Ticket #43280: 43280.3.diff

src/wp-includes/widgets/class-wp-widget-media-image.php

@@ -261 +261 @@
                                 $link .= sprintf( ' rel="%s"', esc_attr( $instance['link_rel'] ) );
                         }
                         if ( ! empty( $instance['link_target_blank'] ) ) {
+                                if ( empty( $instance['link_rel'] ) ) {
+                                        $link .= ' rel="noopener noreferrer"';
+                                }
                                 $link .= ' target="_blank"';
                         }
                         $link .= '>';

tests/phpunit/tests/widgets/media-image-widget.php

@@ -503 +503 @@
                                 'link_type'         => 'custom',
                                 'link_url'          => 'https://example.org',
                                 'link_target_blank' => true,
+                                'link_rel'          => false,
                         )
                 );
                 $output = ob_get_clean();
 
                 $this->assertContains( '<a href="https://example.org"', $output );
                 $this->assertContains( 'target="_blank"', $output );
+                $this->assertContains( 'rel="noopener noreferrer"', $output );
 
                 // Populate caption in attachment.
                 wp_update_post(