From 1eef7893068655f8d145a3e06061a9e6296ac1f3 Mon Sep 17 00:00:00 2001
From: Marien Fressinaud <dev@marienfressinaud.fr>
Date: Wed, 1 Oct 2014 11:27:41 +0200
Subject: Reorganize subscription management code

There is still a lot of work to do. Some links are broken.

See https://github.com/marienfressinaud/FreshRSS/issues/646
---
 app/layout/aside_subscription.phtml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 app/layout/aside_subscription.phtml

(limited to 'app/layout/aside_subscription.phtml')

diff --git a/app/layout/aside_subscription.phtml b/app/layout/aside_subscription.phtml
new file mode 100644
index 000000000..9a95763c3
--- /dev/null
+++ b/app/layout/aside_subscription.phtml
@@ -0,0 +1,17 @@
+<ul class="nav nav-list aside aside_feed">
+	<li class="nav-header"><?php echo _t('subscription_management'); ?></li>
+
+	<li class="item<?php echo Minz_Request::controllerName() == 'subscription' ? ' active' : ''; ?>">
+		<a href="<?php echo _url('subscription', 'index'); ?>"><?php echo _t('subscription_management'); ?></a>
+	</li>
+
+	<li class="item<?php echo Minz_Request::controllerName() == 'importExport' ? ' active' : ''; ?>">
+		<a href="<?php echo _url('importExport', 'index'); ?>"><?php echo _t('import_export'); ?></a>
+	</li>
+
+	<li class="item">
+		<a onclick="return false;" href="javascript:(function(){var%20url%20=%20location.href;window.open('<?php echo Minz_Url::display(array('c' => 'feed', 'a' => 'add'), 'html', true); ?>&amp;url_rss='+encodeURIComponent(url), '_blank');})();">
+			<?php echo _t('bookmark'); ?>
+		</a>
+	</li>
+</ul>
-- 
cgit v1.2.3


From 6dc1267b9832272abd466579053c2bcdedcb5ecb Mon Sep 17 00:00:00 2001
From: Marien Fressinaud <dev@marienfressinaud.fr>
Date: Thu, 23 Oct 2014 12:33:22 +0200
Subject: Fix Origine theme

See https://github.com/marienfressinaud/FreshRSS/issues/634
---
 app/layout/aside_subscription.phtml |  2 +-
 p/themes/Origine/origine.css        |  8 ++++----
 p/themes/base-theme/template.css    | 24 ++++++++++++++++++------
 3 files changed, 23 insertions(+), 11 deletions(-)

(limited to 'app/layout/aside_subscription.phtml')

diff --git a/app/layout/aside_subscription.phtml b/app/layout/aside_subscription.phtml
index 9a95763c3..cbf5df67d 100644
--- a/app/layout/aside_subscription.phtml
+++ b/app/layout/aside_subscription.phtml
@@ -1,4 +1,4 @@
-<ul class="nav nav-list aside aside_feed">
+<ul class="nav nav-list aside">
 	<li class="nav-header"><?php echo _t('subscription_management'); ?></li>
 
