mirror/Part-DB.Part-DB-server
1
0
Fork 1
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2025-06-21 01:25:55 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Added rel=noopener to target=_blank links to prevent window.opener spoof.

Browse source
This commit is contained in:
Jan Böhmer 2019-11-01 23:49:46 +01:00
parent 7a5a2f65f9
commit 9b481323aa
7 changed files with 10 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

2
assets/ts_src/event_listeners.ts
View file

@ -425,7 +425,7 @@ $(document).on("ajaxUI:start", function () {
$(this).removeAttr('data-markdown'); $(this).removeAttr('data-markdown');
//Make all links external //Make all links external
$('a', this).addClass('link-external').attr('target', '_blank'); $('a', this).addClass('link-external').attr('target', '_blank').attr('rel', 'noopener');
//Bootstrapify objects //Bootstrapify objects
$('table', this).addClass('table table-hover table-striped table-bordered'); $('table', this).addClass('table table-hover table-striped table-bordered');
}); });

4
templates/AdminPages/_attachments.html.twig
View file

@ -43,11 +43,11 @@
</h6> </h6>
{% endif %} {% endif %}
{% if attach.picture %} {% if attach.picture %}
<a href="{{ attach | entityURL('file_view') }}" target="_blank" data-no-ajax> <a href="{{ attach | entityURL('file_view') }}" target="_blank" rel="noopener" data-no-ajax>
<img class="img-fluid img-thumbnail thumbnail-sm" src="{{ attachment_thumbnail(attach, 'thumbnail_md') }}" alt="{% trans %}attachment.preview.alt{% endtrans %}" /> <img class="img-fluid img-thumbnail thumbnail-sm" src="{{ attachment_thumbnail(attach, 'thumbnail_md') }}" alt="{% trans %}attachment.preview.alt{% endtrans %}" />
</a> </a>
{% else %} {% else %}
<a href="{{ attach | entityURL('file_view') }}" target="_blank" data-no-ajax class="link-external">{% trans %}attachment.view{% endtrans %}</a> <a href="{{ attach | entityURL('file_view') }}" rel="noopener" target="_blank" data-no-ajax class="link-external">{% trans %}attachment.view{% endtrans %}</a>
{% endif %} {% endif %}
{% else %} {% else %}
<br><br> <br><br>

4
templates/Parts/edit/_attachments.html.twig
View file

@ -41,11 +41,11 @@
{% endif %} {% endif %}
{% if attach.picture %} {% if attach.picture %}
<a href="{{ attach | entityURL('file_view') }}" target="_blank" data-no-ajax> <a href="{{ attach | entityURL('file_view') }}" rel="noopener" target="_blank" data-no-ajax>
<img class="img-fluid img-thumbnail thumbnail-sm" src="{{ attachment_thumbnail(attach, 'thumbnail_md') }}" alt="{% trans %}attachment.preview.alt{% endtrans %}" /> <img class="img-fluid img-thumbnail thumbnail-sm" src="{{ attachment_thumbnail(attach, 'thumbnail_md') }}" alt="{% trans %}attachment.preview.alt{% endtrans %}" />
</a> </a>
{% else %} {% else %}
<a href="{{ attach | entityURL('file_view') }}" target="_blank" data-no-ajax class="link-external">{% trans %}attachment.view{% endtrans %}</a> <a href="{{ attach | entityURL('file_view') }}" rel="noopener" target="_blank" data-no-ajax class="link-external">{% trans %}attachment.view{% endtrans %}</a>
{% endif %} {% endif %}
{% else %} {% else %}
<br><br> <br><br>

