From f138d3cb70e96a6124c543092397c907d959d9d5 Mon Sep 17 00:00:00 2001
From: Julian Lam <julian@nodebb.org>
Date: Mon, 15 Jan 2018 15:28:46 -0500
Subject: [PATCH] adding noopener and noreferrer to links in widgets

---
 public/src/utils.js   | 14 ++++++++++++++
 public/src/widgets.js |  1 +
 2 files changed, 15 insertions(+)

diff --git a/public/src/utils.js b/public/src/utils.js
index 0e300d2772..078396fdeb 100644
--- a/public/src/utils.js
+++ b/public/src/utils.js
@@ -545,6 +545,20 @@
 			return str.toString().replace(escapeChars, replaceChar);
 		},
 
+		addNoReferrer: function (containerEl) {
+			containerEl.find('a').attr('rel', function (idx, value) {
+				value = value ? value.split(' ') : [];
+
+				['noopener', 'noreferrer'].forEach(function (property) {
+					if (!value.includes(property)) {
+						value.push(property);
+					}
+				});
+
+				return value.join(' ');
+			});
+		},
+
 		isAndroidBrowser: function () {
 			// http://stackoverflow.com/questions/9286355/how-to-detect-only-the-native-android-browser
 			var nua = navigator.userAgent;
diff --git a/public/src/widgets.js b/public/src/widgets.js
index 51f6e0d2be..b8e22ab276 100644
--- a/public/src/widgets.js
+++ b/public/src/widgets.js
@@ -59,6 +59,7 @@
 				title: $(this).attr('title'),
 			});
 		});
+		utils.addNoReferrer(widgetAreas);
 		$(window).trigger('action:widgets.loaded', {});
 		callback();
 	};