summaryrefslogtreecommitdiffstats
path: root/template
diff options
context:
space:
mode:
authorFrédéric Buclin <LpSolit@gmail.com>2015-01-05 05:40:22 +0100
committerByron Jones <glob@mozilla.com>2015-01-05 05:40:22 +0100
commitb78ed6c10802fa83bc6eb70729a562866ad8f4c7 (patch)
treeb7b7efdc88b5f328d51f9cc85f05476ec0784db9 /template
parent66a9fc93e06ac364194a86c7269b662e1e227c60 (diff)
downloadbugzilla-b78ed6c10802fa83bc6eb70729a562866ad8f4c7.tar.gz
bugzilla-b78ed6c10802fa83bc6eb70729a562866ad8f4c7.tar.xz
Bug 1113630: Set window.opener to null for the URL field to prevent interaction between a remote script and the bug report
Diffstat (limited to 'template')
-rw-r--r--template/en/default/bug/edit.html.tmpl5
-rw-r--r--template/en/default/bug/show-multiple.html.tmpl2
2 files changed, 4 insertions, 3 deletions
diff --git a/template/en/default/bug/edit.html.tmpl b/template/en/default/bug/edit.html.tmpl
index 4ccf2a0a2..8057e4d02 100644
--- a/template/en/default/bug/edit.html.tmpl
+++ b/template/en/default/bug/edit.html.tmpl
@@ -595,7 +595,7 @@
[% IF bug.check_can_change_field("bug_file_loc", 0, 1) %]
<span id="bz_url_edit_container" class="bz_default_hidden">
<a href="[% bug.bug_file_loc FILTER html %]" target="_blank"
- title="[% bug.bug_file_loc FILTER html %]"
+ rel="noreferrer" title="[% bug.bug_file_loc FILTER html %]"
[% IF NOT is_safe_url(bug.bug_file_loc) %]
onclick="return confirm(
'This is considered an unsafe URL and could possibly be harmful. '
@@ -610,7 +610,8 @@
[% url_output = PROCESS input no_td=1 inputname => "bug_file_loc" size => "40" colspan => 2 %]
[% IF NOT bug.check_can_change_field("bug_file_loc", 0, 1)
AND is_safe_url(bug.bug_file_loc) %]
- <a href="[% bug.bug_file_loc FILTER html %]">[% url_output FILTER none %]</a>
+ <a href="[% bug.bug_file_loc FILTER html %]"
+ rel="noreferrer">[% url_output FILTER none %]</a>
[% ELSE %]
[% url_output FILTER none %]
[% END %]
diff --git a/template/en/default/bug/show-multiple.html.tmpl b/template/en/default/bug/show-multiple.html.tmpl
index cfd0d8e20..a0a4ecbf1 100644
--- a/template/en/default/bug/show-multiple.html.tmpl
+++ b/template/en/default/bug/show-multiple.html.tmpl
@@ -164,7 +164,7 @@
<th>[% field_descs.bug_file_loc FILTER html %]:</th>
<td colspan="3">
[% IF is_safe_url(bug.bug_file_loc) %]
- <a href="[% bug.bug_file_loc FILTER html %]">
+ <a href="[% bug.bug_file_loc FILTER html %]" rel="noreferrer">
[% bug.bug_file_loc FILTER html %]</a>
[% ELSE %]
[% bug.bug_file_loc FILTER html %]