From 9a3c1c71824723d4b369df9b412fd0a7d6f08ac5 Mon Sep 17 00:00:00 2001
From: Bernhard Posselt <dev@bernhard-posselt.com>
Date: Tue, 10 May 2016 17:34:00 +0200
Subject: Fix window.opener vulnerability

---
 js/gui/KeyboardShortcuts.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'js')

diff --git a/js/gui/KeyboardShortcuts.js b/js/gui/KeyboardShortcuts.js
index c90f3bc70..9e32a15b3 100644
--- a/js/gui/KeyboardShortcuts.js
+++ b/js/gui/KeyboardShortcuts.js
@@ -263,7 +263,9 @@
     var openLink = function (scrollArea) {
         onActiveItem(scrollArea, function (item) {
             item.trigger('click');  // mark read
-            window.open(item.find('.external:visible').attr('href'), '_blank');
+            var url = item.find('.external:visible').attr('href');
+            var newWindow = window.open(url, '_blank');
+            newWindow.opener = null;
         });
     };
 
-- 
cgit v1.2.3