Bug 16095: Remove target="_blank" when a link refer to an external link
If you click on a link that opens a new tab/window to another site, that tab
has access to the original window through JavaScript. The browsing context is
related, even if the domains are totally different.
The tab retains access to the original window's object via window.opener, even
if you navigate to another page or domain, in the new or original window.
Access to the Window object means the new window can use Window.location to
open a different URL in the original window, perfect for phishing attacks.
Depending on the site's Same-Origin Policy settings, the new window may have
access to other parts of the original window's DOM as well.
Any 'A HREF' that contains a target of of '_blank' or '_new' or a fixed name
is vulnerable. Previous security best practice often suggested creating a random
fixed name for an unpredictable namespace - that won't help with this problem!
Targets of '_self' and '_parent' are safe.
We do not use _new (at first glance) but several _blank. Some are used
to refer internal url, we do not need to update or remove them. Others
are used to satisfy OPACURLOpenInNewWindow, in these case, we should add
the rel="noreferrer" attribute to the a tags.
In other cases, we can simply remove them and let the users discover
that a mouse has more than one button (we are in 2016, they can do it!)
Signed-off-by: Chris <chrisc@catalyst.net.nz>
Signed-off-by: Jesse Weaver <jweaver@bywatersolutions.com>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
(cherry picked from commit 6c1b39b4cb)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
This commit is contained in:
Jonathan Druart
Julian Maurice
parent
8d0a57f524
commit
bf55fbd4d4
|
|
@ -708,12 +708,12 @@
|
|||
</ul>
|
||||
|
||||
<h2>jQuery Star Rating Plugin</h2>
|
||||
<p>jQuery Star Rating Plugin v3.14 by <a href="http://www.fyneworks.com/">Fyneworks.com</a> is licensed under the <a target="_blank" href="http://en.wikipedia.org/wiki/MIT_License">MIT License</a> and the <a target="_blank" href="http://creativecommons.org/licenses/GPL/2.0/">GPL License</a>.</p>
|
||||
<p>jQuery Star Rating Plugin v3.14 by <a href="http://www.fyneworks.com/">Fyneworks.com</a> is licensed under the <a href="http://en.wikipedia.org/wiki/MIT_License">MIT License</a> and the <a href="http://creativecommons.org/licenses/GPL/2.0/">GPL License</a>.</p>
|
||||
|
||||
<p>Copyright © 2008 <a href="http://www.fyneworks.com/">Fyneworks.com</a></p>
|
||||
|
||||
<h2>jQuery insertAtCaret Plugin</h2>
|
||||
<p>jQuery insertAtCaret Plugin v1.0 by the phpMyAdmin devel team is licensed under the <a target="_blank" href="http://www.gnu.org/licenses/gpl.html">GPL License</a>.</p>
|
||||
<p>jQuery insertAtCaret Plugin v1.0 by the phpMyAdmin devel team is licensed under the <a href="http://www.gnu.org/licenses/gpl.html">GPL License</a>.</p>
|
||||
|
||||
<p>Copyright © 2003-2010 phpMyAdmin devel team</p>
|
||||
|
||||
|
|
|
|||
|
|
@ -309,7 +309,7 @@ function delete_contact(ev) {
|
|||
<p><span class="label">Phone: </span>[% phone %]</p>
|
||||
<p><span class="label">Fax: </span>[% fax %]</p>
|
||||
[% IF ( url ) %]
|
||||
<p><span class="label">Website: </span><a href="[% url %]" target="_blank">[% url %]</a></p>
|
||||
<p><span class="label">Website: </span><a href="[% url %]">[% url %]</a></p>
|
||||
[% END %]
|
||||
[% IF ( accountnumber ) %]
|
||||
<p><span class="label">Account number: </span>[% accountnumber %]</p>
