getgrav / getgrav/grav-plugin-admin
Tabnabbing on the notifications and blog updates
- Dominant language
- PHP
- Stars
- 377
- Forks
- 225
- Avg merge
- 11h 51m
- Merged PRs (30d)
- 4
Description
The links in the dashboard have `target="_blank"` which allows those links to have access to the `window.opener`. This is a small security issue where the landing pages will have partial access to the admin dashboard page.
## Proposed fix
Add `rel="noopener noreferrer"` to each outbound link being opened in a new tab.
[https://github.com/getgrav/grav-plugin-admin/edit/develop/themes/grav/templates/partials/notification-feed-block.html.twig](https://github.com/getgrav/grav-plugin-admin/edit/develop/themes/grav/templates/partials/notification-feed-block.html.twig)
## References
* https://owasp.org/www-community/attacks/Reverse_Tabnabbing
* https://en.wikipedia.org/wiki/Tabnabbing
Contributor guide
Assessment
This issue has not been assessed yet.