@nico3333fr opened this Pull Request on May 8th 2018 Contributor

Hi there,

first thanks for Matomo, I use it on several website, really happy with it. 👍

While running a detectify on one of my website, it found that the piwik/piwik.php is giving this text
This resource is part of Matomo. Keep full control of your data with the leading free and open source digital analytics platform for web and mobile. with a link to Matomo using target="_blank".

And it advised me to add rel="noopener noreferrer" to this link, which is indeed, a good security pratice, see https://medium.com/@jitbit/target-blank-the-most-underestimated-vulnerability-ever-96e328301f4c for example.

I've modified all the files where I found it, hope this will be enough.

Cheers,
Nicolas

@Findus23 commented on May 8th 2018 Member

Thanks @nico3333fr and congratulation to the first PR :tada:

Using noreferrer is definitely a good idea.

@c960657 is currently going through all external links in #12780 so this is related.

@mattab commented on May 8th 2018 Member

Thanks for the PR! FYI there are 2 tests failing

1) Piwik\Tests\Unit\Tracker\ResponseTest::test_outputResponse_shouldOutputPiwikMessage_InCaseNothingWasTracked
Failed asserting that two strings are equal.
--- Expected
+++ Actual
@@ @@
-'This resource is part of Matomo. Keep full control of your data with the leading free and open source <a href='https://matomo.org' target='_blank'>digital analytics platform</a> for web and mobile.'
+'This resource is part of Matomo. Keep full control of your data with the leading free and open source <a href='https://matomo.org' target='_blank' rel='noopener noreferrer'>digital analytics platform</a> for web and mobile.'
3) Piwik\Tests\Integration\TrackerTest::test_main_shouldReturnEmptyPiwikResponse_IfNoRequestsAreGiven
Failed asserting that two strings are equal.
--- Expected
+++ Actual
@@ @@
-'This resource is part of Matomo. Keep full control of your data with the leading free and open source <a href='https://matomo.org' target='_blank'>digital analytics platform</a> for web and mobile.'
+'This resource is part of Matomo. Keep full control of your data with the leading free and open source <a href='https://matomo.org' target='_blank' rel='noopener noreferrer'>digital analytics platform</a> for web and mobile.'
/home/travis/build/matomo-org/matomo/tests/PHPUnit/Integration/TrackerTest.php:255

(There are actually more tests failing but they are unrelated to this PR, we'll need to fix them as soon as doable cc @sgiehl @diosmosis )

This Pull Request was closed on May 14th 2018
Powered by GitHub Issue Mirror