id) { function openArticleInNewWindow(id) { toggleUnread(id, 0, false); - window.open("backend.php?op=article&method=redirect&id=" + id); + + var w = window.open(""); + w.opener = null; + w.location = "backend.php?op=article&method=redirect&id=" + id; } function isCdmMode() { |