More secure target blank links

3 files changed, 4 insertions, 3 deletions

diff --git a/client/src/app/videos/+video-watch/comment/video-comment.component.html b/client/src/app/videos/+video-watch/comment/video-comment.component.html
index 831ea0521..8a649e88f 100644
--- a/client/src/app/videos/+video-watch/comment/video-comment.component.html
+++ b/client/src/app/videos/+video-watch/comment/video-comment.component.html
@@ -5,7 +5,7 @@
     <div *ngIf="highlightedComment === true" class="highlighted-comment">Highlighted comment</div>
 
     <div class="comment-account-date">
-      <a target="_blank" [href]="comment.account.url" class="comment-account">{{ comment.by }}</a>
+      <a [href]="comment.account.url"  target="_blank" rel="noopener noreferrer" class="comment-account">{{ comment.by }}</a>
       <a [routerLink]="['/videos/watch', video.uuid, { 'threadId': comment.threadId }]" class="comment-date">{{ comment.createdAt | myFromNow }}</a>
     </div>
     <div class="comment-html" [innerHTML]="sanitizedCommentHTML"></div>
diff --git a/client/src/app/videos/+video-watch/comment/video-comment.component.ts b/client/src/app/videos/+video-watch/comment/video-comment.component.ts
index cfcefed83..26fc9d0b8 100644
--- a/client/src/app/videos/+video-watch/comment/video-comment.component.ts
+++ b/client/src/app/videos/+video-watch/comment/video-comment.component.ts
@@ -107,7 +107,8 @@ export class VideoCommentComponent implements OnInit, OnChanges {
           return {
             tagName,
             attribs: Object.assign(attribs, {
-              target: '_blank'
+              target: '_blank',
+              rel: 'noopener noreferrer'
             })
           }
         }
diff --git a/client/src/app/videos/+video-watch/video-watch.component.html b/client/src/app/videos/+video-watch/video-watch.component.html
index 6a7da0614..6c7fc08e1 100644
--- a/client/src/app/videos/+video-watch/video-watch.component.html
+++ b/client/src/app/videos/+video-watch/video-watch.component.html
@@ -183,7 +183,7 @@
     <strong>Friendly Reminder:</strong>
     <div class="privacy-concerns-text">
       The sharing system used by this video implies that some technical information about your system (such as a public IP address) can be accessed publicly.
-      <a title="Get more information" target="_blank" href="/about#p2p-privacy">More information</a>
+      <a title="Get more information" target="_blank" rel="noopener noreferrer" href="/about#p2p-privacy">More information</a>
     </div>
 
     <div class="privacy-concerns-okay" (click)="acceptedPrivacyConcern()">