From 03643bed9fe959a45f573b3ac654a68a731a6e50 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Fri, 18 Mar 2016 08:34:22 +0000 Subject: [PATCH] Bug 16095: Remove target="_blank" when a link refer to an external link MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit If you click on a link that opens a new tab/window to another site, that tab has access to the original window through JavaScript. The browsing context is related, even if the domains are totally different. The tab retains access to the original window's object via window.opener, even if you navigate to another page or domain, in the new or original window. Access to the Window object means the new window can use Window.location to open a different URL in the original window, perfect for phishing attacks. Depending on the site's Same-Origin Policy settings, the new window may have access to other parts of the original window's DOM as well. Any 'A HREF' that contains a target of of '_blank' or '_new' or a fixed name is vulnerable. Previous security best practice often suggested creating a random fixed name for an unpredictable namespace - that won't help with this problem! Targets of '_self' and '_parent' are safe. We do not use _new (at first glance) but several _blank. Some are used to refer internal url, we do not need to update or remove them. Others are used to satisfy OPACURLOpenInNewWindow, in these case, we should add the rel="noreferrer" attribute to the a tags. In other cases, we can simply remove them and let the users discover that a mouse has more than one button (we are in 2016, they can do it!) Signed-off-by: Chris Signed-off-by: Jesse Weaver Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com (cherry picked from commit 6c1b39b4cbceb1a414a91865e15612385c2eb5b7) Signed-off-by: Julian Maurice (cherry picked from commit bf55fbd4d42058487f1fef30f7dbfc24e6f8bad3) Signed-off-by: Frédéric Demians --- .../intranet-tmpl/prog/en/modules/about.tt | 4 +-- .../prog/en/modules/acqui/supplier.tt | 2 +- .../bootstrap/en/modules/opac-basket.tt | 2 +- .../bootstrap/en/modules/opac-detail.tt | 30 +++++++++---------- .../bootstrap/en/modules/opac-idref.tt | 2 +- .../opac-tmpl/bootstrap/js/google-jackets.js | 2 +- 6 files changed, 21 insertions(+), 21 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt index 754e558efe..5703340811 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt @@ -661,12 +661,12 @@

jQuery Star Rating Plugin

-

jQuery Star Rating Plugin v3.14 by Fyneworks.com is licensed under the MIT License and the GPL License.

+

jQuery Star Rating Plugin v3.14 by Fyneworks.com is licensed under the MIT License and the GPL License.

Copyright © 2008 Fyneworks.com

jQuery insertAtCaret Plugin

-

jQuery insertAtCaret Plugin v1.0 by the phpMyAdmin devel team is licensed under the GPL License.

+

jQuery insertAtCaret Plugin v1.0 by the phpMyAdmin devel team is licensed under the GPL License.

Copyright © 2003-2010 phpMyAdmin devel team

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt index 5bf8e614c3..96c37f4d0d 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt @@ -309,7 +309,7 @@ function delete_contact(ev) {

Phone: [% phone %]

Fax: [% fax %]

[% IF ( url ) %] -

Website: [% url %]

+

Website: [% url %]

[% END %] [% IF ( accountnumber ) %]

Account number: [% accountnumber %]

diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt index 94d5e0b60e..437b372af9 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt @@ -199,7 +199,7 @@ [% IF MARCurl.part %]

[% MARCurl.part %]

[% END %] [% IF OPACURLOpenInNewWindow %] - [% MARCurl.linktext %] + [% MARCurl.linktext %] [% ELSE %] [% MARCurl.linktext %] [% END %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt index 9b5b3e9358..de26bdcb25 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt @@ -54,7 +54,7 @@ [% END %] [% IF ( OPACAmazonCoverImages ) %] [% IF ( OPACURLOpenInNewWindow ) %] - + [% ELSE %] [% END %] @@ -91,7 +91,7 @@ [% IF ( BakerTaylorEnabled && normalized_isbn ) %] [% IF BakerTaylorBookstoreURL %] [% IF ( OPACURLOpenInNewWindow ) %] - See Baker & Taylor + See Baker & Taylor [% ELSE %] See Baker & Taylor [% END %] @@ -340,9 +340,9 @@ [% IF ( OPACURLOpenInNewWindow ) %] [% IF trackclicks == 'track' || trackclicks == 'anonymous' %] - + [% ELSE %] - + [% END %] [% ELSE %] [% IF trackclicks == 'track' || trackclicks == 'anonymous' %] @@ -439,9 +439,9 @@ Series information: [% IF ( using_https ) %] - Click to open in new window + Click to open in new window [% ELSE %] - Click to open in new window + Click to open in new window [% END %] [% END # / IF SyndeticsSeries && SyndeticsSERIES1Exists%] @@ -449,9 +449,9 @@ Audiovisual profile: [% IF ( using_https ) %] - Click to open in new window + Click to open in new window [% ELSE %] - Click to open in new window + Click to open in new window [% END %] [% END # / IF SyndeticsAVPROFILEExists %] @@ -460,9 +460,9 @@ Fiction notes: [% IF ( using_https ) %] - Click to open in new window + Click to open in new window [% ELSE %] - Click to open in new window + Click to open in new window [% END %] [% END # / IF SyndeticsFICTIONExists %] @@ -471,9 +471,9 @@ Awards: [% IF ( using_https ) %] - Click to open in new window + Click to open in new window [% ELSE %] - Click to open in new window + Click to open in new window [% END %] [% END # / IF SyndeticsAwards && SyndeticsAWARDS1Exists %] @@ -518,7 +518,7 @@ [% IF ( BakerTaylorContentURL ) %] Enhanced content: - [% IF ( OPACURLOpenInNewWindow ) %]Content Cafe[% ELSE %]Content Cafe[% END %] + [% IF ( OPACURLOpenInNewWindow ) %]Content Cafe[% ELSE %]Content Cafe[% END %] [% END # / IF BakerTaylorContentURL %] @@ -1277,13 +1277,13 @@ [% IF ITEM_RESULT.uri %] [% IF trackclicks == 'track' || trackclicks == 'anonymous' %] [% IF Koha.Preference("OPACURLOpenInNewWindow") %] - Link to resource + Link to resource [% ELSE %] Link to resource [% END %] [% ELSE %] [% IF Koha.Preference("OPACURLOpenInNewWindow") %] - [% ITEM_RESULT.uri %] + [% ITEM_RESULT.uri %] [% ELSE %] [% ITEM_RESULT.uri %] [% END %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt index c389c79d3d..4db0d1a2e2 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt @@ -36,7 +36,7 @@ [% doc.citation %] Koha - Sudoc + Sudoc [% END %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/js/google-jackets.js b/koha-tmpl/opac-tmpl/bootstrap/js/google-jackets.js index b23599f24f..307f683e99 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/js/google-jackets.js +++ b/koha-tmpl/opac-tmpl/bootstrap/js/google-jackets.js @@ -41,7 +41,7 @@ KOHA.Google = { gbsCallBack: function(booksInfo) { var target = ''; if (this.openInNewWindow) { - target = 'target="_blank" '; + target = 'target="_blank" rel="noreferrer" '; } for (id in booksInfo) { var book = booksInfo[id]; -- 2.39.5