add some protection against opener attacks if external site is opened via window...

diff --git a/include/functions2.php b/include/functions2.php
index 6017a78f84d66226face64666d02cb0875b6d7eb..6674c77346d9e1c0125a423104d921d3e0f48284 100644 (file)
--- a/include/functions2.php
+++ b/include/functions2.php
@@ -1957,7 +1957,7 @@
 #                              $entry .= " <a target=\"_blank\" href=\"" . htmlspecialchars($url) . "\">" .
 #                                      $filename . " (" . $ctype . ")" . "</a>";
 
-                               $entry = "<div onclick=\"window.open('".htmlspecialchars($url)."')\"
+                               $entry = "<div onclick=\"openUrlPopup('".htmlspecialchars($url)."')\"
                                        dojoType=\"dijit.MenuItem\">$filename ($ctype)</div>";
 
                                array_push($entries_html, $entry);
@@ -2038,7 +2038,7 @@
                                else
                                        $filename = "";
 
-                               $rv .= "<div onclick='window.open(\"".htmlspecialchars($entry["url"])."\")'
+                               $rv .= "<div onclick='openUrlPopup(\"".htmlspecialchars($entry["url"])."\")'
                                        dojoType=\"dijit.MenuItem\">".$filename . $title."</div>";
 
                        };

diff --git a/js/functions.js b/js/functions.js
index db18ac6dd9d8d49bdb15a6c813ce00bd0c4b3af4..6ba0922aaacfc930eb5d21408fb869e104cd0154 100755 (executable)
--- a/js/functions.js
+++ b/js/functions.js
@@ -2064,9 +2064,17 @@ function getSelectionText() {
        return text.stripTags();
 }
 
+function openUrlPopup(url) {
+       var w = window.open("");
+
+       w.opener = null;
+       w.location = url;
+}
 function openArticlePopup(id) {
-       window.open("backend.php?op=article&method=view&mode=raw&html=1&zoom=1&id=" + id +
-               "&csrf_token=" + getInitParam("csrf_token"),
+       var w = window.open("",
                "ttrss_article_popup",
                "height=900,width=900,resizable=yes,status=no,location=no,menubar=no,directories=no,scrollbars=yes,toolbar=no");
+
+       w.opener = null;
+       w.location = "backend.php?op=article&method=view&mode=raw&html=1&zoom=1&id=" + id + "&csrf_token=" + getInitParam("csrf_token");
 }
\ No newline at end of file

diff --git a/js/viewfeed.js b/js/viewfeed.js
index 1f597e226073f952ed13d6e31f0d7ec9f5a12d13..dfbf8bced9a22438009ad372ee8807a9fcfa9038 100755 (executable)
--- a/js/viewfeed.js
+++ b/js/viewfeed.js
@@ -1729,7 +1729,10 @@ function hlClicked(event, id) {
 
 function openArticleInNewWindow(id) {
        toggleUnread(id, 0, false);
-       window.open("backend.php?op=article&method=redirect&id=" + id);
+
+       var w = window.open("");
+       w.opener = null;
+       w.location = "backend.php?op=article&method=redirect&id=" + id;
 }
 
 function isCdmMode() {