|
||||
|
|
|
|||
|
|
@ -199,7 +199,7 @@
|
|||
[% IF MARCurl.part %]<p>[% MARCurl.part %]</p>[% END %]
|
||||
|
||||
[% IF OPACURLOpenInNewWindow %]
|
||||
<a href="[% MARCurl.MARCURL %]" title="[% MARCurl.MARCURL %]" target="_blank">[% MARCurl.linktext %]</a>
|
||||
<a href="[% MARCurl.MARCURL %]" title="[% MARCurl.MARCURL %]" target="_blank" rel="noreferrer">[% MARCurl.linktext %]</a>
|
||||
[% ELSE %]
|
||||
<a href="[% MARCurl.MARCURL %]" title="[% MARCurl.MARCURL %]">[% MARCurl.linktext %]</a>
|
||||
[% END %]
|
||||
|
|
|
|||
|
|
@ -54,7 +54,7 @@
|
|||
[% END %]
|
||||
[% IF ( OPACAmazonCoverImages ) %]
|
||||
[% IF ( OPACURLOpenInNewWindow ) %]
|
||||
<a href="http://www.amazon[% AmazonTld %]/gp/reader/[% normalized_isbn %]/ref=sib_dp_pt/002-7879865-0184864#reader-link" target="_blank">
|
||||
<a href="http://www.amazon[% AmazonTld %]/gp/reader/[% normalized_isbn %]/ref=sib_dp_pt/002-7879865-0184864#reader-link" target="_blank" rel="noreferrer">
|
||||
[% ELSE %]
|
||||
<a href="http://www.amazon[% AmazonTld %]/dp/[% normalized_isbn %]">
|
||||
[% END %]
|
||||
|
|
@ -92,7 +92,7 @@
|
|||
[% IF ( BakerTaylorEnabled && bt_id ) %]
|
||||
[% IF BakerTaylorBookstoreURL %]
|
||||
[% IF ( OPACURLOpenInNewWindow ) %]
|
||||
<a href="https://[% BakerTaylorBookstoreURL |html %][% bt_id %]" target="_blank"><img alt="See Baker & Taylor" src="[% BakerTaylorImageURL |html %][% bt_id %]" /></a>
|
||||
<a href="https://[% BakerTaylorBookstoreURL |html %][% bt_id %]" target="_blank" rel="noreferrer"><img alt="See Baker & Taylor" src="[% BakerTaylorImageURL |html %][% bt_id %]" /></a>
|
||||
[% ELSE %]
|
||||
<a href="https://[% BakerTaylorBookstoreURL |html %][% bt_id %]"><img alt="See Baker & Taylor" src="[% BakerTaylorImageURL |html %][% bt_id %]" /></a>
|
||||
[% END %]
|
||||
|
|
@ -341,9 +341,9 @@
|
|||
|
||||
[% IF ( OPACURLOpenInNewWindow ) %]
|
||||
[% IF trackclicks == 'track' || trackclicks == 'anonymous' %]
|
||||
<a href="/cgi-bin/koha/tracklinks.pl?uri=[% MARCurl.MARCURL |url%]&biblionumber=[% biblionumber | url %]" title="[% MARCurl.MARCURL %]" target="_blank">
|
||||
<a href="/cgi-bin/koha/tracklinks.pl?uri=[% MARCurl.MARCURL |url%]&biblionumber=[% biblionumber | url %]" title="[% MARCurl.MARCURL %]" target="_blank" rel="noreferrer">
|
||||
[% ELSE %]
|
||||
<a href="[% MARCurl.MARCURL %]" title="[% MARCurl.MARCURL %]" target="_blank">
|
||||
<a href="[% MARCurl.MARCURL %]" title="[% MARCurl.MARCURL %]" target="_blank" rel="noreferrer">
|
||||
[% END %]
|
||||
[% ELSE %]
|
||||
[% IF trackclicks == 'track' || trackclicks == 'anonymous' %]
|
||||
|
|
@ -440,9 +440,9 @@
|
|||
<span class="results_summary">
|
||||
<span class="label">Series information:</span>
|
||||
[% IF ( using_https ) %]
|
||||
<a target="_blank" href="https://secure.syndetics.com/ffseries.aspx?isbn=[% normalized_isbn %]&type=series&num=1&client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&oclc=[% normalized_oclc %][% END %]">Click to open in new window</a>
|
||||
<a target="_blank" rel="noreferrer" href="https://secure.syndetics.com/ffseries.aspx?isbn=[% normalized_isbn %]&type=series&num=1&client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&oclc=[% normalized_oclc %][% END %]">Click to open in new window</a>
|
||||
[% ELSE %]
|
||||
<a target="_blank" href="http://www.syndetics.com/ffseries.aspx?isbn=[% normalized_isbn %]&type=series&num=1&client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&oclc=[% normalized_oclc %][% END %]">Click to open in new window</a>