 	<li class="item<?php echo Minz_Request::controllerName() == 'subscription' ? ' active' : ''; ?>">
diff --git a/p/themes/Origine/origine.css b/p/themes/Origine/origine.css
index 0a317695b..d01bed963 100644
--- a/p/themes/Origine/origine.css
+++ b/p/themes/Origine/origine.css
@@ -505,7 +505,7 @@ a.btn {
 .tree-folder-title {
 	padding: 0 10px;
 	line-height: 2.5rem;
-	font-size: 1.2rem;
+	font-size: 1rem;
 	font-weight: bold;
 }
 .tree-folder-items {
@@ -513,7 +513,7 @@ a.btn {
 	border-bottom: 1px solid #ccc;
 	background: #f6f6f6;
 }
-.tree-folder-items .item {
+.tree-folder-items > .item {
 	padding: 0 10px;
 	line-height: 2.5rem;
 	font-size: 0.8rem;
@@ -606,12 +606,12 @@ a.btn {
 .aside_feed .tree-folder-items .item.error.active > a {
 	color: #fff;
 }
-.aside_feed .tree-folder-items .item > a {
+.aside_feed .tree-folder-items > .item > a {
 	line-height: 3em;
 	text-align: left;
 	text-decoration: none;
 }
-.aside_feed .tree-folder-items .item:not([data-unread="0"]) {
+.aside_feed .tree-folder-items > .item:not([data-unread="0"]) {
 	font-weight: bold;
 }
 .aside_feed .tree-folder-items .dropdown-menu:after {
diff --git a/p/themes/base-theme/template.css b/p/themes/base-theme/template.css
index fb02a5b53..bcafd162c 100644
--- a/p/themes/base-theme/template.css
+++ b/p/themes/base-theme/template.css
@@ -331,19 +331,31 @@ a.btn {
 	padding: 0;
 	list-style: none;
 }
-.tree-folder-title {
-	display: block;
-}
 .tree-folder-items {
 	padding: 0;
 	list-style: none;
 }
-.tree-folder-items .item {
+.tree-folder-title {
 	display: block;
 	overflow: hidden;
 	white-space: nowrap;
 	text-overflow: ellipsis;
 }
+.tree-folder-title .title {
+	vertical-align: middle;
+}
+.tree-folder-items > .item {
+	display: block;
+	white-space: nowrap;
+}
+.tree-folder-items > .item > a {
+	display: inline-block;
+	vertical-align: middle;
+	width: calc(100% - 32px);
+	overflow: hidden;
+	white-space: nowrap;
+	text-overflow: ellipsis;
+}
 
 /*=== STRUCTURE */
 /*===============*/
@@ -392,7 +404,7 @@ a.btn {
 
 /*=== Aside main page (categories) */
 .aside_feed.state_unread .tree-folder:not(.active)[data-unread="0"],
-.aside_feed.state_unread .tree-folder .item:not(.active)[data-unread="0"] {
+.aside_feed.state_unread .tree-folder > .item:not(.active)[data-unread="0"] {
 	display: none;
 }
 .aside_feed .tree-folder-title > .title:not([data-unread="0"]):after {
@@ -403,7 +415,7 @@ a.btn {
 .aside_feed .tree-folder-items:not(.active) {
 	display: none;
 }
-.aside_feed .tree-folder-items .item > a:not([data-unread="0"]):before {
+.aside_feed .tree-folder-items > .item > a:not([data-unread="0"]):before {
 	content: "(" attr(data-unread) ") ";
 }
 .aside_feed .tree-folder-items .dropdown-menu {
-- 
cgit v1.2.3


From 2f24f0fe882af0be6c893b16d9adae48e06bac1f Mon Sep 17 00:00:00 2001
From: Marien Fressinaud <dev@marienfressinaud.fr>
Date: Wed, 10 Dec 2014 22:37:49 +0100
Subject: Fix i18n for aside subscription

---
 app/i18n/en/gen.php                 | 2 --
 app/i18n/en/sub.php                 | 5 +++++
 app/i18n/fr/gen.php                 | 5 -----
 app/i18n/fr/sub.php                 | 5 +++++
 app/layout/aside_subscription.phtml | 8 ++++----
 5 files changed, 14 insertions(+), 11 deletions(-)

(limited to 'app/layout/aside_subscription.phtml')

