Andal.LND/edx-platform
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Pervent reverse tabnabbing in edx platform

Browse Source
This commit is contained in:
Awais Jibran
2019-08-22 16:37:44 +05:00
parent 1c4f9da92d
commit 1a4eb7d2e8
61 changed files with 120 additions and 103 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
lms/templates/api_admin/catalogs/edit.html
View File

@@ -25,7 +25,7 @@ from openedx.core.djangolib.js_utils import js_escaped_string
<h1 id="api-header">${catalog.name}</h1>
<p>
<a href="${'{root}/{id}/csv/'.format(root=catalog_api_catalog_endpoint, id=catalog.id)}" target="_blank">
<a href="${'{root}/{id}/csv/'.format(root=catalog_api_catalog_endpoint, id=catalog.id)}" rel="noopener" target="_blank">
${_("Download CSV")}
</a>
</p>

2
lms/templates/api_admin/catalogs/list.html
View File

@@ -28,7 +28,7 @@ CatalogPreviewFactory({
<li>
<a href="${reverse('api_admin:catalog-edit', args=(catalog.id,))}">${catalog.name}</a>&nbsp;
(<a
href="${'{root}/{id}/csv/'.format(root=catalog_api_catalog_endpoint, id=catalog.id)}"
href="${'{root}/{id}/csv/'.format(root=catalog_api_catalog_endpoint, id=catalog.id)}" rel="noopener"
target="_blank">${_("Download CSV")}</a>)
</li>
% endfor

6
lms/templates/certificates/_accomplishment-banner.html
View File

@@ -25,7 +25,7 @@ from openedx.core.djangolib.js_utils import js_escaped_string
social_network: 'LinkedIn'
};
Logger.log('edx.certificate.shared', data);
window.open('${linked_in_url | n, js_escaped_string}');
window.open('${linked_in_url | n, js_escaped_string}', '', 'noopener');
});
});
@@ -33,7 +33,9 @@ from openedx.core.djangolib.js_utils import js_escaped_string
// popup a window at center of the screen.
var left = (screen.width/2)-(width/2);
var top = (screen.height/2)-(height/2);
return window.open(url, title, 'toolbar=no, location=no, directories=no, status=no, menubar=no, scrollbars=yes, resizable=yes, width='+width+', height='+height+', top='+top+', left='+left);
var popupWindow = window.open(url, title, 'toolbar=no, location=no, directories=no, status=no, menubar=no, scrollbars=yes, resizable=yes, width='+width+', height='+height+', top='+top+', left='+left);
popupWindow.opener = null;
return popupWindow;
}
</script>
</%block>

4
lms/templates/certificates/_badges-modal.html
View File

@@ -13,9 +13,9 @@
<hr class="modal-hr"/>
<img class="backpack-logo" src="${static.url('certificates/images/backpack-logo.png')}">
<ol class="badges-steps">
<li class="step">Create a <a href="https://backpack.openbadges.org/" target="_blank">Mozilla Backpack</a> account, or log in to your existing account
<li class="step">Create a <a href="https://backpack.openbadges.org/" rel="noopener" target="_blank">Mozilla Backpack</a> account, or log in to your existing account
</li>
<li class="step"><a href="${badge.image_url}" target="_blank">Download this image (right-click, save as)</a> and then <a href="https://backpack.openbadges.org/backpack/add" target="_blank">upload</a> it to your backpack.</li>
<li class="step"><a href="${badge.image_url}" rel="noopener" target="_blank">Download this image (right-click, save as)</a> and then <a href="https://backpack.openbadges.org/backpack/add" target="_blank">upload</a> it to your backpack.</li>
</ol>
<div class="image-container">
<img class="badges-backpack-example" src="${static.url('certificates/images/backpack-ui.png')}">

4
lms/templates/courseware/progress.html
View File

@@ -80,9 +80,9 @@ username = get_enterprise_learner_generic_name(request) or student.username
</div>
<div class="msg-actions">
%if certificate_data.cert_web_view_url:
<a class="btn" href="${certificate_data.cert_web_view_url}" target="_blank">${_("View Certificate")} <span class="sr">${_("Opens in a new browser window")}</span></a>
<a class="btn" href="${certificate_data.cert_web_view_url}" rel="noopener" target="_blank">${_("View Certificate")} <span class="sr">${_("Opens in a new browser window")}</span></a>
%elif certificate_data.cert_status == CertificateStatuses.downloadable and certificate_data.download_url:
<a class="btn" href="${certificate_data.download_url}" target="_blank">${_("Download Your Certificate")} <span class="sr">${_("Opens in a new browser window")}</span></a>
<a class="btn" href="${certificate_data.download_url}" rel="noopener" target="_blank">${_("Download Your Certificate")} <span class="sr">${_("Opens in a new browser window")}</span></a>
%elif certificate_data.cert_status == CertificateStatuses.requesting:
<button class="btn generate_certs" data-endpoint="${post_url}" id="btn_generate_cert">${_('Request Certificate')}</button>
%endif

