Fixes #3147 Add rel="noreferrer" to all outgoing links . This works in Firefox so far and only for "left clicks". Not perfect, but hopefully other browsers will implement this in the future, as it's a useful privacy enhancing feature!

7 files changed, 21 insertions, 21 deletions

diff --git a/core/API/DocumentationGenerator.php b/core/API/DocumentationGenerator.php
index 6a140ac8fb..3c88f62027 100644
--- a/core/API/DocumentationGenerator.php
+++ b/core/API/DocumentationGenerator.php
@@ -132,13 +132,13 @@ class DocumentationGenerator
             $lastNUrls = '';
             if (preg_match('/(&period)|(&date)/', $exampleUrl)) {
                 $exampleUrlRss = $prefixUrls . $this->getExampleUrl($class, $methodName, array('date' => 'last10', 'period' => 'day') + $parametersToSet);
-                $lastNUrls = ", RSS of the last <a target=_blank href='$exampleUrlRss&format=rss$token_auth&translateColumnNames=1'>10 days</a>";
+                $lastNUrls = ", RSS of the last <a target='_blank' href='$exampleUrlRss&format=rss$token_auth&translateColumnNames=1'>10 days</a>";
             }
             $exampleUrl = $prefixUrls . $exampleUrl;
             $str .= " [ Example in
-                                                                    <a target=_blank href='$exampleUrl&format=xml$token_auth'>XML</a>,
-                                                                    <a target=_blank href='$exampleUrl&format=JSON$token_auth'>Json</a>,
-                                                                    <a target=_blank href='$exampleUrl&format=Tsv$token_auth&translateColumnNames=1'>Tsv (Excel)</a>
+                                                                    <a target='_blank' href='$exampleUrl&format=xml$token_auth'>XML</a>,
+                                                                    <a target='_blank' href='$exampleUrl&format=JSON$token_auth'>Json</a>,
+                                                                    <a target='_blank' href='$exampleUrl&format=Tsv$token_auth&translateColumnNames=1'>Tsv (Excel)</a>
                                                                     $lastNUrls
                                                                     ]";
         } else {
@@ -350,13 +350,13 @@ class DocumentationGenerator
                 $lastNUrls = '';
                 if (preg_match('/(&period)|(&date)/', $exampleUrl)) {
                     $exampleUrlRss = $prefixUrls . $this->getExampleUrl($class, $methodName, array('date' => 'last10', 'period' => 'day') + $parametersToSet);
-                    $lastNUrls = ",	RSS of the last <a target=_blank href='$exampleUrlRss&format=rss$token_auth&translateColumnNames=1'>10 days</a>";
+                    $lastNUrls = ",	RSS of the last <a target='_blank' href='$exampleUrlRss&format=rss$token_auth&translateColumnNames=1'>10 days</a>";
                 }
                 $exampleUrl = $prefixUrls . $exampleUrl;
                 $str .= " [ Example in
-									<a target=_blank href='$exampleUrl&format=xml$token_auth'>XML</a>,
-									<a target=_blank href='$exampleUrl&format=JSON$token_auth'>Json</a>,
-									<a target=_blank href='$exampleUrl&format=Tsv$token_auth&translateColumnNames=1'>Tsv (Excel)</a>
+									<a target='_blank' href='$exampleUrl&format=xml$token_auth'>XML</a>,
+									<a target='_blank' href='$exampleUrl&format=JSON$token_auth'>Json</a>,
+									<a target='_blank' href='$exampleUrl&format=Tsv$token_auth&translateColumnNames=1'>Tsv (Excel)</a>
 									$lastNUrls
 									]";
             } else {
diff --git a/core/Error.php b/core/Error.php
index c56e3301a7..d8fa0706fc 100644
--- a/core/Error.php
+++ b/core/Error.php
@@ -148,7 +148,7 @@ class Error
             $htmlString = '';
             $htmlString .= "\n<div style='word-wrap: break-word; border: 3px solid red; padding:4px; width:70%; background-color:#FFFF96;'>
         <strong>There is an error. Please report the message (Piwik " . (class_exists('Piwik\Version') ? Version::VERSION : '') . ")
-        and full backtrace in the <a href='?module=Proxy&action=redirect&url=http://forum.piwik.org' target='_blank'>Piwik forums</a> (please do a Search first as it might have been reported already!).<br /><br/>
+        and full backtrace in the <a href='?module=Proxy&action=redirect&url=http://forum.piwik.org' rel='noreferrer' target='_blank'>Piwik forums</a> (please do a Search first as it might have been reported already!).<br /><br/>
         ";
             $htmlString .= Error::getErrNoString($message->errno);
             $htmlString .= ":</strong> <em>{$message->errstr}</em> in <strong>{$message->errfile}</strong>";
diff --git a/core/Plugin/ControllerAdmin.php b/core/Plugin/ControllerAdmin.php
index 746395e88e..008cb4d2f4 100644
--- a/core/Plugin/ControllerAdmin.php
+++ b/core/Plugin/ControllerAdmin.php
@@ -131,7 +131,7 @@ abstract class ControllerAdmin extends Controller
         $message = sprintf("You are using the PHP accelerator & optimizer eAccelerator which is known to be not compatible with Piwik.
             We have disabled eAccelerator, which might affect the performance of Piwik.
             Read the %srelated ticket%s for more information and how to fix this problem.",
-            '<a target="_blank" href="https://github.com/piwik/piwik/issues/4439">', '</a>');
+            '<a rel="noreferrer" target="_blank" href="https://github.com/piwik/piwik/issues/4439">', '</a>');
 