diff --git a/app/i18n/en/gen.php b/app/i18n/en/gen.php
index c762713c1..f98c40c5b 100644
--- a/app/i18n/en/gen.php
+++ b/app/i18n/en/gen.php
@@ -110,7 +110,6 @@ return array(
 	'before_yesterday' => 'Before yesterday',
 	'blank_to_disable' => 'Leave blank to disable',
 	'blogotext' => 'Blogotext',
-	'bookmark' => 'Subscribe (FreshRSS bookmark)',
 	'bottom_line' => 'Bottom line',
 	'bugs_reports' => 'Bugs reports',
 	'by' => 'by',
@@ -235,7 +234,6 @@ return array(
 	'http_username' => 'HTTP username',
 	'img_with_lazyload' => 'Use "lazy load" mode to load pictures',
 	'import' => 'Import',
-	'import_export' => 'Import / export',
 	'informations' => 'Information',
 	'install_not_deleted' => 'Something went wrong; you must delete the file <em>%s</em> manually.',
 	'installation_is_ok' => 'The installation process was successful.<br />The final step will now attempt to delete any file and database backup created during the update process.<br />You may choose to skip this step by deleting <kbd>./data/do-install.txt</kbd> manually.',
diff --git a/app/i18n/en/sub.php b/app/i18n/en/sub.php
index e64b6ca4b..d915a18a7 100644
--- a/app/i18n/en/sub.php
+++ b/app/i18n/en/sub.php
@@ -7,4 +7,9 @@ return array(
 	'feeds' => array(
 		'over_max' => 'You have reached your limit of feeds (%d)',
 	),
+	'menu' => array(
+		'bookmark' => 'Subscribe (FreshRSS bookmark)',
+		'import_export' => 'Import / export',
+		'subscription_management' => 'Subscriptions management',
+	),
 );
diff --git a/app/i18n/fr/gen.php b/app/i18n/fr/gen.php
index 9d9624cc8..06a08eb0a 100644
--- a/app/i18n/fr/gen.php
+++ b/app/i18n/fr/gen.php
@@ -110,7 +110,6 @@ return array(
 	'before_yesterday' => 'À partir d’avant-hier',
 	'blank_to_disable' => 'Laissez vide pour désactiver',
 	'blogotext' => 'Blogotext',
-	'bookmark' => 'S’abonner (bookmark FreshRSS)',
 	'bottom_line' => 'Ligne du bas',
 	'bugs_reports' => 'Rapports de bugs',
 	'by' => 'par',
@@ -235,7 +234,6 @@ return array(
 	'http_username' => 'Identifiant HTTP',
 	'img_with_lazyload' => 'Utiliser le mode “chargement différé” pour les images',
 	'import' => 'Importer',
-	'import_export' => 'Importer / exporter',
 	'informations' => 'Informations',
 	'install_not_deleted' => 'Quelque chose s’est mal passé, vous devez supprimer le fichier <em>%s</em> à la main.',
 	'installation_is_ok' => 'L’installation s’est bien passée.<br />La dernière étape va maintenant tenter de supprimer les fichiers ainsi que d’éventuelles copies de base de données créés durant le processus de mise à jour.<br />Vous pouvez choisir de sauter cette étape en supprimant <kbd>./data/do-install.txt</kbd> manuellement.',
@@ -421,11 +419,8 @@ return array(
 	'stats_entry_per_month' => 'Par mois (moyenne : %.2f messages)',
 	'stats_entry_repartition' => 'Répartition des articles',
 	'stats_feed_per_category' => 'Flux par catégorie',
-	'stats_idle' => 'Flux inactifs',
-	'stats_main' => 'Statistiques principales',
 	'stats_no_idle' => 'Il n’y a aucun flux inactif !',
 	'stats_percent_of_total' => '%% du total',
-	'stats_repartition' => 'Répartition des articles',
 	'stats_top_feed' => 'Les dix plus gros flux',
 	'status_favorites' => 'favoris',
 	'status_read' => 'lus',
diff --git a/app/i18n/fr/sub.php b/app/i18n/fr/sub.php
index 6ef4002a6..7bb52b113 100644
--- a/app/i18n/fr/sub.php
+++ b/app/i18n/fr/sub.php
@@ -7,4 +7,9 @@ return array(
 	'feeds' => array(
 		'over_max' => 'Vous avez atteint votre limite de flux (%d)',
 	),
+	'menu' => array(
+		'bookmark' => 'S’abonner (bookmark FreshRSS)',
+		'import_export' => 'Importer / exporter',
+		'subscription_management' => 'Gestion des abonnements',
+	),
 );
diff --git a/app/layout/aside_subscription.phtml b/app/layout/aside_subscription.phtml
index cbf5df67d..8a54e2dc2 100644
--- a/app/layout/aside_subscription.phtml
+++ b/app/layout/aside_subscription.phtml
@@ -1,17 +1,17 @@
 <ul class="nav nav-list aside">
-	<li class="nav-header"><?php echo _t('subscription_management'); ?></li>
+	<li class="nav-header"><?php echo _t('sub.menu.subscription_management'); ?></li>
 
 	<li class="item<?php echo Minz_Request::controllerName() == 'subscription' ? ' active' : ''; ?>">
-		<a href="<?php echo _url('subscription', 'index'); ?>"><?php echo _t('subscription_management'); ?></a>
+		<a href="<?php echo _url('subscription', 'index'); ?>"><?php echo _t('sub.menu.subscription_management'); ?></a>
 	</li>
 
