public/tt-rss
1
0
Fork 0
mirror of https://git.tt-rss.org/git/tt-rss.git synced 2025-12-13 17:25:55 +00:00
Code Issues Releases Wiki Activity

Prevent target='_blank' vulnerability on dynamic link

Browse Source
This commit is contained in:
Jérémy DECOOL
2017-02-12 11:01:36 +01:00
parent 2187322cae
commit ba2853caac
6 changed files with 25 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
classes/pref/prefs.php
View File

@@ -776,7 +776,7 @@ class Pref_Prefs extends Handler_Protected {
print "<td><label><img src='images/$plugin_icon' alt=''> $name</label></td>";
print "<td>" . htmlspecialchars($about[1]);
if (@$about[4]) {
print " &mdash; <a target=\"_blank\" class=\"visibleLink\"
print " &mdash; <a target=\"_blank\" rel=\"noopener noreferrer\" class=\"visibleLink\"
href=\"".htmlspecialchars($about[4])."\">".__("more info")."</a>";
}
print "</td>";
@@ -835,7 +835,7 @@ class Pref_Prefs extends Handler_Protected {
print "<td><label for='FPCHK-$name'><img src='images/$plugin_icon' alt=''> $name</label></td>";
print "<td><label for='FPCHK-$name'>" . htmlspecialchars($about[1]) . "</label>";
if (@$about[4]) {
print " &mdash; <a target=\"_blank\" class=\"visibleLink\"
print " &mdash; <a target=\"_blank\" rel=\"noopener noreferrer\" class=\"visibleLink\"
href=\"".htmlspecialchars($about[4])."\">".__("more info")."</a>";
}
print "</td>";