Use rel="noopener noreferrer" for saved link widget opening in target…

…="_blank" For #30 because of https://www.jitbit.com/alexblog/256-targetblank---the-most-underestimated-vulnerability-ever/
INN · May 15, 2019 · 455344a · 455344a
1 parent bdfd4bd
commit 455344a
Showing 1 changed file with 9 additions and 3 deletions.
diff --git a/inc/saved-links/class-saved-links-widget.php b/inc/saved-links/class-saved-links-widget.php
@@ -57,9 +57,12 @@ function widget( $args, $instance ) {
 					<h5>
 						<?php
 							if ( isset( $custom["lr_url"][0] ) ) {
-								$output = '<a href="' . $custom["lr_url"][0] . '" ';
+								$output = sprintf(
+									'<a href="%1$s" rel="noopener noreferrer"',
+									esc_attr( $custom["lr_url"][0] )
+								);
 								if ( $instance['new_window'] == 'on' ) {
-									$output .= 'target="_blank" ';
+									$output .= 'target="_blank"';
 								}
 								$output .= '>' . get_the_title() . '</a>';
 							} else {
@@ -79,7 +82,10 @@ function widget( $args, $instance ) {
 						if ( isset($custom["lr_source"][0] ) && ! empty ( $custom["lr_source"][0] ) ) {
 							$lr_source = '<p class="source"><span class="source-label">' . __('Source: ', 'link-roundups') . '</span><span>';
 							if ( !empty( $custom["lr_url"][0] ) ) {
-								$lr_source .= '<a href="' . $custom["lr_url"][0] . '" ';
+								$lr_source .= sprintf(
+									'<a href="%1$s" rel="noopener noreferrer"',
+									esc_attr( $custom["lr_url"][0] )
+								);
 								if ( $instance['new_window'] == 'on' ) {
 									$lr_source .= 'target="_blank" ';
 								}