From 4dab9f8db84d5286ef1da9217af9e44771433b2f Mon Sep 17 00:00:00 2001 From: Andrey Andreev Date: Wed, 31 Jan 2018 23:56:21 +0200 Subject: Merge pull request #5391 from mehdibo/fix/url-helper Prevent tab hijacking when using the URL helper --- system/helpers/url_helper.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/system/helpers/url_helper.php b/system/helpers/url_helper.php index 0359ac92c..a22c4c215 100644 --- a/system/helpers/url_helper.php +++ b/system/helpers/url_helper.php @@ -396,7 +396,7 @@ if ( ! function_exists('auto_link')) if ($type !== 'email' && preg_match_all('#(\w*://|www\.)[a-z0-9]+(-+[a-z0-9]+)*(\.[a-z0-9]+(-+[a-z0-9]+)*)+(/([^\s()<>;]+\w)?/?)?#i', $str, $matches, PREG_OFFSET_CAPTURE | PREG_SET_ORDER)) { // Set our target HTML if using popup links. - $target = ($popup) ? ' target="_blank"' : ''; + $target = ($popup) ? ' target="_blank" rel="noopener"' : ''; // We process the links in reverse order (last -> first) so that // the returned string offsets from preg_match_all() are not -- cgit v1.2.3-24-g4f1b