public/tt-rss
1
0
Fork 0
mirror of https://git.tt-rss.org/git/tt-rss.git synced 2025-12-28 13:51:28 +00:00
Code Issues Releases Wiki Activity

Prevent target='_blank' vulnerability on dynamic link

Browse Source
This commit is contained in:
Jérémy DECOOL
2017-02-12 11:01:36 +01:00
parent 2187322cae
commit ba2853caac
6 changed files with 25 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
include/feedbrowser.php
View File

@@ -59,12 +59,12 @@
$class = ($feedctr % 2) ? "even" : "odd";
$site_url = "<a target=\"_blank\"
$site_url = "<a target=\"_blank\" rel=\"noopener noreferrer\"
href=\"$site_url\">
<span class=\"fb_feedTitle\">".
htmlspecialchars($line["title"])."</span></a>";
$feed_url = "<a target=\"_blank\" class=\"fb_feedUrl\"
$feed_url = "<a target=\"_blank\" rel=\"noopener noreferrer\" class=\"fb_feedUrl\"
href=\"$feed_url\"><img src='images/pub_set.png'
style='vertical-align : middle'></a>";
@@ -87,12 +87,12 @@
$archived = '';
}
$site_url = "<a target=\"_blank\"
$site_url = "<a target=\"_blank\" rel=\"noopener noreferrer\"
href=\"$site_url\">
<span class=\"fb_feedTitle\">".
htmlspecialchars($line["title"])."</span></a>";
$feed_url = "<a target=\"_blank\" class=\"fb_feedUrl\"
$feed_url = "<a target=\"_blank\" rel=\"noopener noreferrer\" class=\"fb_feedUrl\"
href=\"$feed_url\"><img src='images/pub_set.png'
style='vertical-align : middle'></a>";