diff options
| author | Frédéric Buclin <LpSolit@gmail.com> | 2015-01-05 05:40:22 +0100 |
|---|---|---|
| committer | Byron Jones <glob@mozilla.com> | 2015-01-05 05:40:22 +0100 |
| commit | b78ed6c10802fa83bc6eb70729a562866ad8f4c7 (patch) | |
| tree | b7b7efdc88b5f328d51f9cc85f05476ec0784db9 /template | |
| parent | 66a9fc93e06ac364194a86c7269b662e1e227c60 (diff) | |
| download | bugzilla-b78ed6c10802fa83bc6eb70729a562866ad8f4c7.tar.gz bugzilla-b78ed6c10802fa83bc6eb70729a562866ad8f4c7.tar.xz | |
Bug 1113630: Set window.opener to null for the URL field to prevent interaction between a remote script and the bug report
Diffstat (limited to 'template')
| -rw-r--r-- | template/en/default/bug/edit.html.tmpl | 5 | ||||
| -rw-r--r-- | template/en/default/bug/show-multiple.html.tmpl | 2 |
2 files changed, 4 insertions, 3 deletions
diff --git a/template/en/default/bug/edit.html.tmpl b/template/en/default/bug/edit.html.tmpl index 4ccf2a0a2..8057e4d02 100644 --- a/template/en/default/bug/edit.html.tmpl +++ b/template/en/default/bug/edit.html.tmpl @@ -595,7 +595,7 @@ [% IF bug.check_can_change_field("bug_file_loc", 0, 1) %] <span id="bz_url_edit_container" class="bz_default_hidden"> <a href="[% bug.bug_file_loc FILTER html %]" target="_blank" - title="[% bug.bug_file_loc FILTER html %]" + rel="noreferrer" title="[% bug.bug_file_loc FILTER html %]" [% IF NOT is_safe_url(bug.bug_file_loc) %] onclick="return confirm( 'This is considered an unsafe URL and could possibly be harmful. ' @@ -610,7 +610,8 @@ [% url_output = PROCESS input no_td=1 inputname => "bug_file_loc" size => "40" colspan => 2 %] [% IF NOT bug.check_can_change_field("bug_file_loc", 0, 1) AND is_safe_url(bug.bug_file_loc) %] - <a href="[% bug.bug_file_loc FILTER html %]">[% url_output FILTER none %]</a> + <a href="[% bug.bug_file_loc FILTER html %]" + rel="noreferrer">[% url_output FILTER none %]</a> [% ELSE %] [% url_output FILTER none %] [% END %] diff --git a/template/en/default/bug/show-multiple.html.tmpl b/template/en/default/bug/show-multiple.html.tmpl index cfd0d8e20..a0a4ecbf1 100644 --- a/template/en/default/bug/show-multiple.html.tmpl +++ b/template/en/default/bug/show-multiple.html.tmpl @@ -164,7 +164,7 @@ <th>[% field_descs.bug_file_loc FILTER html %]:</th> <td colspan="3"> [% IF is_safe_url(bug.bug_file_loc) %] - <a href="[% bug.bug_file_loc FILTER html %]"> + <a href="[% bug.bug_file_loc FILTER html %]" rel="noreferrer"> [% bug.bug_file_loc FILTER html %]</a> [% ELSE %] [% bug.bug_file_loc FILTER html %] |