From 63a5fdaa21ed2f755b164376aeb661425e8a1ba7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Tue, 12 Jul 2016 10:57:23 +0200
Subject: [PATCH] Add rel="noopener noreferrer" to all target="_blank" links
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 changelog.php                                            | 1 +
 index.php                                                | 9 ++++++---
 libraries/display_git_revision.lib.php                   | 4 ++--
 libraries/engines/pbxt.lib.php                           | 4 ++--
 .../abstract/InlineTransformationsPlugin.class.php       | 2 +-
 .../TextImageLinkTransformationsPlugin.class.php         | 2 +-
 libraries/sanitizing.lib.php                             | 3 +++
 themes.php                                               | 2 +-
 8 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/changelog.php b/changelog.php
index 2c407c1646..61b2b5efdf 100644
--- a/changelog.php
+++ b/changelog.php
@@ -146,6 +146,7 @@ echo '</pre>';
 var links = document.getElementsByTagName("a");
 for(var i = 0; i < links.length; i++) {
     links[i].target = "_blank";
+    links[i].rel = "noopener noreferrer";
 }
 </script>
 </body>
diff --git a/index.php b/index.php
index 6831bdc532..1637cb9379 100644
--- a/index.php
+++ b/index.php
@@ -116,9 +116,9 @@ if ($server > 0 || count($cfg['Servers']) > 1
     /**
      * Displays the MySQL servers choice form
      */
-    if ($cfg['ServerDefault'] == 0 
+    if ($cfg['ServerDefault'] == 0
         || (! $cfg['NavigationDisplayServers']
-            && (count($cfg['Servers']) > 1 
+            && (count($cfg['Servers']) > 1
                 || ($server == 0 && count($cfg['Servers']) == 1)
             )
         )
@@ -155,7 +155,7 @@ if ($server > 0 || count($cfg['Servers']) > 1
         echo '        <form method="post" action="index.php">' . "\n"
            . PMA_generate_common_hidden_inputs(null, null, 4, 'collation_connection')
            . '            <label for="select_collation_connection">' . "\n"
-           . '                '. PMA_Util::getImage('s_asci.png') . " " 
+           . '                '. PMA_Util::getImage('s_asci.png') . " "
                                . __('Server connection collation') . "\n"
            // put the doc link in the form so that it appears on the same line
            . PMA_Util::showMySQLDocu(
@@ -598,6 +598,9 @@ function PMA_printListItem($name, $id = null, $url = null, $mysql_help_page = nu
         echo '<a href="' . $url . '"';
         if (null !== $target) {
             echo ' target="' . $target . '"';
+            if ($target == '_blank') {
+                echo ' rel="noopener noreferrer"';
+            }
         }
         if (null != $a_id) {
             echo ' id="' . $a_id .'"';
diff --git a/libraries/display_git_revision.lib.php b/libraries/display_git_revision.lib.php
index 939c84f3fb..622fcdba18 100644
--- a/libraries/display_git_revision.lib.php
+++ b/libraries/display_git_revision.lib.php
@@ -40,7 +40,7 @@ function PMA_printGitRevision()
                 'https://github.com/phpmyadmin/phpmyadmin/commit/'
                 . $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_COMMITHASH')
             )
-            . '" target="_blank">' . $commit_hash . '</a>';
+            . '" rel="noopener noreferrer" target="_blank">' . $commit_hash . '</a>';
     }
 
     $branch = $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_BRANCH');
@@ -50,7 +50,7 @@ function PMA_printGitRevision()
                 'https://github.com/phpmyadmin/phpmyadmin/tree/'
                 . $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_BRANCH')
             )
-            . '" target="_blank">' . $branch . '</a>';
+            . '" rel="noopener noreferrer" target="_blank">' . $branch . '</a>';
     }
     if ($branch !== false) {
         $branch = sprintf(__('%1$s from %2$s branch'), $commit_hash, $branch);
diff --git a/libraries/engines/pbxt.lib.php b/libraries/engines/pbxt.lib.php
index 180279b090..7654d63e97 100644
--- a/libraries/engines/pbxt.lib.php
+++ b/libraries/engines/pbxt.lib.php
@@ -132,11 +132,11 @@ class PMA_StorageEngine_pbxt extends PMA_StorageEngine
     function getPageDocumentation()
     {
         $output = '<p>'
-        . sprintf(__('Documentation and further information about PBXT can be found on the %sPrimeBase XT Home Page%s.'), '<a href="' . PMA_linkURL('http://www.primebase.com/xt/') . '" target="_blank">', '</a>')
+        . sprintf(__('Documentation and further information about PBXT can be found on the %sPrimeBase XT Home Page%s.'), '<a href="' . PMA_linkURL('http://www.primebase.com/xt/') . '" rel="noopener noreferrer" target="_blank">', '</a>')
         . '</p>' . "\n"
         . '<h3>' . __('Related Links') . '</h3>' . "\n"
         . '<ul>' . "\n"
-        . '<li><a href="' . PMA_linkURL('http://pbxt.blogspot.com/') . '" target="_blank">' . __('The PrimeBase XT Blog by Paul McCullagh') . '</a></li>' . "\n"
+        . '<li><a href="' . PMA_linkURL('http://pbxt.blogspot.com/') . '" rel="noopener noreferrer" target="_blank">' . __('The PrimeBase XT Blog by Paul McCullagh') . '</a></li>' . "\n"
         . '</ul>' . "\n";
 