 	<li class="item<?php echo Minz_Request::controllerName() == 'importExport' ? ' active' : ''; ?>">
-		<a href="<?php echo _url('importExport', 'index'); ?>"><?php echo _t('import_export'); ?></a>
+		<a href="<?php echo _url('importExport', 'index'); ?>"><?php echo _t('sub.menu.import_export'); ?></a>
 	</li>
 
 	<li class="item">
 		<a onclick="return false;" href="javascript:(function(){var%20url%20=%20location.href;window.open('<?php echo Minz_Url::display(array('c' => 'feed', 'a' => 'add'), 'html', true); ?>&amp;url_rss='+encodeURIComponent(url), '_blank');})();">
-			<?php echo _t('bookmark'); ?>
+			<?php echo _t('sub.menu.bookmark'); ?>
 		</a>
 	</li>
 </ul>
-- 
cgit v1.2.3


From b4864149889a749042d344625d4ffbdbd3f8a3cc Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Sun, 21 Feb 2016 18:06:32 +0100
Subject: CSP for bookmarklet (subscription)

https://github.com/FreshRSS/FreshRSS/issues/1075
---
 app/layout/aside_subscription.phtml | 2 +-
 p/scripts/main.js                   | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

(limited to 'app/layout/aside_subscription.phtml')

diff --git a/app/layout/aside_subscription.phtml b/app/layout/aside_subscription.phtml
index 8a54e2dc2..fa10d63e8 100644
--- a/app/layout/aside_subscription.phtml
+++ b/app/layout/aside_subscription.phtml
@@ -10,7 +10,7 @@
 	</li>
 
 	<li class="item">
-		<a onclick="return false;" href="javascript:(function(){var%20url%20=%20location.href;window.open('<?php echo Minz_Url::display(array('c' => 'feed', 'a' => 'add'), 'html', true); ?>&amp;url_rss='+encodeURIComponent(url), '_blank');})();">
+		<a class="bookmarkClick" href="javascript:(function(){var%20url%20=%20location.href;window.open('<?php echo Minz_Url::display(array('c' => 'feed', 'a' => 'add'), 'html', true); ?>&amp;url_rss='+encodeURIComponent(url), '_blank');})();">
 			<?php echo _t('sub.menu.bookmark'); ?>
 		</a>
 	</li>
diff --git a/p/scripts/main.js b/p/scripts/main.js
index f07cdafd7..cfde5fd4e 100644
--- a/p/scripts/main.js
+++ b/p/scripts/main.js
@@ -1245,6 +1245,12 @@ function init_configuration_alert() {
 	});
 }
 
+function init_subscription() {
+	$('body').on('click', '.bookmarkClick', function (e) {
+		return false;
+	});
+}
+
 function parseJsonVars() {
 	var jsonVars = document.getElementById('jsonVars'),
 		json = JSON.parse(jsonVars.innerHTML);
@@ -1281,6 +1287,7 @@ function init_all() {
 		init_notifs_html5();
 		window.setInterval(refreshUnreads, 120000);
 	} else {
+		init_subscription();
 		init_crypto_form();
 		init_share_observers();
 		init_remove_observers();
-- 
cgit v1.2.3


From 8a776f146182bc6870702cfeb87041e3af66b24b Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre.alapetite@alexandra.dk>
Date: Wed, 7 Sep 2016 14:35:51 +0200
Subject: Prevent a target _blank attacks with window.opener

https://mathiasbynens.github.io/rel-noopener/
noopener is implied by noreferrer
https://html.spec.whatwg.org/multipage/semantics.html#link-type-noreferrer
The API for window.open() does not seem stable yet
https://bugzilla.mozilla.org/show_bug.cgi?id=1267339
---
 app/layout/aside_feed.phtml                       | 2 +-
 app/layout/aside_subscription.phtml               | 2 +-
 app/layout/nav_menu.phtml                         | 2 +-
 app/views/configure/sharing.phtml                 | 4 ++--
 app/views/feed/add.phtml                          | 6 +++---
 app/views/helpers/feed/update.phtml               | 6 +++---
 app/views/helpers/index/normal/entry_bottom.phtml | 4 ++--
 app/views/helpers/index/normal/entry_header.phtml | 4 ++--
 app/views/index/normal.phtml                      | 2 +-
 p/scripts/main.js                                 | 2 +-
 10 files changed, 17 insertions(+), 17 deletions(-)

