mitigate against browser phishing

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.10.0b4
+FROM python:3.9.6
 
 RUN apt-get update && apt-get install -y postgresql-client
 

tock/tock/static/js/components/timecard.js

@@ -254,7 +254,7 @@ function displayAlerts(selectBoxId) {
       alert_text =
         '<a href="' +
         alertData[i].url +
-        '" target="_blank">' +
+        '" target="_blank" rel="noopener noreferrer">' +
         alert_text +
         '</a>';
     }

tock/tock/templates/_navigation.html

@@ -9,7 +9,7 @@
         <a href="/" accesskey="1" title="Home" aria-label="Home">Tock your time</a>
       </li>
       <li class="usa-nav__primary-item">
-        <a class="usa-nav__link" href="{{ x_tock_change_request_form_url }}" target="_blank">
+        <a class="usa-nav__link" href="{{ x_tock_change_request_form_url }}" target="_blank"  rel="noopener noreferrer">
           <span class="usa-link--external">Request changes</span>
         </a>
       </li>

tock/tock/templates/base.html

@@ -90,16 +90,16 @@
       <nav class="grid-row grid-gap">
         <div class="grid-col-4">
           <p><i>The current release is <code>{{ x_tock_release_name }}</code>, <a class="usa-link--external"
-                href="{{ x_tock_release_url }}" title="{{ x_tock_release_name }}" target="_blank">view this release on
+                href="{{ x_tock_release_url }}" title="{{ x_tock_release_name }}" target="_blank"  rel="noopener noreferrer">view this release on
                 GitHub</a></i>.</p>
         </div>
         <div class="grid-col-4">
           <p><i>For questions, suggestions, or bug reports, please <a class="usa-link--external"
-                href="https://github.com/18f/tock/issues" target="_blank">file an issue</a>.</i></p>
+                href="https://github.com/18f/tock/issues" target="_blank" rel="noopener noreferrer">file an issue</a>.</i></p>
         </div>
         <div class="grid-col-4">
           <p><i>To change your previously submitted hours in Tock, please <a class="usa-link--external"
-                href="{{ x_tock_change_request_form_url }}" target="_blank">use the Tock Change Request Form</a>.</i>
+                href="{{ x_tock_change_request_form_url }}" target="_blank" rel="noopener noreferrer">use the Tock Change Request Form</a>.</i>
           </p>
         </div>
       </nav>

tock/tock/templates/projects/project_detail.html

@@ -49,7 +49,7 @@ <h1><a href="{% url 'projects:ProjectListView' %}">Tock Projects</a> / {{ object
           {% if object.alerts.exists %}
           {% for alert in object.alerts.all %}
           {% if alert.destination_url %}
-          <a href="{{ alert.destination_url }}" target="_blank"><span
+          <a href="{{ alert.destination_url }}" target="_blank" rel="noopener noreferrer"><span
               class="{{ alert.full_style }}">{{ alert.full_alert_text }}</span></a>
           {% else %}
           <span class="{{ alert.full_style }}">{{ alert.full_alert_text }}</span>

tock/tock/templates/projects/project_list.html

@@ -33,7 +33,7 @@ <h1>Tock Projects</h1>
         {% for alert in project.alerts.all %}
           <li>
             {% if alert.destination_url %}
-                <a href="{{ alert.destination_url }}" target="_blank"><span class="{{ alert.full_style }}">{{ alert.full_alert_text }}</span></a>
+                <a href="{{ alert.destination_url }}" target="_blank" rel="noopener noreferrer"><span class="{{ alert.full_style }}">{{ alert.full_alert_text }}</span></a>
             {% else %}
                 <span class="{{ alert.full_style }}">{{ alert.full_alert_text }}</span>
             {% endif %}
@@ -79,7 +79,7 @@ <h1>Tock Projects</h1>
         {% for alert in project.alerts.all %}
           <li>
             {% if alert.destination_url %}
-                <a href="{{ alert.destination_url }}" target="_blank"><span class="{{ alert.full_style }}">{{ alert.full_alert_text }}</span></a>
+                <a href="{{ alert.destination_url }}" target="_blank" rel="noopener noreferrer"><span class="{{ alert.full_style }}">{{ alert.full_alert_text }}</span></a>
             {% else %}
                 <span class="{{ alert.full_style }}">{{ alert.full_alert_text }}</span>
             {% endif %}

tock/tock/templates/uaa_client/login_error.html

@@ -4,6 +4,6 @@
 
   <h2>cloud.gov Login Error</h2>
 
-  <p>Oops! We weren't able to authenticate you. Please try logging in again or drop a message in <a href="https://slack.com/app_redirect?channel=C1JFYCX3P" target="_blank">#tock-dev</a> for help.</p>
+  <p>Oops! We weren't able to authenticate you. Please try logging in again or drop a message in <a href="https://slack.com/app_redirect?channel=C1JFYCX3P" target="_blank"  rel="noopener noreferrer">#tock-dev</a> for help.</p>
 
 {% endblock %}