2
lms/templates/credit_notifications/credit_eligibility_email.html
View File

@@ -19,7 +19,7 @@
<table>
<tr>
<td class="cn-img-wrapper">
<a target="_blank" title="" href="#">
<a rel="noopener" target="_blank" title="" href="#">
<img class="cn-img" src="cid:${branded_logo}">
</a>
</td>

2
lms/templates/dashboard.html
View File

@@ -297,7 +297,7 @@ from student.models import CourseEnrollment
<li class="order-history">
<span class="title">${_("Order History")}</span>
% for order_history_item in order_history_list:
<span><a href="${order_history_item['receipt_url']}" target="_blank" class="edit-name">${order_history_item['order_date']}</a></span>
<span><a href="${order_history_item['receipt_url']}" rel="noopener" target="_blank" class="edit-name">${order_history_item['order_date']}</a></span>
% endfor
</li>
% endif

4
lms/templates/dashboard/_dashboard_certificate_information.html
View File

@@ -82,7 +82,7 @@ else:
</li>
% elif cert_status['status'] == 'downloadable' and cert_status.get('show_cert_web_view', False):
<li class="action action-certificate">
<a class="btn" href="${cert_status['cert_web_view_url']}" target="_blank"
<a class="btn" href="${cert_status['cert_web_view_url']}" rel="noopener" target="_blank"
title="${_('This link will open the certificate web view')}">
${_("View {cert_name_short}").format(cert_name_short=cert_name_short,)}
</a>
@@ -123,7 +123,7 @@ else:
% if cert_status['status'] == 'downloadable' and cert_status['linked_in_url']:
<ul class="actions actions-secondary">
<li class="action action-share">
<a class="action-linkedin-profile" target="_blank" href="${cert_status['linked_in_url']}"
<a class="action-linkedin-profile" rel="noopener" target="_blank" href="${cert_status['linked_in_url']}"
title="${_('Add Certificate to LinkedIn Profile')}"
data-course-id="${course_overview.id}"
data-certificate-mode="${cert_status['mode']}"

6
lms/templates/dashboard/_dashboard_course_listing.html
View File

@@ -236,10 +236,11 @@ from util.course import get_link_for_about_page, get_encoded_course_sharing_utm_
data-trigger="focus hover"
class="action action-facebook"
href="${facebook_url}"
rel="noopener"
target="_blank"
title="${_('Share on Facebook')}"
data-course-id="${course_overview.id}"
onclick="window.open('${facebook_url}', '${share_window_name}', '${share_window_config}'); return false;">
onclick="var popupWindow = window.open('${facebook_url}', '${share_window_name}', '${share_window_config}'); popupWindow.opener = null; return false;">
<span class="sr">${share_msg}</span>
<span class="fa fa-facebook" aria-hidden="true"></span>
</a>
@@ -257,10 +258,11 @@ from util.course import get_link_for_about_page, get_encoded_course_sharing_utm_
data-trigger="focus hover"
class="action action-twitter"
href="${twitter_url}"
rel="noopener"
target="_blank"
title="${_('Share on Twitter')}"
data-course-id="${course_overview.id}"
onclick="window.open('${twitter_url}', '${share_window_name}', '${share_window_config}'); return false;">
onclick="var popupWindow = window.open('${twitter_url}', '${share_window_name}', '${share_window_config}'); popupWindow.opener = null; return false;">
<span class="sr">${share_msg}</span>
<span class="fa fa-twitter" aria-hidden="true"></span>
</a>

4
lms/templates/dashboard/_dashboard_credit_info.html
View File

@@ -8,7 +8,7 @@
% if credit_status["eligible"]:
<%
provider_link = HTML('<a href="{href}" target="_blank">{name}</a>').format(
provider_link = HTML('<a href="{href}" rel="noopener" target="_blank">{name}</a>').format(
href=credit_status["provider_status_url"],
name=credit_status["provider_name"])
@@ -85,7 +85,7 @@
</p>
<div class="credit-action">
% if credit_btn_label:
<a class="btn credit-btn ${credit_btn_class}" href="${credit_btn_href}" target="_blank" data-course-key="${credit_status['course_key']}" data-user="${user.username}" data-provider="${credit_status['provider_id']}">
<a class="btn credit-btn ${credit_btn_class}" href="${credit_btn_href}" rel="noopener" target="_blank" data-course-key="${credit_status['course_key']}" data-user="${user.username}" data-provider="${credit_status['provider_id']}">
${credit_btn_label}
</a>
% endif