(limited to 'app/layout/aside_subscription.phtml')

diff --git a/app/layout/aside_feed.phtml b/app/layout/aside_feed.phtml
index e8fdbf842..94c281b7f 100644
--- a/app/layout/aside_feed.phtml
+++ b/app/layout/aside_feed.phtml
@@ -79,7 +79,7 @@
 		<?php if (FreshRSS_Auth::hasAccess()) { ?>
 		<li class="item"><a href="<?php echo _url('stats', 'repartition', 'id', '------'); ?>"><?php echo _t('index.menu.stats'); ?></a></li>
 		<?php } ?>
-		<li class="item"><a target="_blank" href="http://example.net/"><?php echo _t('gen.action.see_website'); ?></a></li>
+		<li class="item"><a target="_blank" rel="noreferrer" href="http://example.net/"><?php echo _t('gen.action.see_website'); ?></a></li>
 		<?php if (FreshRSS_Auth::hasAccess()) { ?>
 		<li class="separator"></li>
 		<li class="item"><a href="<?php echo _url('subscription', 'index', 'id', '------'); ?>"><?php echo _t('gen.action.manage'); ?></a></li>
diff --git a/app/layout/aside_subscription.phtml b/app/layout/aside_subscription.phtml
index fa10d63e8..e14afe2a7 100644
--- a/app/layout/aside_subscription.phtml
+++ b/app/layout/aside_subscription.phtml
@@ -10,7 +10,7 @@
 	</li>
 
