[tryton-commits] changeset in sao:default Add noreferrer noopener to external URL

[Cédric Krier]

changeset ecd678a55935 in sao:default
details: https://hg.tryton.org/sao?cmd=changeset;node=ecd678a55935
description:
        Add noreferrer noopener to external URL

        issue9089
        review289401002
diffstat:

 CHANGELOG        |  1 +
 src/common.js    |  3 ++-
 src/view/form.js |  4 +++-
 src/view/tree.js |  8 ++++----
 4 files changed, 10 insertions(+), 6 deletions(-)

diffs (74 lines):

diff -r 0bccb444c4f7 -r ecd678a55935 CHANGELOG
--- a/CHANGELOG Fri Mar 06 23:14:24 2020 +0100
+++ b/CHANGELOG Mon Mar 09 18:08:24 2020 +0100
@@ -1,3 +1,4 @@
+* Add noreferrer noopener to external URL (issue9089)
 * Manage readonly dates in calendar view
 * Manage editable on calendar view
 * Manage named separator as label
diff -r 0bccb444c4f7 -r ecd678a55935 src/common.js
--- a/src/common.js     Fri Mar 06 23:14:24 2020 +0100
+++ b/src/common.js     Mon Mar 09 18:08:24 2020 +0100
@@ -3210,7 +3210,8 @@
                     .append(jQuery('<a/>', {
                         'class': 'btn btn-link',
                         href: Sao.config.bug_url,
-                        target: '_blank'
+                        target: '_blank',
+                        rel: 'noreferrer noopener',
                     }).text(Sao.i18n.gettext('Report Bug')))));
             jQuery('<button/>', {
                 'class': 'btn btn-primary',
diff -r 0bccb444c4f7 -r ecd678a55935 src/view/form.js
--- a/src/view/form.js  Fri Mar 06 23:14:24 2020 +0100
+++ b/src/view/form.js  Mon Mar 09 18:08:24 2020 +0100
@@ -3915,7 +3915,8 @@
             Sao.View.Form.URL._super.init.call(this, view, attributes);
             this.button = jQuery('<a/>', {
                 'class': 'btn btn-default',
-                'target': '_new'
+                'target': '_blank',
+                'rel': 'noreferrer noopener',
             }).appendTo(jQuery('<span/>', {
                 'class': 'input-group-btn'
             }).appendTo(this.group));
@@ -3997,6 +3998,7 @@
             this.button = jQuery('<a/>', {
                 'class': 'btn btn-lnk',
                 'target': '_blank',
+                'rel': 'noreferrer noopener',
             }).text(attributes.string).appendTo(this.el);
             if (attributes.translate) {
                 var button = jQuery('<button/>', {
diff -r 0bccb444c4f7 -r ecd678a55935 src/view/tree.js
--- a/src/view/tree.js  Fri Mar 06 23:14:24 2020 +0100
+++ b/src/view/tree.js  Mon Mar 09 18:08:24 2020 +0100
@@ -1870,7 +1870,8 @@
             var cell;
             if (this.protocol) {
                 cell = jQuery('<a/>', {
-                    'target': '_new'
+                    'target': '_blank',
+                    'rel': 'noreferrer noopener',
                 });
                 cell.append(jQuery('<img/>'));
                 cell.click({'cell': cell}, this.clicked.bind(this));
@@ -1911,7 +1912,7 @@
                                 break;
                         }
                     }
-                    cell.attr('src', value);
+                    cell.attr('href', value);
                 }
                 if (this.icon) {
                     if (this.icon in record.model.fields) {
@@ -1951,8 +1952,7 @@
             return cell;
         },
         clicked: function(event) {
-            event.preventDefault();  // prevent edition
-            window.open(event.data.cell.attr('src'), '_blank');
+            event.stopPropagation();  // prevent edition
         }
     });