From b78ed6c10802fa83bc6eb70729a562866ad8f4c7 Mon Sep 17 00:00:00 2001
From: Frédéric Buclin <LpSolit@gmail.com>
Date: Mon, 5 Jan 2015 12:40:22 +0800
Subject: Bug 1113630: Set window.opener to null for the URL field to prevent
 interaction between a remote script and the bug report

---
 .../template/en/default/hook/bug/comments-aftercomments.html.tmpl       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'extensions/InlineHistory/template/en')

diff --git a/extensions/InlineHistory/template/en/default/hook/bug/comments-aftercomments.html.tmpl b/extensions/InlineHistory/template/en/default/hook/bug/comments-aftercomments.html.tmpl
index d75c69f78..d9871e43f 100644
--- a/extensions/InlineHistory/template/en/default/hook/bug/comments-aftercomments.html.tmpl
+++ b/extensions/InlineHistory/template/en/default/hook/bug/comments-aftercomments.html.tmpl
@@ -137,7 +137,7 @@
   [% ELSIF change.buglist %]
     [% value FILTER bug_list_link FILTER js %]
   [% ELSIF change.fieldname == 'bug_file_loc' %]
-    [%~%]<a href="[% value FILTER html FILTER js %]" target="_blank"
+    [%~%]<a href="[% value FILTER html FILTER js %]" target="_blank" rel="noreferrer"
       [%~ ' onclick="return inline_history.confirmUnsafeUrl(this.href)"'
           UNLESS is_safe_url(value) %]>
     [%~%][% value FILTER ih_short_value FILTER html FILTER js %]</a>
-- 
cgit v1.2.3-24-g4f1b