 	<li class="item">
-		<a class="bookmarkClick" href="javascript:(function(){var%20url%20=%20location.href;window.open('<?php echo Minz_Url::display(array('c' => 'feed', 'a' => 'add'), 'html', true); ?>&amp;url_rss='+encodeURIComponent(url), '_blank');})();">
+		<a class="bookmarkClick" href="javascript:(function(){var%20url%20=%20location.href;var%20otherWindow=window.open('about:blank','_blank');otherWindow.opener=null;otherWindow.location='<?php echo Minz_Url::display(array('c' => 'feed', 'a' => 'add'), 'html', true); ?>&amp;url_rss='+encodeURIComponent(url);})();">
 			<?php echo _t('sub.menu.bookmark'); ?>
 		</a>
 	</li>
diff --git a/app/layout/nav_menu.phtml b/app/layout/nav_menu.phtml
index 23255f04f..d77c1abf9 100644
--- a/app/layout/nav_menu.phtml
+++ b/app/layout/nav_menu.phtml
@@ -152,7 +152,7 @@
 				$url_output['params']['token'] = FreshRSS_Context::$user_conf->token;
 			}
 		?>
-		<a class="view_rss btn" target="_blank" title="<?php echo _t('index.menu.rss_view'); ?>" href="<?php echo Minz_Url::display($url_output); ?>">
+		<a class="view_rss btn" target="_blank" rel="noreferrer" title="<?php echo _t('index.menu.rss_view'); ?>" href="<?php echo Minz_Url::display($url_output); ?>">
 			<?php echo _i('rss'); ?>
 		</a>
 	</div>
diff --git a/app/views/configure/sharing.phtml b/app/views/configure/sharing.phtml
index 0dad5bf6d..ffcfb8b29 100644
--- a/app/views/configure/sharing.phtml
+++ b/app/views/configure/sharing.phtml
@@ -13,7 +13,7 @@
 			<input type="text" id="share_##key##_name" name="share[##key##][name]" class="extend" value="" placeholder="<?php echo _t('conf.sharing.share_name'); ?>" size="64" />
 			<input type="url" id="share_##key##_url" name="share[##key##][url]" class="extend" value="" placeholder="<?php echo _t('conf.sharing.share_url'); ?>" size="64" />
 			<a href="#" class="remove btn btn-attention" data-remove="group-share-##key##"><?php echo _i('close'); ?></a></div>
-			<a target="_blank" class="btn" title="<?php echo _t('conf.sharing.more_information'); ?>" href="##help##"><?php echo _i('help'); ?></a>
+			<a target="_blank" rel="noreferrer" class="btn" title="<?php echo _t('conf.sharing.more_information'); ?>" href="##help##"><?php echo _i('help'); ?></a>
 			</div></div>'>
 		<input type="hidden" name="_csrf" value="<?php echo FreshRSS_Auth::csrfToken(); ?>" />
 		<legend><?php echo _t('conf.sharing'); ?></legend>
@@ -38,7 +38,7 @@
 						<a href='#' class='remove btn btn-attention' data-remove="group-share-<?php echo $key; ?>"><?php echo _i('close'); ?></a>
 					</div>
 					<?php if ($share->formType() === 'advanced') { ?>
-						<a target="_blank" class="btn" title="<?php echo _t('conf.sharing.more_information'); ?>" href="<?php echo $share->help(); ?>"><?php echo _i('help'); ?></a>
+						<a target="_blank" rel="noreferrer" class="btn" title="<?php echo _t('conf.sharing.more_information'); ?>" href="<?php echo $share->help(); ?>"><?php echo _i('help'); ?></a>
 					<?php } ?>
 				</div>
 			</div>
diff --git a/app/views/feed/add.phtml b/app/views/feed/add.phtml
index caf685d79..5cd59d298 100644
--- a/app/views/feed/add.phtml
+++ b/app/views/feed/add.phtml
@@ -30,7 +30,7 @@
 			<label class="group-name"><?php echo _t('sub.feed.website'); ?></label>
 			<div class="group-controls">
 				<?php echo $this->feed->website(); ?>
-				<a class="btn" target="_blank" href="<?php echo $this->feed->website(); ?>"><?php echo _i('link'); ?></a>
+				<a class="btn" target="_blank" rel="noreferrer" href="<?php echo $this->feed->website(); ?>"><?php echo _i('link'); ?></a>
 			</div>
 		</div>
 		<?php } ?>
@@ -40,9 +40,9 @@
 			<div class="group-controls">
 				<div class="stick">
 					<input type="text" name="url_rss" id="url" class="extend" value="<?php echo $this->feed->url(); ?>" />
-					<a class="btn" target="_blank" href="<?php echo $this->feed->url(); ?>"><?php echo _i('link'); ?></a>
+					<a class="btn" target="_blank" rel="noreferrer" href="<?php echo $this->feed->url(); ?>"><?php echo _i('link'); ?></a>
 				</div>
-				<a class="btn" target="_blank" href="http://validator.w3.org/feed/check.cgi?url=<?php echo $this->feed->url(); ?>"><?php echo _t('sub.feed.validator'); ?></a>
+				<a class="btn" target="_blank" rel="noreferrer" href="http://validator.w3.org/feed/check.cgi?url=<?php echo $this->feed->url(); ?>"><?php echo _t('sub.feed.validator'); ?></a>
 			</div>
 		</div>
 		<div class="form-group">
diff --git a/app/views/helpers/feed/update.phtml b/app/views/helpers/feed/update.phtml
index b7e8f68cd..bf87a255a 100644
--- a/app/views/helpers/feed/update.phtml
+++ b/app/views/helpers/feed/update.phtml
@@ -37,7 +37,7 @@
 			<div class="group-controls">
 				<div class="stick">
 					<input type="text" name="website" id="website" class="extend" value="<?php echo $this->feed->website(); ?>" />
-					<a class="btn" target="_blank" href="<?php echo $this->feed->website(); ?>"><?php echo _i('link'); ?></a>
+					<a class="btn" target="_blank" rel="noreferrer" href="<?php echo $this->feed->website(); ?>"><?php echo _i('link'); ?></a>
 				</div>
 			</div>
 		</div>
@@ -46,10 +46,10 @@
 			<div class="group-controls">
 				<div class="stick">
 					<input type="text" name="url" id="url" class="extend" value="<?php echo $this->feed->url(); ?>" />
-					<a class="btn" target="_blank" href="<?php echo $this->feed->url(); ?>"><?php echo _i('link'); ?></a>
+					<a class="btn" target="_blank" rel="noreferrer" href="<?php echo $this->feed->url(); ?>"><?php echo _i('link'); ?></a>
 				</div>
 
