Skip to content

K
kohinos-tav
Commit e7618e16 by Julien Jorry
Options

Fix target='_blank' securty issues with rel='noopener noreferrer'

parent 0ce4a2f8
Showing with 14 additions and 12 deletions
src/Form/Type/GlobalConfigurationFormType.php
...@@ -100,7 +100,7 @@ class GlobalConfigurationFormType extends AbstractType ...@@ -100,7 +100,7 @@ class GlobalConfigurationFormType extends AbstractType
new RegexConstraint(['pattern' => '/^\[[0-9]+\.[0-9]+,[0-9]+\.[0-9]+\]/', 'message' => 'Coordonnées invalide, format attendu : [45.7,3.2]']), new RegexConstraint(['pattern' => '/^\[[0-9]+\.[0-9]+,[0-9]+\.[0-9]+\]/', 'message' => 'Coordonnées invalide, format attendu : [45.7,3.2]']),
], ],
'help_html' => true, 'help_html' => true,
'help' => "Pour déterminer le centre et zoom de la carte <a target='_blank' href='https://www.openstreetmap.org/'>Ouvrir OpenStreetMap</a><br/> 'help' => "Pour déterminer le centre et zoom de la carte <a target='_blank' rel='noopener noreferrer' href='https://www.openstreetmap.org/'>Ouvrir OpenStreetMap</a><br/>
Exemple : <em>https://www.openstreetmap.org/search?query=clermont#map=12/45.7811/3.0927</em><br/> Exemple : <em>https://www.openstreetmap.org/search?query=clermont#map=12/45.7811/3.0927</em><br/>
Zoom de la carte : 12<br/> Zoom de la carte : 12<br/>
Centre de la carte : [45.7811,3.0927]", Centre de la carte : [45.7811,3.0927]",
......
templates/themes/kohinos/admin/fluxvisualisation.html.twig
...@@ -114,7 +114,7 @@ ...@@ -114,7 +114,7 @@
<h4><u>{{ "Exemples d'importations possible (Fichiers .csv uniquement):"|trans }}</u></h4> <h4><u>{{ "Exemples d'importations possible (Fichiers .csv uniquement):"|trans }}</u></h4>
<div class='mb-5'> <div class='mb-5'>
{% for key, csvparam in csvparams %} {% for key, csvparam in csvparams %}
<h5><strong>{{ key|capitalize }} : </strong><a class='ml-4' target='_blank' href='{{ csvparam.file }}'>Télécharger un exemple</a></h5> <h5><strong>{{ key|capitalize }} : </strong><a class='ml-4' target='_blank' rel="noopener noreferrer" href='{{ csvparam.file }}'>Télécharger un exemple</a></h5>
<p class='ml-4'><i>{{ csvparam.header }}</i></p> <p class='ml-4'><i>{{ csvparam.header }}</i></p>
<p class='ml-4 mb-4'><i>{{ 'Exemple'|trans }} :</i> {{ csvparam.example }}</p> <p class='ml-4 mb-4'><i>{{ 'Exemple'|trans }} :</i> {{ csvparam.example }}</p>
{% endfor %} {% endfor %}
......
templates/themes/kohinos/admin/import.html.twig
...@@ -50,9 +50,9 @@ ...@@ -50,9 +50,9 @@
{% for key, csvparam in csvparams %} {% for key, csvparam in csvparams %}
<h4>{{ key|capitalize }}(s) : </h4> <h4>{{ key|capitalize }}(s) : </h4>
<p> <p>
<a class='btn btn-default ml-4' target='_blank' href='{{ csvparam.filexls }}'>Instructions en .xlsx</a> <a class='btn btn-default ml-4' target='_blank' rel="noopener noreferrer" href='{{ csvparam.filexls }}'>Instructions en .xlsx</a>
<a class='btn btn-default ml-4' target='_blank' href='{{ csvparam.filenum }}'>Instructions en .numbers</a> <a class='btn btn-default ml-4' target='_blank' rel="noopener noreferrer" href='{{ csvparam.filenum }}'>Instructions en .numbers</a>
<a class='btn btn-default ml-4' target='_blank' href='{{ csvparam.filecsv }}'>Exemple .csv</a> <a class='btn btn-default ml-4' target='_blank' rel="noopener noreferrer" href='{{ csvparam.filecsv }}'>Exemple .csv</a>
</p> </p>
{# <p class='ml-4'><i>{{ csvparam.header }}</i></p> {# <p class='ml-4'><i>{{ csvparam.header }}</i></p>
<p class='ml-4 mb-4'><i>{{ 'Exemple'|trans }} :</i> {{ csvparam.example }}</p> #} <p class='ml-4 mb-4'><i>{{ 'Exemple'|trans }} :</i> {{ csvparam.example }}</p> #}
......