         $notification = new Notification($message);
         $notification->context = Notification::CONTEXT_WARNING;
diff --git a/core/Session.php b/core/Session.php
index f67b2e4caf..edd468c95e 100644
--- a/core/Session.php
+++ b/core/Session.php
@@ -120,7 +120,7 @@ class Session extends Zend_Session
             $enableDbSessions = '';
             if (DbHelper::isInstalled()) {
                 $enableDbSessions = "<br/>If you still experience issues after trying these changes,
-			            			we recommend that you <a href='http://piwik.org/faq/how-to-install/#faq_133' target='_blank'>enable database session storage</a>.";
+			            			we recommend that you <a href='http://piwik.org/faq/how-to-install/#faq_133' rel='noreferrer' target='_blank'>enable database session storage</a>.";
             }
 
             $pathToSessions = Filechecks::getErrorMessageMissingPermissions(Filesystem::getPathToPiwikRoot() . '/tmp/sessions/');
diff --git a/core/Updates/0.6-rc1.php b/core/Updates/0.6-rc1.php
index 9f293dda97..9a946251ad 100644
--- a/core/Updates/0.6-rc1.php
+++ b/core/Updates/0.6-rc1.php
@@ -42,8 +42,8 @@ class Updates_0_6_rc1 extends Updates
     {
         // first we disable the plugins and keep an array of warnings messages
         $pluginsToDisableMessage = array(
-            'SearchEnginePosition' => "SearchEnginePosition plugin was disabled, because it is not compatible with the new Piwik 0.6. \n You can download the latest version of the plugin, compatible with Piwik 0.6.\n<a target='_blank' href='?module=Proxy&action=redirect&url=https://github.com/piwik/piwik/issues/502'>Click here.</a>",
-            'GeoIP'                => "GeoIP plugin was disabled, because it is not compatible with the new Piwik 0.6. \nYou can download the latest version of the plugin, compatible with Piwik 0.6.\n<a target='_blank' href='?module=Proxy&action=redirect&url=https://github.com/piwik/piwik/issues/45'>Click here.</a>"
+            'SearchEnginePosition' => "SearchEnginePosition plugin was disabled, because it is not compatible with the new Piwik 0.6. \n You can download the latest version of the plugin, compatible with Piwik 0.6.\n<a rel='noreferrer' target='_blank' href='?module=Proxy&action=redirect&url=https://github.com/piwik/piwik/issues/502'>Click here.</a>",
+            'GeoIP'                => "GeoIP plugin was disabled, because it is not compatible with the new Piwik 0.6. \nYou can download the latest version of the plugin, compatible with Piwik 0.6.\n<a rel='noreferrer' target='_blank' href='?module=Proxy&action=redirect&url=https://github.com/piwik/piwik/issues/45'>Click here.</a>"
         );
         $disabledPlugins = array();
         foreach ($pluginsToDisableMessage as $pluginToDisable => $warningMessage) {
diff --git a/core/Updates/1.2-rc1.php b/core/Updates/1.2-rc1.php
index e268ad8570..658dffeb27 100644
--- a/core/Updates/1.2-rc1.php
+++ b/core/Updates/1.2-rc1.php
@@ -129,7 +129,7 @@ class Updates_1_2_rc1 extends Updates
     {
         // first we disable the plugins and keep an array of warnings messages
         $pluginsToDisableMessage = array(
-            'GeoIP'     => "GeoIP plugin was disabled, because it is not compatible with the new Piwik 1.2. \nYou can download the latest version of the plugin, compatible with Piwik 1.2.\n<a target='_blank' href='?module=Proxy&action=redirect&url=https://github.com/piwik/piwik/issues/45'>Click here.</a>",
+            'GeoIP'     => "GeoIP plugin was disabled, because it is not compatible with the new Piwik 1.2. \nYou can download the latest version of the plugin, compatible with Piwik 1.2.\n<a rel='noreferrer' target='_blank' href='?module=Proxy&action=redirect&url=https://github.com/piwik/piwik/issues/45'>Click here.</a>",
             'EntryPage' => "EntryPage plugin is not compatible with this version of Piwik, it was disabled.",
         );
         $disabledPlugins = array();
diff --git a/core/testMinimumPhpVersion.php b/core/testMinimumPhpVersion.php
index a24780077d..eec5a50d1b 100644
--- a/core/testMinimumPhpVersion.php
+++ b/core/testMinimumPhpVersion.php
@@ -52,11 +52,11 @@ if ($minimumPhpInvalid) {
             $composerInstall = "Download and run <a href=\"https://getcomposer.org/Composer-Setup.exe\"><b>Composer-Setup.exe</b></a>, it will install the latest Composer version and set up your PATH so that you can just call composer from any directory in your command line. "
                 . " <br>Then run this command in a terminal in the piwik directory: <br> $ php composer.phar update ";
         }
-        $piwik_errorMessage .= "<p>It appears the <a href='https://getcomposer.org/' target='_blank'>composer</a> tool is not yet installed. You can install Composer in a few easy steps:\n\n".
+        $piwik_errorMessage .= "<p>It appears the <a href='https://getcomposer.org/' rel='noreferrer' target='_blank'>composer</a> tool is not yet installed. You can install Composer in a few easy steps:\n\n".
                     "<br/>" . $composerInstall.
                     " This will initialize composer for Piwik and download libraries we use in vendor/* directory.".
                     "\n\n<br/><br/>Then reload this page to access your analytics reports." .
-                    "\n\n<br/><br/>For more information check out this FAQ: <a href='http://piwik.org/faq/how-to-install/faq_18271/' target='_blank'>How do I use Piwik from the Git repository?</a>." .
+                    "\n\n<br/><br/>For more information check out this FAQ: <a href='http://piwik.org/faq/how-to-install/faq_18271/' rel='noreferrer' target='_blank'>How do I use Piwik from the Git repository?</a>." .
                     "\n\n<br/><br/>Note: if for some reasons you cannot install composer, instead install the latest Piwik release from ".
                     "<a href='http://builds.piwik.org/piwik.zip'>builds.piwik.org</a>.</p>";
     }
@@ -122,11 +122,11 @@ if (!function_exists('Piwik_GetErrorMessagePage')) {
 
         if ($optionalLinks) {
             $optionalLinks = '<ul>
-                            <li><a target="_blank" href="http://piwik.org">Piwik.org homepage</a></li>
-                            <li><a target="_blank" href="http://piwik.org/faq/">Piwik Frequently Asked Questions</a></li>
-                            <li><a target="_blank" href="http://piwik.org/docs/">Piwik Documentation</a></li>
-                            <li><a target="_blank" href="http://forum.piwik.org/">Piwik Forums</a></li>
-                            <li><a target="_blank" href="http://demo.piwik.org">Piwik Online Demo</a></li>
+                            <li><a rel="noreferrer" target="_blank" href="http://piwik.org">Piwik.org homepage</a></li>
+                            <li><a rel="noreferrer" target="_blank" href="http://piwik.org/faq/">Piwik Frequently Asked Questions</a></li>
+                            <li><a rel="noreferrer" target="_blank" href="http://piwik.org/docs/">Piwik Documentation</a></li>
+                            <li><a rel="noreferrer" target="_blank" href="http://forum.piwik.org/">Piwik Forums</a></li>
+                            <li><a rel="noreferrer" target="_blank" href="http://demo.piwik.org">Piwik Online Demo</a></li>
                             </ul>';
         }
         if ($optionalLinkBack) {