-				<a class="btn" target="_blank" href="http://validator.w3.org/feed/check.cgi?url=<?php echo rawurlencode(htmlspecialchars_decode($this->feed->url(), ENT_QUOTES)); ?>"><?php echo _t('sub.feed.validator'); ?></a>
+				<a class="btn" target="_blank" rel="noreferrer" href="http://validator.w3.org/feed/check.cgi?url=<?php echo rawurlencode(htmlspecialchars_decode($this->feed->url(), ENT_QUOTES)); ?>"><?php echo _t('sub.feed.validator'); ?></a>
 			</div>
 		</div>
 		<div class="form-group">
diff --git a/app/views/helpers/index/normal/entry_bottom.phtml b/app/views/helpers/index/normal/entry_bottom.phtml
index 3af7436c3..a9d5a80ca 100644
--- a/app/views/helpers/index/normal/entry_bottom.phtml
+++ b/app/views/helpers/index/normal/entry_bottom.phtml
@@ -52,7 +52,7 @@
 						$share_options['title'] = $title;
 						$share->update($share_options);
 				?><li class="item share">
-					<a target="_blank" href="<?php echo $share->url(); ?>"><?php echo $share->name(); ?></a>
+					<a target="_blank" rel="noreferrer" href="<?php echo $share->url(); ?>"><?php echo $share->name(); ?></a>
 				</li><?php
 					}
 			?></ul>
@@ -81,6 +81,6 @@
 		?><li class="item date"><?php echo $this->entry->date(); ?></li><?php
 	}
 	if ($bottomline_link) {
-		?><li class="item link"><a target="_blank" href="<?php echo $this->entry->link(); ?>"><?php echo _i('link'); ?></a></li><?php
+		?><li class="item link"><a target="_blank" rel="noreferrer" href="<?php echo $this->entry->link(); ?>"><?php echo _i('link'); ?></a></li><?php
 	} ?>
 </ul>
diff --git a/app/views/helpers/index/normal/entry_header.phtml b/app/views/helpers/index/normal/entry_header.phtml
index dc544298f..86298e59f 100644
--- a/app/views/helpers/index/normal/entry_header.phtml
+++ b/app/views/helpers/index/normal/entry_header.phtml
@@ -27,7 +27,7 @@
 		}
 	}
 	?><li class="item website"><a href="<?php echo _url('index', 'index', 'get', 'f_' . $this->feed->id()); ?>"><img class="favicon" src="<?php echo $this->feed->favicon(); ?>" alt="✇" /> <span><?php echo $this->feed->name(); ?></span></a></li>
-	<li class="item title"><a target="_blank" href="<?php echo $this->entry->link(); ?>"><?php echo $this->entry->title(); ?></a></li>
+	<li class="item title"><a target="_blank" rel="noreferrer" href="<?php echo $this->entry->link(); ?>"><?php echo $this->entry->title(); ?></a></li>
 	<?php if ($topline_date) { ?><li class="item date"><?php echo $this->entry->date(); ?> </li><?php } ?>
-	<?php if ($topline_link) { ?><li class="item link"><a target="_blank" href="<?php echo $this->entry->link(); ?>"><?php echo _i('link'); ?></a></li><?php } ?>
+	<?php if ($topline_link) { ?><li class="item link"><a target="_blank" rel="noreferrer" href="<?php echo $this->entry->link(); ?>"><?php echo _i('link'); ?></a></li><?php } ?>
 </ul>
diff --git a/app/views/index/normal.phtml b/app/views/index/normal.phtml
index 91ebcebd3..6fda11ed9 100644
--- a/app/views/index/normal.phtml
+++ b/app/views/index/normal.phtml
@@ -66,7 +66,7 @@ if (!empty($this->entries)) {
 
 		?><div class="flux_content">
 			<div class="content <?php echo $content_width; ?>">
-				<h1 class="title"><a target="_blank" href="<?php echo $this->entry->link(); ?>"><?php echo $this->entry->title(); ?></a></h1>
+				<h1 class="title"><a target="_blank" rel="noreferrer" href="<?php echo $this->entry->link(); ?>"><?php echo $this->entry->title(); ?></a></h1>
 				<?php
 					$author = $this->entry->author();
 					echo $author != '' ? '<div class="author">' . _t('gen.short.by_author', $author) . '</div>' : '',
diff --git a/p/scripts/main.js b/p/scripts/main.js
index 8980fe2f6..74631451a 100644
--- a/p/scripts/main.js
+++ b/p/scripts/main.js
@@ -752,7 +752,7 @@ function init_stream(divStream) {
 	});
 
 	divStream.on('click', '.flux .content a', function () {
-		$(this).attr('target', '_blank');
+		$(this).attr('target', '_blank').attr('rel', 'noreferrer');
 	});
 
 	if (context.auto_mark_site) {
-- 
cgit v1.2.3