|
||||
<a target="_blank" rel="noreferrer" href="http://www.syndetics.com/ffseries.aspx?isbn=[% normalized_isbn %]&type=series&num=1&client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&oclc=[% normalized_oclc %][% END %]">Click to open in new window</a>
|
||||
[% END %]
|
||||
</span>
|
||||
[% END # / IF SyndeticsSeries && SyndeticsSERIES1Exists%]
|
||||
|
|
@ -450,9 +450,9 @@
|
|||
<span class="results_summary">
|
||||
<span class="label">Audiovisual profile:</span>
|
||||
[% IF ( using_https ) %]
|
||||
<a target="_blank" href="https://secure.syndetics.com/index.aspx?isbn=[% normalized_isbn %]/avprofile.html&client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&oclc=[% normalized_oclc %][% END %]&type=xw10">Click to open in new window</a>
|
||||
<a target="_blank" rel="noreferrer" href="https://secure.syndetics.com/index.aspx?isbn=[% normalized_isbn %]/avprofile.html&client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&oclc=[% normalized_oclc %][% END %]&type=xw10">Click to open in new window</a>
|
||||
[% ELSE %]
|
||||
<a target="_blank" href="http://www.syndetics.com/index.aspx?isbn=[% normalized_isbn %]/avprofile.html&client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&oclc=[% normalized_oclc %][% END %]&type=xw10">Click to open in new window</a>
|
||||
<a target="_blank" rel="noreferrer" href="http://www.syndetics.com/index.aspx?isbn=[% normalized_isbn %]/avprofile.html&client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&oclc=[% normalized_oclc %][% END %]&type=xw10">Click to open in new window</a>
|
||||
[% END %]
|
||||
</span>
|
||||
[% END # / IF SyndeticsAVPROFILEExists %]
|
||||
|
|
@ -461,9 +461,9 @@
|
|||
<span class="results_summary">
|
||||
<span class="label">Fiction notes:</span>
|
||||
[% IF ( using_https ) %]
|
||||
<a target="_blank" href="https://secure.syndetics.com/index.aspx?isbn=[% normalized_isbn %]/fiction.html&client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&oclc=[% normalized_oclc %][% END %]&type=xw10">Click to open in new window</a>
|
||||
<a target="_blank" rel="noreferrer" href="https://secure.syndetics.com/index.aspx?isbn=[% normalized_isbn %]/fiction.html&client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&oclc=[% normalized_oclc %][% END %]&type=xw10">Click to open in new window</a>
|
||||
[% ELSE %]
|
||||
<a target="_blank" href="http://www.syndetics.com/index.aspx?isbn=[% normalized_isbn %]/fiction.html&client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&oclc=[% normalized_oclc %][% END %]&type=xw10">Click to open in new window</a>
|
||||
<a target="_blank" rel="noreferrer" href="http://www.syndetics.com/index.aspx?isbn=[% normalized_isbn %]/fiction.html&client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&oclc=[% normalized_oclc %][% END %]&type=xw10">Click to open in new window</a>
|
||||
[% END %]
|
||||
</span>
|
||||
[% END # / IF SyndeticsFICTIONExists %]
|
||||
|
|
@ -472,9 +472,9 @@
|
|||
<span class="results_summary">
|
||||
<span class="label">Awards:</span>
|
||||
[% IF ( using_https ) %]
|
||||
<a target="_blank" href="https://secure.syndetics.com/ffawards.aspx?isbn=[% normalized_isbn %]&type=awards&client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&oclc=[% normalized_oclc %][% END %]">Click to open in new window</a>
|
||||
