[object Object]

← back to NationalPaperHangers

fix: add rel=noopener noreferrer to target=_blank links in admin views

55b6c3425dca37627d6b8e900c4b7e5edd711f14 · 2026-05-31 00:00:34 -0700 · SteveStudio2

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

Diff

commit 55b6c3425dca37627d6b8e900c4b7e5edd711f14
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Sun May 31 00:00:34 2026 -0700

    fix: add rel=noopener noreferrer to target=_blank links in admin views
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 views/admin/ops-watch.ejs             | 2 +-
 views/admin/partials/admin-header.ejs | 2 +-
 views/admin/template.ejs              | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/views/admin/ops-watch.ejs b/views/admin/ops-watch.ejs
index 4781ea2..230f999 100644
--- a/views/admin/ops-watch.ejs
+++ b/views/admin/ops-watch.ejs
@@ -4,7 +4,7 @@
 <section class="admin-main">
   <header class="admin-page-head">
     <h1>Ops · /watch curation</h1>
-    <p class="muted">Hand-picked YouTube videos for the public <a href="/watch" target="_blank">/watch</a> page. Every entry must be reviewed before publish.</p>
+    <p class="muted">Hand-picked YouTube videos for the public <a href="/watch" target="_blank" rel="noopener noreferrer">/watch</a> page. Every entry must be reviewed before publish.</p>
   </header>
 
   <% if (flash && flash.error) { %><div class="callout callout-warn"><%= flash.error %></div><% } %>
diff --git a/views/admin/partials/admin-header.ejs b/views/admin/partials/admin-header.ejs
index cad8d17..8b0f183 100644
--- a/views/admin/partials/admin-header.ejs
+++ b/views/admin/partials/admin-header.ejs
@@ -19,7 +19,7 @@
         <span class="t-light" aria-hidden="true">☼</span>
         <span class="t-dark" aria-hidden="true">☾</span>
       </button>
-      <a href="/installer/<%= installer.slug %>" class="btn btn-ghost btn-sm" target="_blank">View public profile ↗</a>
+      <a href="/installer/<%= installer.slug %>" class="btn btn-ghost btn-sm" target="_blank" rel="noopener noreferrer">View public profile ↗</a>
       <form method="post" action="/logout" class="inline-form"><input type="hidden" name="_csrf" value="<%= csrfToken %>"><button class="btn btn-ghost btn-sm" type="submit">Log out</button></form>
     </div>
   </div>
diff --git a/views/admin/template.ejs b/views/admin/template.ejs
index be2a7e8..d494a11 100644
--- a/views/admin/template.ejs
+++ b/views/admin/template.ejs
@@ -97,7 +97,7 @@
 
     <div style="display:flex;gap:12px;align-items:center">
       <button type="submit" class="btn btn-primary btn-lg">Save page design</button>
-      <a href="/installer/<%= installer.slug %>" target="_blank" class="btn btn-ghost">Preview live page ↗</a>
+      <a href="/installer/<%= installer.slug %>" target="_blank" rel="noopener noreferrer" class="btn btn-ghost">Preview live page ↗</a>
     </div>
   </form>

← ec8d505 Hold back ai_agent call mode at launch (DTD verdict 2026-05-  ·  back to NationalPaperHangers  ·  Add per-site favicon (kills /favicon.ico 404) b18f55a →