4
templates/Parts/info/_attachments_info.html.twig
View file

@ -24,7 +24,7 @@
<td class="align-middle">{{ attachment.attachmentType.fullPath }}</td> <td class="align-middle">{{ attachment.attachmentType.fullPath }}</td>
<td class="align-middle"> <td class="align-middle">
{% if attachment.external %} {% if attachment.external %}
<a href="{{ attachment.uRL }}" target="_blank" class="link-external">{{ attachment.host }}</a> <a href="{{ attachment.uRL }}" rel="noopener" target="_blank" class="link-external">{{ attachment.host }}</a>
{% else %} {% else %}
{{ attachment.filename }} {{ attachment.filename }}
{% endif %} {% endif %}
@ -42,7 +42,7 @@
<td><div class="btn-group" role="group" aria-label=""> <td><div class="btn-group" role="group" aria-label="">
<a {% if attachment_helper.fileExisting(attachment) %}href="{{ attachment|entityURL('file_view') }}"{% endif %} target="_blank" <a {% if attachment_helper.fileExisting(attachment) %}href="{{ attachment|entityURL('file_view') }}"{% endif %} target="_blank"
class="btn btn-secondary {% if not attachment_helper.fileExisting(attachment) %}disabled{% endif %}" class="btn btn-secondary {% if not attachment_helper.fileExisting(attachment) %}disabled{% endif %}"
data-no-ajax title="{% trans %}attachment.view{% endtrans %}"> data-no-ajax title="{% trans %}attachment.view{% endtrans %}" rel="noopener">
<i class="fas fa-eye fa-fw"></i> <i class="fas fa-eye fa-fw"></i>
</a> </a>
<a {% if attachment_helper.fileExisting(attachment) %}href="{{ attachment|entityURL('file_download') }}"{% endif %} data-no-ajax <a {% if attachment_helper.fileExisting(attachment) %}href="{{ attachment|entityURL('file_download') }}"{% endif %} data-no-ajax

2
templates/Parts/info/_main_infos.html.twig
View file

@ -15,7 +15,7 @@
{% endif %} {% endif %}
{% if part.manufacturerProductUrl %} {% if part.manufacturerProductUrl %}
<small> <small>
<a class="link-external" href="{{ part.manufacturerProductUrl }}" target="_blank">{{ part.manufacturerProductNumber }}</a> <a class="link-external" href="{{ part.manufacturerProductUrl }}" rel="noopener" target="_blank">{{ part.manufacturerProductNumber }}</a>
</small> </small>
{% else %} {% else %}
<small>{{ part.manufacturerProductNumber }}</small> <small>{{ part.manufacturerProductNumber }}</small>

2
templates/Parts/info/_order_infos.html.twig
View file

@ -15,7 +15,7 @@
<a href="{{ order.supplier | entityURL('list_parts') }}">{{ order.supplier.name }}</a> <a href="{{ order.supplier | entityURL('list_parts') }}">{{ order.supplier.name }}</a>
</td> </td>
<td>{% if order.supplierProductUrl is not empty %} <td>{% if order.supplierProductUrl is not empty %}
<a href="{{ order.supplierProductUrl }}" target="_blank" class="link-external">{{ order.supplierPartNr }}</a> <a href="{{ order.supplierProductUrl }}" rel="noopener" target="_blank" class="link-external">{{ order.supplierPartNr }}</a>
{% else %} {% else %}
{{ order.supplierPartNr }} {{ order.supplierPartNr }}
{% endif %} {% endif %}

2
templates/helper.twig
View file

@ -36,7 +36,7 @@
{% macro attachment_icon(attachment, attachment_helper, class = "fa-fw fas fa-3x", link = true) %} {% macro attachment_icon(attachment, attachment_helper, class = "fa-fw fas fa-3x", link = true) %}
{% if not attachment_helper or attachment_helper.fileExisting(attachment) %} {% if not attachment_helper or attachment_helper.fileExisting(attachment) %}
<a target="_blank" data-no-ajax href="{% if link %}{{ attachment|entityURL('file_view') }}{% endif %}"> <a target="_blank" data-no-ajax rel="noopener" href="{% if link %}{{ attachment|entityURL('file_view') }}{% endif %}">
{% if attachment.picture %} {% if attachment.picture %}
<img class="hoverpic" src="{{ attachment|entityURL('file_view') }}"> <img class="hoverpic" src="{{ attachment|entityURL('file_view') }}">
{% else %} {% else %}