getgrav / getgrav/grav-plugin-admin

Tabnabbing on the notifications and blog updates

Open
#2,012 0 comments 0 reactions 1 assignee Claimed by @rhukster View on GitHub
enhancement
Dominant language
PHP
Stars
377
Forks
225
Avg merge
11h 51m
Merged PRs (30d)
4

Description

The links in the dashboard have `target="_blank"` which allows those links to have access to the `window.opener`. This is a small security issue where the landing pages will have partial access to the admin dashboard page.

## Proposed fix
Add `rel="noopener noreferrer"` to each outbound link being opened in a new tab.

[https://github.com/getgrav/grav-plugin-admin/edit/develop/themes/grav/templates/partials/notification-feed-block.html.twig](https://github.com/getgrav/grav-plugin-admin/edit/develop/themes/grav/templates/partials/notification-feed-block.html.twig)

## References
* https://owasp.org/www-community/attacks/Reverse_Tabnabbing
* https://en.wikipedia.org/wiki/Tabnabbing

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.