From: Tooru Fujisawa <arai.unmht@gmail.com>
Date: Fri, 13 Jan 2017 22:27:58 +0000 (+0000)
Subject: Bug 1329511 - Any link to user-entered URL with target="_blank" should have rel=... 
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f1ad5506428db19b46a7d95d956e6ce477019036;p=thirdparty%2Fbugzilla.git

Bug 1329511 - Any link to user-entered URL with target="_blank" should have rel="noopener" or rel="noreferrer"
---

diff --git a/extensions/BugModal/template/en/default/bug_modal/activity_stream.html.tmpl b/extensions/BugModal/template/en/default/bug_modal/activity_stream.html.tmpl
index 4f9dd60b5..f5074dbfa 100644
--- a/extensions/BugModal/template/en/default/bug_modal/activity_stream.html.tmpl
+++ b/extensions/BugModal/template/en/default/bug_modal/activity_stream.html.tmpl
@@ -332,7 +332,7 @@
             "$terms.bug $see_also.bug_id" FILTER bug_link(see_also.bug_id);
           ELSE;
             %]
-            <a href="[% see_also.url FILTER html %]" target="_blank">[% see_also.url FILTER html %]</a>
+            <a href="[% see_also.url FILTER html %]" target="_blank" rel="noreferrer">[% see_also.url FILTER html %]</a>
             [%
           END;
           ", " UNLESS loop.last;
diff --git a/extensions/InlineHistory/template/en/default/hook/bug/comments-aftercomments.html.tmpl b/extensions/InlineHistory/template/en/default/hook/bug/comments-aftercomments.html.tmpl
index fb5d25225..c224a4e45 100644
--- a/extensions/InlineHistory/template/en/default/hook/bug/comments-aftercomments.html.tmpl
+++ b/extensions/InlineHistory/template/en/default/hook/bug/comments-aftercomments.html.tmpl
@@ -146,7 +146,7 @@
       [% IF see_also.bug_id %]
         [%~%][% "$terms.bug $see_also.bug_id" FILTER bug_link(see_also.bug_id) FILTER js %]
       [% ELSE %]
-        [%~%]<a href="[% see_also.url FILTER html FILTER js %]" target="_blank">
+        [%~%]<a href="[% see_also.url FILTER html FILTER js %]" target="_blank" rel="noreferrer">
         [%~%][% see_also.url FILTER html FILTER js %]</a>
       [% END %]
       [%- ", " IF NOT loop.last %]