From c5790f031ff56216e63d899c2eb41a8a1897a96c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Mon, 9 Mar 2020 18:21:27 +0100
Subject: [PATCH] Add noreferrer noopener to window.open calls

issue9089
---
 src/action.js    | 2 +-
 src/sao.js       | 2 +-
 src/view/form.js | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/action.js b/src/action.js
index edeecb5e86..f4f6264765 100644
--- a/src/action.js
+++ b/src/action.js
@@ -133,7 +133,7 @@
                 Sao.Action.exec_report(params);
                 return;
             case 'ir.action.url':
-                window.open(action.url, '_blank');
+                window.open(action.url, '_blank', 'noreferrer,noopener');
                 return;
         }
     };
diff --git a/src/sao.js b/src/sao.js
index b81a17dce1..3282262f94 100644
--- a/src/sao.js
+++ b/src/sao.js
@@ -530,7 +530,7 @@ var Sao = {};
                 return;
             }
             if (url) {
-                window.open(url, '_blank');
+                window.open(url, '_blank', 'noreferrer,noopener');
             }
         }
 
diff --git a/src/view/form.js b/src/view/form.js
index dfb6f708cd..901f5e727b 100644
--- a/src/view/form.js
+++ b/src/view/form.js
@@ -4037,7 +4037,7 @@ function eval_pyson(value){
             });
             Sao.common.selection(Sao.i18n.gettext("Choose a language"), options)
             .done(function(language) {
-                window.open(this.uri(language), '_blank');
+                window.open(this.uri(language), '_blank', 'noreferrer,noopener');
             }.bind(this));
         },
     });