         return $output;
diff --git a/libraries/plugins/transformations/abstract/InlineTransformationsPlugin.class.php b/libraries/plugins/transformations/abstract/InlineTransformationsPlugin.class.php
index 33603a66ff..ed08f11d48 100644
--- a/libraries/plugins/transformations/abstract/InlineTransformationsPlugin.class.php
+++ b/libraries/plugins/transformations/abstract/InlineTransformationsPlugin.class.php
@@ -49,7 +49,7 @@ abstract class InlineTransformationsPlugin extends TransformationsPlugin
         if (PMA_IS_GD2) {
             return '<a href="transformation_wrapper.php'
                 . $options['wrapper_link']
-                . '" target="_blank"><img src="transformation_wrapper.php'
+                . '" rel="noopener noreferrer" target="_blank"><img src="transformation_wrapper.php'
                 . $options['wrapper_link'] . '&amp;resize=jpeg&amp;newWidth='
                 . (isset($options[0]) ? $options[0] : '100') . '&amp;newHeight='
                 . (isset($options[1]) ? $options[1] : 100)
diff --git a/libraries/plugins/transformations/abstract/TextImageLinkTransformationsPlugin.class.php b/libraries/plugins/transformations/abstract/TextImageLinkTransformationsPlugin.class.php
index f303b252a8..3d4a3a323a 100644
--- a/libraries/plugins/transformations/abstract/TextImageLinkTransformationsPlugin.class.php
+++ b/libraries/plugins/transformations/abstract/TextImageLinkTransformationsPlugin.class.php
@@ -52,7 +52,7 @@ abstract class TextImageLinkTransformationsPlugin extends TransformationsPlugin
             return htmlspecialchars($url);
         }
         return '<a href="' . htmlspecialchars($url)
-            . '" target="_blank"><img src="' . htmlspecialchars($url)
+            . '" rel="noopener noreferrer" target="_blank"><img src="' . htmlspecialchars($url)
             . '" border="0" width="' . (isset($options[1]) ? $options[1] : 100)
             . '" height="' . (isset($options[2]) ? $options[2] : 50) . '" />'
             . htmlspecialchars($buffer) . '</a>';
diff --git a/libraries/sanitizing.lib.php b/libraries/sanitizing.lib.php
index 7e6e84db5b..03cc74359a 100644
--- a/libraries/sanitizing.lib.php
+++ b/libraries/sanitizing.lib.php
@@ -59,6 +59,9 @@ function PMA_replaceBBLink($found)
     $target = '';
     if (! empty($found[3])) {
         $target = ' target="' . $found[3] . '"';
+        if ($found[3] == '_blank') {
+            $target .= ' rel="noopener noreferrer"';
+        }
     }
 
     /* Construct url */
diff --git a/themes.php b/themes.php
index 4328383a73..7b5a830fdf 100644
--- a/themes.php
+++ b/themes.php
@@ -20,7 +20,7 @@ $hash    = '#pma_' . preg_replace('/([0-9]*)\.([0-9]*)\..*/', '\1_\2', PMA_VERSI
 $url     = PMA_linkURL('http://www.phpmyadmin.net/home_page/themes.php') . $hash;
 $output  = '<h1>phpMyAdmin - ' . __('Theme') . '</h1>';
 $output .= '<p>';
-$output .= '<a href="' . $url . '" class="_blank">';
+$output .= '<a href="' . $url . '" rel="noopener noreferrer" class="_blank">';
 $output .= __('Get more themes!');
 $output .= '</a>';
 $output .= '</p>';