Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added rel="noopener" to target="_blank" hrefs #327

Merged
merged 2 commits into from
Dec 2, 2016
Merged

Added rel="noopener" to target="_blank" hrefs #327

merged 2 commits into from
Dec 2, 2016

Conversation

Bwko
Copy link
Member

@Bwko Bwko commented Dec 1, 2016

Partially fixes #315
I've just ran a replace on gitea, replacing target="_blank" with target="_blank" rel="noopener"

@lunny
Copy link
Member

lunny commented Dec 1, 2016

But maybe only external URL needs this property?

@tboerger tboerger added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Dec 1, 2016
@Bwko
Copy link
Member Author

Bwko commented Dec 1, 2016

Yes but it can't hurt to add to internal URLs , since just replacing all the _blanks was the easiest solution

tboerger
tboerger reviewed Dec 1, 2016
View reviewed changes
Copy link
Member

@tboerger tboerger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not entirely related to the topic but we need to change that.

templates/base/footer.tmpl
<a target="_blank" href="https://twitter.com/gogitservice"><i class="fa fa-twitter"></i><span class="sr-only">Twitter</span></a>
<a target="_blank" href="http://weibo.com/gogschina"><i class="fa fa-weibo"></i><span class="sr-only">Sina Weibo</span></a>
<a target="_blank" rel="noopener" href="https://github.com/go-gitea/gitea"><i class="fa fa-github-square"></i><span class="sr-only">GitHub</span></a>
<a target="_blank" rel="noopener" href="https://twitter.com/gogitservice"><i class="fa fa-twitter"></i><span class="sr-only">Twitter</span></a>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to drop that

templates/base/footer.tmpl
<a target="_blank" href="http://weibo.com/gogschina"><i class="fa fa-weibo"></i><span class="sr-only">Sina Weibo</span></a>
<a target="_blank" rel="noopener" href="https://github.com/go-gitea/gitea"><i class="fa fa-github-square"></i><span class="sr-only">GitHub</span></a>
<a target="_blank" rel="noopener" href="https://twitter.com/gogitservice"><i class="fa fa-twitter"></i><span class="sr-only">Twitter</span></a>
<a target="_blank" rel="noopener" href="http://weibo.com/gogschina"><i class="fa fa-weibo"></i><span class="sr-only">Sina Weibo</span></a>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This as well

templates/base/head.tmpl
@@ -113,7 +113,7 @@
<i class="octicon octicon-settings"></i>
{{.i18n.Tr "your_settings"}}<!-- Your settings -->
</a>
<a class="item" target="_blank" href="https://gogs.io/docs" rel="noreferrer">
<a class="item" target="_blank" rel="noopener" href="https://gogs.io/docs" rel="noreferrer">
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://docs.gitea.io

templates/base/head.tmpl
@@ -137,7 +137,7 @@

{{else}}

<a class="item" target="_blank" href="https://gogs.io/docs" rel="noreferrer">{{.i18n.Tr "help"}}</a>
<a class="item" target="_blank" rel="noopener" href="https://gogs.io/docs" rel="noreferrer">{{.i18n.Tr "help"}}</a>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as above

templates/home.tmpl
@@ -20,15 +20,15 @@
<i class="octicon octicon-flame"></i> Einfach zu installieren
</h1>
<p class="large">
Starte einfach <a target="_blank" href="https://gogs.io/docs/installation/install_from_binary.html">die Anwendung</a> für deine Plattform. Gitea gibt es auch für <a target="_blank" href="https://github.com/go-gitea/gitea/tree/master/docker">Docker</a>, <a target="_blank" href="https://github.com/geerlingguy/ansible-vagrant-examples/tree/master/gogs">Vagrant</a> oder als <a target="_blank" href="https://gogs.io/docs/installation/install_from_packages.html">Installationspaket</a>.
Starte einfach <a target="_blank" rel="noopener" href="https://gogs.io/docs/installation/install_from_binary.html">die Anwendung</a> für deine Plattform. Gitea gibt es auch für <a target="_blank" rel="noopener" href="https://github.com/go-gitea/gitea/tree/master/docker">Docker</a>, <a target="_blank" rel="noopener" href="https://github.com/geerlingguy/ansible-vagrant-examples/tree/master/gogs">Vagrant</a> oder als <a target="_blank" rel="noopener" href="https://gogs.io/docs/installation/install_from_packages.html">Installationspaket</a>.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as above

templates/repo/issue/labels.tmpl
@@ -43,7 +43,7 @@
<div class="ui attached left aligned segment">
<h4 class="ui header">
{{.i18n.Tr "repo.issues.label_templates.title"}}
<a target="_blank"
<a target="_blank" rel="noopener"
href="https://discuss.gogs.io/t/how-to-use-predefined-label-templates/599">
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This link also won't work for us

@thibaultmeyer
Copy link
Contributor

LGTM

@tboerger tboerger added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Dec 1, 2016
@tboerger
Copy link
Member

tboerger commented Dec 1, 2016

LGTM

@tboerger tboerger added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Dec 1, 2016
@lunny lunny merged commit 5ab8537 into go-gitea:master Dec 2, 2016
@lunny lunny added this to the 1.0.0 milestone Dec 2, 2016
@Bwko Bwko deleted the noopener branch December 2, 2016 11:31
@tboerger tboerger added type/bug topic/security Something leaks user information or is otherwise vulnerable. Should be fixed! labels Dec 2, 2016
@ghost ghost mentioned this pull request Jun 27, 2018
Merged
@go-gitea go-gitea locked and limited conversation to collaborators Nov 23, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@tboerger tboerger tboerger left review comments

Assignees
No one assigned
Labels
lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. topic/security Something leaks user information or is otherwise vulnerable. Should be fixed! type/bug
Projects
None yet
Milestone
1.0.0
Development

Successfully merging this pull request may close these issues.

[security] target="_blank" without rel="noopener"
4 participants
@Bwko @lunny @thibaultmeyer @tboerger