2
lms/templates/fields/field_order_history.underscore
View File

@@ -4,7 +4,7 @@
<span class="u-field-order-price"><span class="sr"><%- gettext('Cost') %>: </span><% if (!isNaN(parseFloat(totalPrice))) { %>$<% } %><%- totalPrice %></span>
<span class="u-field-order-link">
<% if (receiptUrl) { %>
<a class="u-field-link" target="_blank" href="<%- receiptUrl %>"><%- gettext('Order Details') %><span class="sr"> <%- gettext('for') %> <%- orderId %></span></a>
<a class="u-field-link" target="_blank" rel="noopener" href="<%- receiptUrl %>"><%- gettext('Order Details') %><span class="sr"> <%- gettext('for') %> <%- orderId %></span></a>
<% } %>
</span>
<% _.each(lines, function(item){ %>

4
lms/templates/header/header.html
View File

@@ -81,8 +81,8 @@ from openedx.core.djangoapps.site_configuration import helpers as configuration_
<div class="ie-banner" aria-hidden="true">${Text(_('{begin_strong}Warning:{end_strong} Your browser is not fully supported. We strongly recommend using {chrome_link} or {ff_link}.')).format(
begin_strong=HTML('<strong>'),
end_strong=HTML('</strong>'),
chrome_link=HTML('<a href="https://www.google.com/chrome" target="_blank">Chrome</a>'),
ff_link=HTML('<a href="http://www.mozilla.org/firefox" target="_blank">Firefox</a>'),
chrome_link=HTML('<a href="https://www.google.com/chrome" rel="noopener" target="_blank">Chrome</a>'),
ff_link=HTML('<a href="http://www.mozilla.org/firefox" rel="noopener" target="_blank">Firefox</a>'),
)}</div>
<![endif]-->
% endif

2
lms/templates/header/navbar-authenticated.html
View File

@@ -68,7 +68,7 @@ from openedx.core.djangoapps.site_configuration import helpers as configuration_
</div>
% endif
<div class="mobile-nav-item hidden-mobile nav-item">
<a class="help-link" href="${help_link}" target="_blank">${_("Help")}</a>
<a class="help-link" href="${help_link}" rel="noopener" target="_blank">${_("Help")}</a>
</div>
<%include file="user_dropdown.html"/>
</div>

4
lms/templates/instructor/instructor_dashboard_2/cohort-group-header.underscore
View File

@@ -12,10 +12,10 @@
<div class="setup-value">
<% if (cohort.get('assignment_type') == "manual") { %>
<%- gettext("Learners are added to this cohort only when you provide their email addresses or usernames on this page.") %>
<a href="/help_token/cohortmanual" class="incontext-help action-secondary action-help" target="_blank"><%- gettext("What does this mean?") %></a>
<a href="/help_token/cohortmanual" class="incontext-help action-secondary action-help" rel="noopener" target="_blank"><%- gettext("What does this mean?") %></a>
<% } else { %>
<%- gettext("Learners are added to this cohort automatically.") %>
<a href="/help_token/cohortautomatic" class="incontext-help action-secondary action-help" target="_blank"><%- gettext("What does this mean?") %></a>
<a href="/help_token/cohortautomatic" class="incontext-help action-secondary action-help" rel="noopener" target="_blank"><%- gettext("What does this mean?") %></a>
<% } %>
</div>
</div>

2
lms/templates/instructor/instructor_dashboard_2/instructor_analytics.html
View File

@@ -11,7 +11,7 @@ from openedx.core.djangolib.markup import HTML, Text
<p>
<em>
${Text(_("For analytics about your course, go to {link_start}{analytics_dashboard_name}{link_end}.")).format(
link_start=HTML('<a href="{dashboard_url}" target="_blank">').format(
link_start=HTML('<a href="{dashboard_url}" rel="noopener" target="_blank">').format(
dashboard_url=escape_uri_path('{base_url}/courses/{course_id}'.format(
base_url=settings.ANALYTICS_DASHBOARD_URL,
course_id=section_data['course_id'],

2
lms/templates/login.html
View File

@@ -33,7 +33,7 @@ from openedx.core.djangolib.js_utils import js_escaped_string, dump_js_escaped_j
// new window/tab opening
$('a[rel="external"], a[class="new-vp"]')
.click( function() {
window.open( $(this).attr('href') );
window.open( $(this).attr('href'), '', 'noopener' );
return false;
});