<a target="_blank" rel="noreferrer" href="https://secure.syndetics.com/ffawards.aspx?isbn=[% normalized_isbn %]&type=awards&client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&oclc=[% normalized_oclc %][% END %]">Click to open in new window</a>
|
||||
[% ELSE %]
|
||||
<a target="_blank" href="http://www.syndetics.com/ffawards.aspx?isbn=[% normalized_isbn %]&type=awards&client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&oclc=[% normalized_oclc %][% END %]">Click to open in new window</a>
|
||||
<a target="_blank" rel="noreferrer" href="http://www.syndetics.com/ffawards.aspx?isbn=[% normalized_isbn %]&type=awards&client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&oclc=[% normalized_oclc %][% END %]">Click to open in new window</a>
|
||||
[% END %]
|
||||
</span>
|
||||
[% END # / IF SyndeticsAwards && SyndeticsAWARDS1Exists %]
|
||||
|
|
@ -519,7 +519,7 @@
|
|||
[% IF ( BakerTaylorContentURL ) %]
|
||||
<span class="results_summary">
|
||||
<span class="label">Enhanced content: </span>
|
||||
[% IF ( OPACURLOpenInNewWindow ) %]<a href="[% BakerTaylorContentURL |html %]" target="_blank">Content Cafe</a>[% ELSE %]<a href="[% BakerTaylorContentURL |html %]">Content Cafe</a>[% END %]
|
||||
[% IF ( OPACURLOpenInNewWindow ) %]<a href="[% BakerTaylorContentURL |html %]" target="_blank" rel="noreferrer">Content Cafe</a>[% ELSE %]<a href="[% BakerTaylorContentURL |html %]">Content Cafe</a>[% END %]
|
||||
</span>
|
||||
[% END # / IF BakerTaylorContentURL %]
|
||||
|
||||
|
|
@ -1278,13 +1278,13 @@
|
|||
[% IF ITEM_RESULT.uri %]
|
||||
[% IF trackclicks == 'track' || trackclicks == 'anonymous' %]
|
||||
[% IF Koha.Preference("OPACURLOpenInNewWindow") %]
|
||||
<a target="_blank" href="/cgi-bin/koha/tracklinks.pl?uri=[% ITEM_RESULT.uri | url %]&biblionumber=[% biblionumber |url %]&itemnumber=[% ITEM_RESULT.itemnumber | url %]" property="url"> Link to resource </a>
|
||||
<a target="_blank" rel="noreferrer" href="/cgi-bin/koha/tracklinks.pl?uri=[% ITEM_RESULT.uri | url %]&biblionumber=[% biblionumber |url %]&itemnumber=[% ITEM_RESULT.itemnumber | url %]" property="url"> Link to resource </a>
|
||||
[% ELSE %]
|
||||
<a href="/cgi-bin/koha/tracklinks.pl?uri=[% ITEM_RESULT.uri | url %]&biblionumber=[% biblionumber |url %]&itemnumber=[% ITEM_RESULT.itemnumber | url %]" property="url"> Link to resource </a>
|
||||
[% END %]
|
||||
[% ELSE %]
|
||||
[% IF Koha.Preference("OPACURLOpenInNewWindow") %]
|
||||
<a target="_blank" href="[% ITEM_RESULT.uri %]" property="url">[% ITEM_RESULT.uri %]</a>
|
||||
<a target="_blank" rel="noreferrer" href="[% ITEM_RESULT.uri %]" property="url">[% ITEM_RESULT.uri %]</a>
|
||||
[% ELSE %]
|
||||
<a href="[% ITEM_RESULT.uri %]" property="url">[% ITEM_RESULT.uri %]</a>
|
||||
[% END %]
|
||||
|
|
|
|||
|
|
@ -36,7 +36,7 @@
|
|||
<tr>
|
||||
<td>[% doc.citation %]</td>
|
||||
<td><a href="/cgi-bin/koha/opac-search.pl?q=ident:[% doc.ppn %]" target="_blank">Koha</a></td>
|
||||
<td><a href="http://www.sudoc.fr/[% doc.ppn %]" target="_blank">Sudoc</a></td>
|
||||
<td><a href="http://www.sudoc.fr/[% doc.ppn %]" target="_blank" rel="noreferrer">Sudoc</a></td>
|
||||
</tr>
|
||||
[% END %]
|
||||
</tbody>
|
||||
|
|
|
|||
|
|
@ -41,7 +41,7 @@ KOHA.Google = {
|
|||
gbsCallBack: function(booksInfo) {
|
||||
var target = '';
|
||||
if (this.openInNewWindow) {
|
||||
target = 'target="_blank" ';
|
||||
target = 'target="_blank" rel="noreferrer" ';
|
||||
}
|
||||
for (id in booksInfo) {
|
||||
var book = booksInfo[id];
|
||||
|
|
|
|||
Loading…
Reference in New Issue