From bdad20516fa58d14a91af4283d91ef1f996ce3ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Mon, 9 Mar 2020 18:08:24 +0100
Subject: [PATCH] Add noreferrer noopener to external URL

issue9089
review289401002
---
 CHANGELOG        | 1 +
 src/common.js    | 3 ++-
 src/view/form.js | 4 +++-
 src/view/tree.js | 8 ++++----
 4 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index d2811bf425..5cfffabbeb 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,4 @@
+* Add noreferrer noopener to external URL (issue9089)
 * Manage readonly dates in calendar view
 * Manage editable on calendar view
 * Manage named separator as label
diff --git a/src/common.js b/src/common.js
index 803d24176d..edb15e9ee9 100644
--- a/src/common.js
+++ b/src/common.js
@@ -3210,7 +3210,8 @@
                     .append(jQuery('<a/>', {
                         'class': 'btn btn-link',
                         href: Sao.config.bug_url,
-                        target: '_blank'
+                        target: '_blank',
+                        rel: 'noreferrer noopener',
                     }).text(Sao.i18n.gettext('Report Bug')))));
             jQuery('<button/>', {
                 'class': 'btn btn-primary',
diff --git a/src/view/form.js b/src/view/form.js
index 2a064ba655..dfb6f708cd 100644
--- a/src/view/form.js
+++ b/src/view/form.js
@@ -3915,7 +3915,8 @@ function eval_pyson(value){
             Sao.View.Form.URL._super.init.call(this, view, attributes);
             this.button = jQuery('<a/>', {
                 'class': 'btn btn-default',
-                'target': '_new'
+                'target': '_blank',
+                'rel': 'noreferrer noopener',
             }).appendTo(jQuery('<span/>', {
                 'class': 'input-group-btn'
             }).appendTo(this.group));
@@ -3997,6 +3998,7 @@ function eval_pyson(value){
             this.button = jQuery('<a/>', {
                 'class': 'btn btn-lnk',
                 'target': '_blank',
+                'rel': 'noreferrer noopener',
             }).text(attributes.string).appendTo(this.el);
             if (attributes.translate) {
                 var button = jQuery('<button/>', {
diff --git a/src/view/tree.js b/src/view/tree.js
index a3fb94db01..7b1f1d5866 100644
--- a/src/view/tree.js
+++ b/src/view/tree.js
@@ -1870,7 +1870,8 @@
             var cell;
             if (this.protocol) {
                 cell = jQuery('<a/>', {
-                    'target': '_new'
+                    'target': '_blank',
+                    'rel': 'noreferrer noopener',
                 });
                 cell.append(jQuery('<img/>'));
                 cell.click({'cell': cell}, this.clicked.bind(this));
@@ -1911,7 +1912,7 @@
                                 break;
                         }
                     }
-                    cell.attr('src', value);
+                    cell.attr('href', value);
                 }
                 if (this.icon) {
                     if (this.icon in record.model.fields) {
@@ -1951,8 +1952,7 @@
             return cell;
         },
         clicked: function(event) {
-            event.preventDefault();  // prevent edition
-            window.open(event.data.cell.attr('src'), '_blank');
+            event.stopPropagation();  // prevent edition
         }
     });