2
lms/templates/lti.html
View File

@@ -34,7 +34,7 @@ from django.utils.translation import ugettext as _
% if description:
<div class="lti-description">${description}</div>
% endif
<p class="lti-link external"><a target="_blank" class="link_lti_new_window" href="${form_url}">
<p class="lti-link external"><a target="_blank" class="link_lti_new_window" rel="noopener" href="${form_url}">
${button_text or _('View resource in a new window')}
<span class="icon fa fa-external-link" aria-hidden="true"></span>
</a></p>

3
lms/templates/navigation/bootstrap/navbar-authenticated.html
View File

@@ -65,7 +65,8 @@ from django.utils.translation import ugettext as _
<li class="nav-item mt-2 nav-item-open-collapsed">
<a href="${get_online_help_info(online_help_token)['doc_url']}"
target="_blank"
rel="noopener"
target="_blank"
class="nav-link">${_("Help")}</a>
</li>

1
lms/templates/navigation/navbar-authenticated.html
View File

@@ -42,6 +42,7 @@ from django.utils.translation import ugettext as _
<%include file="../user_dropdown.html"/>
<a href="${get_online_help_info(online_help_token)['doc_url']}"
rel="noopener"
target="_blank"
class="doc-link">${_("Help")}</a>

4
lms/templates/navigation/navigation.html
View File

@@ -93,8 +93,8 @@ from openedx.core.djangoapps.lang_pref.api import header_language_selector_is_en
<div class="ie-banner" aria-hidden="true">${Text(_('{begin_strong}Warning:{end_strong} Your browser is not fully supported. We strongly recommend using {chrome_link} or {ff_link}.')).format(
begin_strong=HTML('<strong>'),
end_strong=HTML('</strong>'),
chrome_link=HTML('<a href="https://www.google.com/chrome" target="_blank">Chrome</a>'),
ff_link=HTML('<a href="http://www.mozilla.org/firefox" target="_blank">Firefox</a>'),
chrome_link=HTML('<a href="https://www.google.com/chrome" rel="noopener" target="_blank">Chrome</a>'),
ff_link=HTML('<a href="http://www.mozilla.org/firefox" rel="noopener" target="_blank">Firefox</a>'),
)}</div>
<![endif]-->
% endif

2
lms/templates/register-shib.html
View File

@@ -28,7 +28,7 @@ import calendar
// new window/tab opening
$('a[rel="external"], a[class="new-vp"]')
.click( function() {
window.open( $(this).attr('href') );
window.open( $(this).attr('href'), '', 'noopener' );
return false;
});

2
lms/templates/register.html
View File

@@ -29,7 +29,7 @@ import calendar
// new window/tab opening
$('a[rel="external"], a[class="new-vp"]')
.click( function() {
window.open( $(this).attr('href') );
window.open( $(this).attr('href'), '', 'noopener' );
return false;
});

4
lms/templates/signup_modal.html
View File

@@ -134,7 +134,7 @@ import calendar
<label data-field="terms_of_service" class="terms-of-service" for="signup_tos">
<input id="signup_tos" name="terms_of_service" type="checkbox" value="true">
${Text(_('I agree to the {link_start}Terms of Service{link_end}')).format(
link_start=HTML('<a href="{url}" target="_blank">').format(url=reverse('tos')),
link_start=HTML('<a href="{url}" rel="noopener" target="_blank">').format(url=reverse('tos')),
link_end=HTML('</a>'))} *
</label>
@@ -142,7 +142,7 @@ import calendar
<label data-field="honor_code" class="honor-code" for="signup_honor">
<input id="signup_honor" name="honor_code" type="checkbox" value="true">
${Text(_('I agree to the {link_start}Honor Code{link_end}')).format(
link_start=HTML('<a href="{url}" target="_blank">').format(url=reverse('honor')),
link_start=HTML('<a href="{url}" rel="noopener" target="_blank">').format(url=reverse('honor')),
link_end=HTML('</a>'))} *
</label>
% endif

2
lms/templates/student_account/account_settings.underscore
View File

@@ -6,7 +6,7 @@
<span><%= HtmlUtils.ensureHtml(message) %></span>
<div class="alert-actions">
<button class="btn-alert-primary" data-old-lang-code="<%- oldLangCode %>"><%- gettext('Switch Language Back') %></button>
<a href="<%- helpTranslateLink %>" target="_blank" class="btn-alert-secondary"><%= HtmlUtils.ensureHtml(helpTranslateText) %></a>
<a href="<%- helpTranslateLink %>" rel="noopener" target="_blank" class="btn-alert-secondary"><%= HtmlUtils.ensureHtml(helpTranslateText) %></a>
</div>
</div>
</div>

