Changeset 52007 for trunk/src/wp-admin/includes/class-wp-comments-list-table.php

Timestamp:

11/03/2021 08:00:36 PM (3 years ago)

Author:

davidbaumwald

Message:

Comments: Add noopener noreferrer to author links in list table.

When viewing the listing of all comments, author links previously passed referrer information to untrusted URLs. This change adds noreferrer to each author link, as well as noopener to prevent the passing of information about the parent window.

Props cybr, adam3128, erayalakese, andraganescu, audrasjb, joedolson, sabernhardt. 
Fixes #40916.

File:

• trunk/src/wp-admin/includes/class-wp-comments-list-table.php (modified) (1 diff)

trunk/src/wp-admin/includes/class-wp-comments-list-table.php

@@ -948 +948 @@
 
         if ( ! empty( $author_url_display ) ) {
-            printf( '<a href="%s">%s</a><br />', esc_url( $author_url ), esc_html( $author_url_display ) );
+            // Print link to author URL, and disallow referrer information (without using target="_blank").
+            printf(
+                '<a href="%s" rel="noopener noreferrer">%s</a><br />',
+                esc_url( $author_url ),
+                esc_html( $author_url_display )
+            );
         }