templates/themes/kohinos/block/useradmin.html.twig
...@@ -66,7 +66,7 @@ ...@@ -66,7 +66,7 @@
{% include '@kohinos/presta/block/carte.html.twig' with {'title': 'Situer les Prestataires'|trans}%} {% include '@kohinos/presta/block/carte.html.twig' with {'title': 'Situer les Prestataires'|trans}%}
{% endif %} {% endif %}
{% if app.user and is_granted('ROLE_ADMIN') %} {% if app.user and is_granted('ROLE_ADMIN') %}
<a href='http://wiki.kohinos.net/doku.php?id=doc:doc' target='_blank' class='ml-2 text-center'><i class="fa fa-book mr-2" aria-hidden="true"></i> Documentation utilisateur</a> <a href='http://wiki.kohinos.net/doku.php?id=doc:doc' target='_blank' rel="noopener noreferrer" class='ml-2 text-center'><i class="fa fa-book mr-2" aria-hidden="true"></i> Documentation utilisateur</a>
{% endif %} {% endif %}
{% endif %} {% endif %}
</div> </div>
templates/themes/kohinos/bundles/SonataAdminBundle/CRUD/list__action_showonfront.html.twig
...@@ -13,6 +13,7 @@ file that was distributed with this source code. ...@@ -13,6 +13,7 @@ file that was distributed with this source code.
<a <a
href="{{ admin.getRouteShowOnFront(object) }}" href="{{ admin.getRouteShowOnFront(object) }}"
target='_blank' target='_blank'
rel="noopener noreferrer"
class="btn btn-sm btn-default view_link" class="btn btn-sm btn-default view_link"
title="{{ 'action_show'|trans({}, 'SonataAdminBundle') }}" title="{{ 'action_show'|trans({}, 'SonataAdminBundle') }}"
> >
......
templates/themes/kohinos/bundles/SonataAdminBundle/standard_layout.html.twig
...@@ -177,7 +177,7 @@ Modified for MLC from Sonata package. ...@@ -177,7 +177,7 @@ Modified for MLC from Sonata package.
{% block bugreport %} {% block bugreport %}
{% set printBugReport = KOH_BUG_REPORT|default('') %} {% set printBugReport = KOH_BUG_REPORT|default('') %}
{% if app.user and (is_granted('ROLE_ADMIN') and printBugReport == 'ROLE_ADMIN') or (is_granted('ROLE_USER') and printBugReport == 'ROLE_USER') %} {% if app.user and (is_granted('ROLE_ADMIN') and printBugReport == 'ROLE_ADMIN') or (is_granted('ROLE_USER') and printBugReport == 'ROLE_USER') %}
<a class='sidebar-front' style='color:#a94442 !important;' href='{{ path('bugreport') }}' target='_blank'> <a class='sidebar-front' style='color:#a94442 !important;' href='{{ path('bugreport') }}' target='_blank' rel="noopener noreferrer">
<i class="fa fa-lg fa-bug"></i> <i class="fa fa-lg fa-bug"></i>
<span class="sr-only">{{ "Reporter un bug"|trans({}, 'messages') }}</span> <span class="sr-only">{{ "Reporter un bug"|trans({}, 'messages') }}</span>
</a> </a>
......
