Bug 1113630: Set window.opener to null for the URL field to prevent interaction betwe...

r=gerv a=glob

diff --git a/template/en/default/bug/edit.html.tmpl b/template/en/default/bug/edit.html.tmpl
index a7674faf856f7c502c4e1ee4b8e6f78961dceaa5..2eb850dd6b1d076c48f64547eeef9c1712f6633e 100644 (file)
--- a/template/en/default/bug/edit.html.tmpl
+++ b/template/en/default/bug/edit.html.tmpl
@@ -492,7 +492,7 @@
         <span id="bz_url_edit_container" class="bz_default_hidden"> 
         [% IF is_safe_url(bug.bug_file_loc) %]
            <a href="[% bug.bug_file_loc FILTER html %]" target="_blank"
-              title="[% bug.bug_file_loc FILTER html %]">
+              rel="noreferrer" title="[% bug.bug_file_loc FILTER html %]">
              [% bug.bug_file_loc FILTER truncate(40) FILTER html %]</a>
         [% ELSE %]
           [% bug.bug_file_loc FILTER html %]
@@ -503,7 +503,8 @@
         [% url_output =  PROCESS input no_td=1 inputname => "bug_file_loc" size => "40" colspan => 2 %]
         [% IF NOT bug.check_can_change_field("bug_file_loc", 0, 1)
               AND is_safe_url(bug.bug_file_loc) %]
-          <a href="[% bug.bug_file_loc FILTER html %]">[% url_output FILTER none %]</a>
+          <a href="[% bug.bug_file_loc FILTER html %]"
+             rel="noreferrer">[% url_output FILTER none %]</a>
         [% ELSE %]
           [% url_output FILTER none %]
         [% END %]

diff --git a/template/en/default/bug/show-multiple.html.tmpl b/template/en/default/bug/show-multiple.html.tmpl
index d3065abda42c526c2c43300d55e4133250ae68be..99dd53215b159c90dc9a932725b1b349d442782e 100644 (file)
--- a/template/en/default/bug/show-multiple.html.tmpl
+++ b/template/en/default/bug/show-multiple.html.tmpl
@@ -148,7 +148,7 @@
         <th>[% field_descs.bug_file_loc FILTER html %]:</th>
         <td colspan="3">
           [% IF is_safe_url(bug.bug_file_loc) %]
-            <a href="[% bug.bug_file_loc FILTER html %]">
+            <a href="[% bug.bug_file_loc FILTER html %]" rel="noreferrer">
                      [% bug.bug_file_loc FILTER html %]</a>
           [% ELSE %]
             [% bug.bug_file_loc FILTER html %]

diff --git a/template/en/default/list/table.html.tmpl b/template/en/default/list/table.html.tmpl
index fe7678b02171dc804bdd21b2078e635894600b68..d3abc9b211c10b0d669353ea9ac3ad2502a88660 100644 (file)
--- a/template/en/default/list/table.html.tmpl
+++ b/template/en/default/list/table.html.tmpl
@@ -213,7 +213,7 @@
         [%- bug.$column.truncate(256, '...') FILTER html -%]
       [% ELSIF column == 'bug_file_loc' && is_safe_url(bug.bug_file_loc) %]
         <a href="[% bug.bug_file_loc FILTER html %]" target="_blank"
-           title="[% bug.bug_file_loc FILTER html %]">
+           rel="noreferrer" title="[% bug.bug_file_loc FILTER html %]">
           [%- display_value(column, bug.$column).truncate(col_abbrev.maxlength, col_abbrev.ellipsis) FILTER html -%]
         </a>
       [% ELSE %]