From b78ed6c10802fa83bc6eb70729a562866ad8f4c7 Mon Sep 17 00:00:00 2001
From: Frédéric Buclin <LpSolit@gmail.com>
Date: Mon, 5 Jan 2015 12:40:22 +0800
Subject: Bug 1113630: Set window.opener to null for the URL field to prevent
 interaction between a remote script and the bug report

---
 template/en/default/bug/edit.html.tmpl          | 5 +++--
 template/en/default/bug/show-multiple.html.tmpl | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

(limited to 'template/en')

diff --git a/template/en/default/bug/edit.html.tmpl b/template/en/default/bug/edit.html.tmpl
index 4ccf2a0a2..8057e4d02 100644
--- a/template/en/default/bug/edit.html.tmpl
+++ b/template/en/default/bug/edit.html.tmpl
@@ -595,7 +595,7 @@
       [% IF bug.check_can_change_field("bug_file_loc", 0, 1) %]
         <span id="bz_url_edit_container" class="bz_default_hidden"> 
           <a href="[% bug.bug_file_loc FILTER html %]" target="_blank"
-             title="[% bug.bug_file_loc FILTER html %]"
+             rel="noreferrer" title="[% bug.bug_file_loc FILTER html %]"
              [% IF NOT is_safe_url(bug.bug_file_loc) %]
                onclick="return confirm(
                  'This is considered an unsafe URL and could possibly be harmful. '
@@ -610,7 +610,8 @@
         [% url_output =  PROCESS input no_td=1 inputname => "bug_file_loc" size => "40" colspan => 2 %]
         [% IF NOT bug.check_can_change_field("bug_file_loc", 0, 1)
               AND is_safe_url(bug.bug_file_loc) %]
-          <a href="[% bug.bug_file_loc FILTER html %]">[% url_output FILTER none %]</a>
+          <a href="[% bug.bug_file_loc FILTER html %]"
+             rel="noreferrer">[% url_output FILTER none %]</a>
         [% ELSE %]
           [% url_output FILTER none %]
         [% END %]
diff --git a/template/en/default/bug/show-multiple.html.tmpl b/template/en/default/bug/show-multiple.html.tmpl
index cfd0d8e20..a0a4ecbf1 100644
--- a/template/en/default/bug/show-multiple.html.tmpl
+++ b/template/en/default/bug/show-multiple.html.tmpl
@@ -164,7 +164,7 @@
         <th>[% field_descs.bug_file_loc FILTER html %]:</th>
         <td colspan="3">
           [% IF is_safe_url(bug.bug_file_loc) %]
-            <a href="[% bug.bug_file_loc FILTER html %]">
+            <a href="[% bug.bug_file_loc FILTER html %]" rel="noreferrer">
                      [% bug.bug_file_loc FILTER html %]</a>
           [% ELSE %]
             [% bug.bug_file_loc FILTER html %]
-- 
cgit v1.2.3-24-g4f1b