templates/themes/kohinos/common/footer.html.twig
<footer class="container clearfix footer"> <footer class="container clearfix footer">
{# TODO : ajouter crédit et lien vers la solution de gestion de la monnaie locale complémentaire libre de droits #} {# TODO : ajouter crédit et lien vers la solution de gestion de la monnaie locale complémentaire libre de droits #}
<a href='http://www.kohinos.com' target='_blank'>Kohinos</a> <a href='http://www.kohinos.com' target='_blank' rel="noopener noreferrer">Kohinos</a>
<span class='appversion'> <span class='appversion'>
<a href='https://www.gnu.org/licenses/agpl-3.0.fr.html' target='_blank' style='color:grey;'>(Licence AGPL v3)</a> <a href='https://www.gnu.org/licenses/agpl-3.0.fr.html' target='_blank' rel="noopener noreferrer" style='color:grey;'>(Licence AGPL v3)</a>
<span> - v{{ shivas_app_version }}</span> <span> - v{{ shivas_app_version }}</span>
</span> </span>
......
templates/themes/kohinos/common/menu.html.twig
...@@ -36,7 +36,7 @@ ...@@ -36,7 +36,7 @@
{% set printBugReport = KOH_BUG_REPORT|default('') %} {% set printBugReport = KOH_BUG_REPORT|default('') %}
{% if app.user and (is_granted('ROLE_ADMIN') and printBugReport == 'ROLE_ADMIN') or (is_granted('ROLE_USER') and printBugReport == 'ROLE_USER') %} {% if app.user and (is_granted('ROLE_ADMIN') and printBugReport == 'ROLE_ADMIN') or (is_granted('ROLE_USER') and printBugReport == 'ROLE_USER') %}
<li class="nav-item" role="menu-item"> <li class="nav-item" role="menu-item">
<a class='nav-link text-warning' href='{{ path('bugreport') }}' target='_blank' data-toggle="tooltip" data-placement="bottom" title="{{ 'Reporter un bug'|trans }}"> <a class='nav-link text-warning' href='{{ path('bugreport') }}' target='_blank' rel="noopener noreferrer" data-toggle="tooltip" data-placement="bottom" title="{{ 'Reporter un bug'|trans }}">
<i class="fas fa-bug"></i> <i class="fas fa-bug"></i>
</a> </a>
</li> </li>
......
templates/themes/kohinos/email/email_layout.html.twig
...@@ -54,6 +54,6 @@ ...@@ -54,6 +54,6 @@
<td></td> <td></td>
</tr> </tr>
</table> </table>
<a href='http://www.kohinos.com' target='_blank'>Kohinos</a> <a href='https://www.gnu.org/licenses/agpl-3.0.fr.html' target='_blank' style='color:grey;'>(Licence AGPL v3)</a> <span class='appversion'> - v{{ shivas_app_version }}</span> <a href='http://www.kohinos.com' target='_blank' rel='noopener noreferrer'>Kohinos</a> <a href='https://www.gnu.org/licenses/agpl-3.0.fr.html' target='_blank' rel='noopener noreferrer' style='color:grey;'>(Licence AGPL v3)</a> <span class='appversion'> - v{{ shivas_app_version }}</span>
</body> </body>
</html> </html>
\ No newline at end of file
templates/themes/kohinos/presta/show.html.twig
...@@ -48,7 +48,7 @@ ...@@ -48,7 +48,7 @@
<h6 class="card-subtitle text-muted mb-3">{{'Horaires'|trans}} : {{ presta.horaires|raw }}</h6> <h6 class="card-subtitle text-muted mb-3">{{'Horaires'|trans}} : {{ presta.horaires|raw }}</h6>
{% endif %} {% endif %}
{% if presta.web != null %} {% if presta.web != null %}
<h6 class="card-subtitle mb-3">{{'Site web'|trans}} : <a href='{{ presta.web }}' target='_blank'>{{ presta.web }}</a></h6> <h6 class="card-subtitle mb-3">{{'Site web'|trans}} : <a href='{{ presta.web }}' target='_blank' rel='noopener noreferrer'>{{ presta.web }}</a></h6>
{% endif %} {% endif %}
{# {% if presta.responsable != null and presta.metier != null %} {# {% if presta.responsable != null and presta.metier != null %}
<h6 class="card-title my-3">Responsable : {{ presta.responsable }} ({{ presta.metier }})</h6> <h6 class="card-title my-3">Responsable : {{ presta.responsable }} ({{ presta.metier }})</h6>
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment