Fixes #3147 Add rel="noreferrer" to all outgoing links . This works in Firefox so far and only for "left clicks". Not perfect, but hopefully other browsers will implement this in the future, as it's a useful privacy enhancing feature!

4 files changed, 5 insertions, 5 deletions

diff --git a/plugins/CorePluginsAdmin/templates/browsePlugins.twig b/plugins/CorePluginsAdmin/templates/browsePlugins.twig
index 9259081a0c..2624dd00e9 100644
--- a/plugins/CorePluginsAdmin/templates/browsePlugins.twig
+++ b/plugins/CorePluginsAdmin/templates/browsePlugins.twig
@@ -55,6 +55,6 @@
     {% set marketplaceSellPluginSubject = 'CorePluginsAdmin_MarketplaceSellPluginSubject'|translate %}
         {{ 'CorePluginsAdmin_GetEarlyAccessForPaidPlugins'|translate("<a href='mailto:hello@piwik.org?subject=" ~ marketplaceSellPluginSubject ~ "'>", "</a>")|raw }}
         <br/>
-        {{ 'CorePluginsAdmin_DevelopersLearnHowToDevelopPlugins'|translate('<a href="?module=Proxy&action=redirect&url=http://developer.piwik.org/plugins" target="_blank">', '</a>')|raw }}
+        {{ 'CorePluginsAdmin_DevelopersLearnHowToDevelopPlugins'|translate('<a href="?module=Proxy&action=redirect&url=http://developer.piwik.org/plugins" rel="noreferrer"  target="_blank">', '</a>')|raw }}
     </div>
 {% endblock %}
diff --git a/plugins/CorePluginsAdmin/templates/macros.twig b/plugins/CorePluginsAdmin/templates/macros.twig
index 8c057ed06f..f5c9220721 100644
--- a/plugins/CorePluginsAdmin/templates/macros.twig
+++ b/plugins/CorePluginsAdmin/templates/macros.twig
@@ -190,7 +190,7 @@
                         </div>
                         {% if plugin.info.license is defined %}
                         <div class="plugin-license">
-                            {% if plugin.info.license_homepage is defined %}<a title="{{ 'CorePluginsAdmin_LicenseHomepage'|translate }}" target="_blank" href="{{ plugin.info.license_homepage }}">{% endif %}{{ plugin.info.license }}{% if plugin.info.license_homepage is defined %}</a>{% endif %}
+                            {% if plugin.info.license_homepage is defined %}<a title="{{ 'CorePluginsAdmin_LicenseHomepage'|translate }}" rel="noreferrer" target="_blank" href="{{ plugin.info.license_homepage }}">{% endif %}{{ plugin.info.license }}{% if plugin.info.license_homepage is defined %}</a>{% endif %}
                         </div>
                         {% endif %}
                         {% if plugin.info.authors is defined %}
@@ -200,7 +200,7 @@
                             {% spaceless %}
                             {% for author in plugin.info.authors if author.name %}
                                 {% if author.homepage is defined %}
-                                    <a title="{{ 'CorePluginsAdmin_AuthorHomepage'|translate }}" href="{{ author.homepage }}" target="_blank">{{ author.name }}</a>
+                                    <a title="{{ 'CorePluginsAdmin_AuthorHomepage'|translate }}" href="{{ aurel="noreferrer"  target="_blank"" target="_blank">{{ author.name }}</a>
                                 {% else %}
                                     {{ author.name }}
                                 {% endif %}
diff --git a/plugins/CorePluginsAdmin/templates/pluginDetails.twig b/plugins/CorePluginsAdmin/templates/pluginDetails.twig
index 2487ef41d6..077f3755c5 100644
--- a/plugins/CorePluginsAdmin/templates/pluginDetails.twig
+++ b/plugins/CorePluginsAdmin/templates/pluginDetails.twig
@@ -69,7 +69,7 @@
                             {{ pluginsMacro.missingRequirementsPleaseUpdateNotice(plugin) }}
                             {% if plugin.canBeUpdated %}
                                 <p class="updateAvailableNotice">{{ 'CorePluginsAdmin_PluginUpdateAvailable'|translate(plugin.currentVersion, plugin.latestVersion) }}
-                                    {% if plugin.repositoryChangelogUrl %}<a target="_blank" href="{{ plugin.repositoryChangelogUrl }}">{{ 'CorePluginsAdmin_ViewRepositoryChangelog'|translate }}</a>{% endif %}
+                                    {% if plugin.repositoryChangelogUrl %}<a rel="noreferrer"  target="_blank" href="{{ plugin.repositoryChangelogUrl }}">{{ 'CorePluginsAdmin_ViewRepositoryChangelog'|translate }}</a>{% endif %}
                                 </p>
                             {% endif %}
 
diff --git a/plugins/CorePluginsAdmin/templates/safemode.twig b/plugins/CorePluginsAdmin/templates/safemode.twig
index e2608c147e..53de56181b 100644
--- a/plugins/CorePluginsAdmin/templates/safemode.twig
+++ b/plugins/CorePluginsAdmin/templates/safemode.twig
@@ -63,7 +63,7 @@
             <p>
                 If this error continues to happen, you may be able to fix this issue by disabling one or more of
                 the Third-Party plugins. You can enable them again in the
-                <a target="_blank" href="index.php?module=CorePluginsAdmin&action=plugins">Plugins</a> or <a target="_blank" href="index.php?module=CorePluginsAdmin&action=themes">Themes</a> page under
+                <a rel="noreferrer"  target="_blank" href="index.php?module=CorePluginsAdmin&action=plugins">Plugins</a> or <a target="_blank" href="index.php?module=CorePluginsAdmin&action=themes">Themes</a> page under
                 settings at any time.
 
                 {% if pluginCausesIssue %}