upgrade target=_blank links to rel="noopener noreferrer"

0223d43a541c9d785e1afae9d80dceb0809607d4 · 2026-05-19 17:35:36 -0700 · Steve

About-page source links (datos.go.cr, Hacienda API) and place.html
website + CTA links now block both window.opener access AND referrer
leakage to external destinations.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M public/about.html
M public/place.html

Diff

commit 0223d43a541c9d785e1afae9d80dceb0809607d4
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue May 19 17:35:36 2026 -0700

    upgrade target=_blank links to rel="noopener noreferrer"
    
    About-page source links (datos.go.cr, Hacienda API) and place.html
    website + CTA links now block both window.opener access AND referrer
    leakage to external destinations.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 public/about.html | 4 ++--
 public/place.html | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/public/about.html b/public/about.html
index 2b65696..b38b8b8 100644
--- a/public/about.html
+++ b/public/about.html
@@ -77,8 +77,8 @@
 
     <h2>Where the data comes from</h2>
     <div class="panel">
-      <div class="src"><span class="k">MEIC PYMEs</span><span><b>Primary source.</b> Activas registry of small-and-medium enterprises, ~31K rows. Fed via <a href="https://datos.go.cr/dataset" target="_blank" rel="noopener">datos.go.cr</a> CKAN dumps. Each row carries a cédula jurídica that links back to the Hacienda registry.</span></div>
-      <div class="src"><span class="k">Hacienda</span><span>Costa Rica Ministerio de Hacienda — the formal taxpayer registry. Used to verify cédula jurídica and pull official business name, situación (active / moroso / omiso), regimen, and CIIU activity codes via the public <a href="https://api.hacienda.go.cr/fe/ae" target="_blank" rel="noopener">Hacienda API</a>.</span></div>
+      <div class="src"><span class="k">MEIC PYMEs</span><span><b>Primary source.</b> Activas registry of small-and-medium enterprises, ~31K rows. Fed via <a href="https://datos.go.cr/dataset" target="_blank" rel="noopener noreferrer">datos.go.cr</a> CKAN dumps. Each row carries a cédula jurídica that links back to the Hacienda registry.</span></div>
+      <div class="src"><span class="k">Hacienda</span><span>Costa Rica Ministerio de Hacienda — the formal taxpayer registry. Used to verify cédula jurídica and pull official business name, situación (active / moroso / omiso), regimen, and CIIU activity codes via the public <a href="https://api.hacienda.go.cr/fe/ae" target="_blank" rel="noopener noreferrer">Hacienda API</a>.</span></div>
       <div class="src"><span class="k">ICT</span><span>Instituto Costarricense de Turismo — tour operators, lodging, surf schools, and other CST-certified tourism providers.</span></div>
       <div class="src"><span class="k">Municipal patentes</span><span>City-level patente ledgers (Heredia, Escazú, Liberia, …) for businesses that wouldn't appear in MEIC.</span></div>
       <div class="src"><span class="k">Wikipedia</span><span>Region cover images come from the Wikipedia REST API <code>/page/summary/{Title}</code> endpoint, with credit and source URL stored alongside the image. Each photo links back to the Wikimedia Commons file page.</span></div>
diff --git a/public/place.html b/public/place.html
index c6ea56f..0647728 100644
--- a/public/place.html
+++ b/public/place.html
@@ -177,7 +177,7 @@
       const lat = p.lat || p.region_lat, lng = p.lng || p.region_lng;
       if (lat && lng) ctaList.push({label:'Open in Google Maps ↗', href:`https://www.google.com/maps/search/?api=1&query=${lat},${lng}`, alt:true});
       if (p.region_slug) ctaList.push({label:'More in ' + p.region_name, href:'/r/' + p.region_slug, alt:true});
-      ctaList.forEach(c => { const a=document.createElement('a'); a.className='cta'+(c.alt?' alt':''); a.href=c.href; if(c.href.startsWith('http')) a.target='_blank'; a.rel='noopener'; a.textContent=c.label; ctas.appendChild(a); });
+      ctaList.forEach(c => { const a=document.createElement('a'); a.className='cta'+(c.alt?' alt':''); a.href=c.href; if(c.href.startsWith('http')){ a.target='_blank'; a.rel='noopener noreferrer'; } a.textContent=c.label; ctas.appendChild(a); });
 
       // Details panel
       setText('d-vertical', vertical);
@@ -187,7 +187,7 @@
       setText('d-phone',    p.phone);
       setText('d-coords',   (lat && lng) ? (+lat).toFixed(4) + ', ' + (+lng).toFixed(4) : null);
       setHTML('d-email',    p.email   ? '<a href="mailto:'+p.email+'">'+p.email+'</a>' : '—');
-      setHTML('d-website',  p.website ? '<a href="'+p.website+'" target="_blank" rel="noopener">'+p.website.replace(/^https?:\/\//,'').replace(/\/$/,'')+'</a>' : '—');
+      setHTML('d-website',  p.website ? '<a href="'+p.website+'" target="_blank" rel="noopener noreferrer">'+p.website.replace(/^https?:\/\//,'').replace(/\/$/,'')+'</a>' : '—');
       setText('d-cedula',   p.cedula_juridica);
       setText('d-price',    p.price_range);
       setText('d-rating',   p.rating ? (+p.rating).toFixed(1) : null);

← fce51b2 snapshot: 10 file(s) changed, +1 new, ~9 modified · back to Costa Rica · guard against serving .bak / .pre- snapshot files 31e910d →