From 632c5e3629c2432371bb6339ad883208bff64ac2 Mon Sep 17 00:00:00 2001
From: Chocobozzz <me@florianbigard.com>
Date: Mon, 19 Mar 2018 18:30:28 +0100
Subject: More secure target blank links

---
 .../src/app/videos/+video-watch/comment/video-comment.component.html   | 2 +-
 client/src/app/videos/+video-watch/comment/video-comment.component.ts  | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

(limited to 'client/src/app/videos/+video-watch/comment')

diff --git a/client/src/app/videos/+video-watch/comment/video-comment.component.html b/client/src/app/videos/+video-watch/comment/video-comment.component.html
index 831ea0521..8a649e88f 100644
--- a/client/src/app/videos/+video-watch/comment/video-comment.component.html
+++ b/client/src/app/videos/+video-watch/comment/video-comment.component.html
@@ -5,7 +5,7 @@
     <div *ngIf="highlightedComment === true" class="highlighted-comment">Highlighted comment</div>
 
     <div class="comment-account-date">
-      <a target="_blank" [href]="comment.account.url" class="comment-account">{{ comment.by }}</a>
+      <a [href]="comment.account.url"  target="_blank" rel="noopener noreferrer" class="comment-account">{{ comment.by }}</a>
       <a [routerLink]="['/videos/watch', video.uuid, { 'threadId': comment.threadId }]" class="comment-date">{{ comment.createdAt | myFromNow }}</a>
     </div>
     <div class="comment-html" [innerHTML]="sanitizedCommentHTML"></div>
diff --git a/client/src/app/videos/+video-watch/comment/video-comment.component.ts b/client/src/app/videos/+video-watch/comment/video-comment.component.ts
index cfcefed83..26fc9d0b8 100644
--- a/client/src/app/videos/+video-watch/comment/video-comment.component.ts
+++ b/client/src/app/videos/+video-watch/comment/video-comment.component.ts
@@ -107,7 +107,8 @@ export class VideoCommentComponent implements OnInit, OnChanges {
           return {
             tagName,
             attribs: Object.assign(attribs, {
-              target: '_blank'
+              target: '_blank',
+              rel: 'noopener noreferrer'
             })
           }
         }
-- 
cgit v1.2.3