From: Andrew Dolgov <noreply@madoka.volgo-balt.ru>
Date: Wed, 8 Feb 2017 12:07:05 +0000 (+0300)
Subject: add some protection against opener attacks if external site is opened via window... 
X-Git-Tag: 17.4~58
X-Git-Url: https://git.wh0rd.org/?a=commitdiff_plain;h=829d478f1b054c8ce1eeb4f15170dc4a1abb3e47;p=tt-rss.git

add some protection against opener attacks if external site is opened via window.open()
---

diff --git a/include/functions2.php b/include/functions2.php
index 6017a78f..6674c773 100644
--- a/include/functions2.php
+++ b/include/functions2.php
@@ -1957,7 +1957,7 @@
 #				$entry .= " <a target=\"_blank\" href=\"" . htmlspecialchars($url) . "\">" .
 #					$filename . " (" . $ctype . ")" . "</a>";
 
-				$entry = "<div onclick=\"window.open('".htmlspecialchars($url)."')\"
+				$entry = "<div onclick=\"openUrlPopup('".htmlspecialchars($url)."')\"
 					dojoType=\"dijit.MenuItem\">$filename ($ctype)</div>";
 
 				array_push($entries_html, $entry);
@@ -2038,7 +2038,7 @@
 				else
 					$filename = "";
 
-				$rv .= "<div onclick='window.open(\"".htmlspecialchars($entry["url"])."\")'
+				$rv .= "<div onclick='openUrlPopup(\"".htmlspecialchars($entry["url"])."\")'
 					dojoType=\"dijit.MenuItem\">".$filename . $title."</div>";
 
 			};
diff --git a/js/functions.js b/js/functions.js
index db18ac6d..6ba0922a 100755
--- a/js/functions.js
+++ b/js/functions.js
@@ -2064,9 +2064,17 @@ function getSelectionText() {
 	return text.stripTags();
 }
 
+function openUrlPopup(url) {
+	var w = window.open("");
+
+	w.opener = null;
+	w.location = url;
+}
 function openArticlePopup(id) {
-	window.open("backend.php?op=article&method=view&mode=raw&html=1&zoom=1&id=" + id +
-		"&csrf_token=" + getInitParam("csrf_token"),
+	var w = window.open("",
 		"ttrss_article_popup",
 		"height=900,width=900,resizable=yes,status=no,location=no,menubar=no,directories=no,scrollbars=yes,toolbar=no");
+
+	w.opener = null;
+	w.location = "backend.php?op=article&method=view&mode=raw&html=1&zoom=1&id=" + id + "&csrf_token=" + getInitParam("csrf_token");
 }
\ No newline at end of file
diff --git a/js/viewfeed.js b/js/viewfeed.js
index 1f597e22..dfbf8bce 100755
--- a/js/viewfeed.js
+++ b/js/viewfeed.js
@@ -1729,7 +1729,10 @@ function hlClicked(event, id) {
 
 function openArticleInNewWindow(id) {
 	toggleUnread(id, 0, false);
-	window.open("backend.php?op=article&method=redirect&id=" + id);
+
+	var w = window.open("");
+	w.opener = null;
+	w.location = "backend.php?op=article&method=redirect&id=" + id;
 }
 
 function isCdmMode() {