Add rel="noopener noreferrer" to all target="_blank" links

Signed-off-by: Michal Čihař <michal@cihar.com>

changelog.php

@@ -146,6 +146,7 @@ echo '</pre>';
 var links = document.getElementsByTagName("a");
 for(var i = 0; i < links.length; i++) {
     links[i].target = "_blank";
+    links[i].rel = "noopener noreferrer";
 }
 </script>
 </body>

index.php

@@ -116,9 +116,9 @@ if ($server > 0 || count($cfg['Servers']) > 1
     /**
      * Displays the MySQL servers choice form
      */
-    if ($cfg['ServerDefault'] == 0 
+    if ($cfg['ServerDefault'] == 0
         || (! $cfg['NavigationDisplayServers']
-            && (count($cfg['Servers']) > 1 
+            && (count($cfg['Servers']) > 1
                 || ($server == 0 && count($cfg['Servers']) == 1)
             )
         )
@@ -155,7 +155,7 @@ if ($server > 0 || count($cfg['Servers']) > 1
         echo '        <form method="post" action="index.php">' . "\n"
            . PMA_generate_common_hidden_inputs(null, null, 4, 'collation_connection')
            . '            <label for="select_collation_connection">' . "\n"
-           . '                '. PMA_Util::getImage('s_asci.png') . " " 
+           . '                '. PMA_Util::getImage('s_asci.png') . " "
                                . __('Server connection collation') . "\n"
            // put the doc link in the form so that it appears on the same line
            . PMA_Util::showMySQLDocu(
@@ -598,6 +598,9 @@ function PMA_printListItem($name, $id = null, $url = null, $mysql_help_page = nu
         echo '<a href="' . $url . '"';
         if (null !== $target) {
             echo ' target="' . $target . '"';
+            if ($target == '_blank') {
+                echo ' rel="noopener noreferrer"';
+            }
         }
         if (null != $a_id) {
             echo ' id="' . $a_id .'"';

libraries/display_git_revision.lib.php

@@ -40,7 +40,7 @@ function PMA_printGitRevision()
                 'https://github.com/phpmyadmin/phpmyadmin/commit/'
                 . $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_COMMITHASH')
             )
-            . '" target="_blank">' . $commit_hash . '</a>';
+            . '" rel="noopener noreferrer" target="_blank">' . $commit_hash . '</a>';
     }
 
     $branch = $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_BRANCH');
@@ -50,7 +50,7 @@ function PMA_printGitRevision()
                 'https://github.com/phpmyadmin/phpmyadmin/tree/'
                 . $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_BRANCH')
             )
-            . '" target="_blank">' . $branch . '</a>';
+            . '" rel="noopener noreferrer" target="_blank">' . $branch . '</a>';
     }
     if ($branch !== false) {
         $branch = sprintf(__('%1$s from %2$s branch'), $commit_hash, $branch);

libraries/engines/pbxt.lib.php

@@ -132,11 +132,11 @@ class PMA_StorageEngine_pbxt extends PMA_StorageEngine
     function getPageDocumentation()
     {
         $output = '<p>'
-        . sprintf(__('Documentation and further information about PBXT can be found on the %sPrimeBase XT Home Page%s.'), '<a href="' . PMA_linkURL('http://www.primebase.com/xt/') . '" target="_blank">', '</a>')
+        . sprintf(__('Documentation and further information about PBXT can be found on the %sPrimeBase XT Home Page%s.'), '<a href="' . PMA_linkURL('http://www.primebase.com/xt/') . '" rel="noopener noreferrer" target="_blank">', '</a>')
         . '</p>' . "\n"
         . '<h3>' . __('Related Links') . '</h3>' . "\n"
         . '<ul>' . "\n"
-        . '<li><a href="' . PMA_linkURL('http://pbxt.blogspot.com/') . '" target="_blank">' . __('The PrimeBase XT Blog by Paul McCullagh') . '</a></li>' . "\n"
+        . '<li><a href="' . PMA_linkURL('http://pbxt.blogspot.com/') . '" rel="noopener noreferrer" target="_blank">' . __('The PrimeBase XT Blog by Paul McCullagh') . '</a></li>' . "\n"
         . '</ul>' . "\n";
 
         return $output;

libraries/plugins/transformations/abstract/InlineTransformationsPlugin.class.php

@@ -49,7 +49,7 @@ abstract class InlineTransformationsPlugin extends TransformationsPlugin
         if (PMA_IS_GD2) {
             return '<a href="transformation_wrapper.php'
                 . $options['wrapper_link']
-                . '" target="_blank"><img src="transformation_wrapper.php'
+                . '" rel="noopener noreferrer" target="_blank"><img src="transformation_wrapper.php'
                 . $options['wrapper_link'] . '&amp;resize=jpeg&amp;newWidth='
                 . (isset($options[0]) ? $options[0] : '100') . '&amp;newHeight='
                 . (isset($options[1]) ? $options[1] : 100)

libraries/plugins/transformations/abstract/TextImageLinkTransformationsPlugin.class.php

@@ -52,7 +52,7 @@ abstract class TextImageLinkTransformationsPlugin extends TransformationsPlugin
             return htmlspecialchars($url);
         }
         return '<a href="' . htmlspecialchars($url)
-            . '" target="_blank"><img src="' . htmlspecialchars($url)
+            . '" rel="noopener noreferrer" target="_blank"><img src="' . htmlspecialchars($url)
             . '" border="0" width="' . (isset($options[1]) ? $options[1] : 100)
             . '" height="' . (isset($options[2]) ? $options[2] : 50) . '" />'
             . htmlspecialchars($buffer) . '</a>';

libraries/sanitizing.lib.php

@@ -59,6 +59,9 @@ function PMA_replaceBBLink($found)
     $target = '';
     if (! empty($found[3])) {
         $target = ' target="' . $found[3] . '"';
+        if ($found[3] == '_blank') {
+            $target .= ' rel="noopener noreferrer"';
+        }
     }
 
     /* Construct url */

themes.php

@@ -20,7 +20,7 @@ $hash    = '#pma_' . preg_replace('/([0-9]*)\.([0-9]*)\..*/', '\1_\2', PMA_VERSI
 $url     = PMA_linkURL('http://www.phpmyadmin.net/home_page/themes.php') . $hash;
 $output  = '<h1>phpMyAdmin - ' . __('Theme') . '</h1>';
 $output .= '<p>';
-$output .= '<a href="' . $url . '" class="_blank">';
+$output .= '<a href="' . $url . '" rel="noopener noreferrer" class="_blank">';
 $output .= __('Get more themes!');
 $output .= '</a>';
 $output .= '</p>';