8
lms/templates/student_account/form_field.underscore
View File

@@ -15,7 +15,7 @@
</label>
<% if (supplementalLink && supplementalText) { %>
<div class="supplemental-link">
<a href="<%- supplementalLink %>" target="_blank"><%- supplementalText %></a>
<a href="<%- supplementalLink %>" rel="noopener" target="_blank"><%- supplementalText %></a>
</div>
<% } %>
<% } %>
@@ -45,7 +45,7 @@
<% if ( instructions ) { %> <span class="tip tip-input" id="<%- form %>-<%- name %>-desc"><%- instructions %></span><% } %>
<% if (supplementalLink && supplementalText) { %>
<div class="supplemental-link">
<a href="<%- supplementalLink %>" target="_blank"><%- supplementalText %></a>
<a href="<%- supplementalLink %>" rel="noopener" target="_blank"><%- supplementalText %></a>
</div>
<% } %>
<% } else if ( type === 'textarea' ) { %>
@@ -71,7 +71,7 @@
<% if ( instructions ) { %> <span class="tip tip-input" id="<%- form %>-<%- name %>-desc"><%- instructions %></span><% } %>
<% if (supplementalLink && supplementalText) { %>
<div class="supplemental-link">
<a href="<%- supplementalLink %>" target="_blank"><%- supplementalText %></a>
<a href="<%- supplementalLink %>" rel="noopener" target="_blank"><%- supplementalText %></a>
</div>
<% } %>
<% } else if (type === 'plaintext' ) { %>
@@ -86,7 +86,7 @@
<% if ( type === 'checkbox' ) { %>
<% if (supplementalLink && supplementalText) { %>
<div class="supplemental-link">
<a href="<%- supplementalLink %>" target="_blank"><%- supplementalText %></a>
<a href="<%- supplementalLink %>" rel="noopener" target="_blank"><%- supplementalText %></a>
</div>
<% } %>
<% } %>

2
lms/templates/wiki/delete.html
View File

@@ -26,7 +26,7 @@
<ul>
{% for child in delete_children %}
<li><a href="{% url 'wiki:get' article_id=child.article.id %}" target="_blank">{{ child.article }}</a></li>
<li><a href="{% url 'wiki:get' article_id=child.article.id %}" rel="noopener" target="_blank">{{ child.article }}</a></li>
{% if delete_children_more %}
<li><em>{% trans "...and more!" as tmsg%}{{tmsg|force_escape}}</em></li>
{% endif %}

6
lms/templates/wiki/includes/cheatsheet.html
View File

@@ -15,9 +15,9 @@
<p>{% trans "This wiki uses {start_strong}Markdown{end_strong} for styling. There are several useful guides online. See any of the links below for in-depth details:" as tmsg%}
{% interpolate_html tmsg start_strong='<strong>'|safe end_strong='</strong>'|safe %}</p>
<ul>
<li><a href="http://daringfireball.net/projects/markdown/basics" target="_blank">{% trans 'Markdown: Basics' as tmsg %}{{tmsg|force_escape}}</a></li>
<li><a href="http://greg.vario.us/doc/markdown.txt" target="_blank">{% trans 'Quick Markdown Syntax Guide' as tmsg %}{{tmsg|force_escape}}</a></li>
<li><a href="http://www.lowendtalk.com/discussion/6/miniature-markdown-guide" target="_blank">{% trans 'Miniature Markdown Guide' as tmsg%}{{tmsg|force_escape}}</a></li>
<li><a href="http://daringfireball.net/projects/markdown/basics" rel="noopener" target="_blank">{% trans 'Markdown: Basics' as tmsg %}{{tmsg|force_escape}}</a></li>
<li><a href="http://greg.vario.us/doc/markdown.txt" rel="noopener" target="_blank">{% trans 'Quick Markdown Syntax Guide' as tmsg %}{{tmsg|force_escape}}</a></li>
<li><a href="http://www.lowendtalk.com/discussion/6/miniature-markdown-guide" rel="noopener" target="_blank">{% trans 'Miniature Markdown Guide' as tmsg%}{{tmsg|force_escape}}</a></li>
</ul>
<p>{% trans "To create a new wiki article, create a link to it. Clicking the link gives you the creation page." as tmsg %}{{tmsg|force_escape}}</p>
<pre>{% trans "[Article Name](wiki:ArticleName)" as tmsg%}{{tmsg|force_escape}}</pre>