harden target=_blank links with rel=noopener noreferrer

a8827dba87b39ba611940ea5eae3cc168051f305 · 2026-05-18 20:20:39 -0700 · SteveStudio2
Files touched

M dashboard.js
M signup.js
Diff

commit a8827dba87b39ba611940ea5eae3cc168051f305
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Mon May 18 20:20:39 2026 -0700

    harden target=_blank links with rel=noopener noreferrer
---
 dashboard.js | 4 ++--
 signup.js    | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/dashboard.js b/dashboard.js
index e5ba854..7fa8340 100644
--- a/dashboard.js
+++ b/dashboard.js
@@ -64,7 +64,7 @@
               <span><b>${inq}</b><em>${inq === 1 ? "inquiry" : "inquiries"}</em></span>
             </div>
             <div class="dash-card-actions">
-              <a href="rental.html?id=${encodeURIComponent(r.slug)}" target="_blank" rel="noopener">Open →</a>
+              <a href="rental.html?id=${encodeURIComponent(r.slug)}" target="_blank" rel="noopener noreferrer">Open →</a>
               <button class="dash-edit" data-slug="${escapeAttr(r.slug)}">Edit</button>
             </div>
             <div class="dash-card-host">Hosted by ${escapeHtml(r.host)}</div>
@@ -158,7 +158,7 @@
           </div>
           <div class="inq-meta">
             <span class="inq-at">${escapeHtml(fmtDate(m.createdAt))}</span>
-            <span class="inq-for">for <a href="rental.html?id=${encodeURIComponent(m._slug)}" target="_blank" rel="noopener">${escapeHtml(m._street)}</a></span>
+            <span class="inq-for">for <a href="rental.html?id=${encodeURIComponent(m._slug)}" target="_blank" rel="noopener noreferrer">${escapeHtml(m._street)}</a></span>
           </div>
         </div>
         <div class="inq-dates">
diff --git a/signup.js b/signup.js
index 747838b..04d4f79 100644
--- a/signup.js
+++ b/signup.js
@@ -245,7 +245,7 @@ if (typeof document !== "undefined") {
           <dt>Suggested nightly</dt><dd><b>${escapeHtml(s.suggested)}</b> (range ${escapeHtml(s.headlineRange)})</dd>
         </dl>
         <p style="margin-top:14px">
-          <a href="rental.html?id=${encodeURIComponent(slug)}" target="_blank" rel="noopener">→ Open my rental microsite</a>
+          <a href="rental.html?id=${encodeURIComponent(slug)}" target="_blank" rel="noopener noreferrer">→ Open my rental microsite</a>
           &nbsp;·&nbsp;
           <a href="dashboard.html">→ Open dashboard</a>
         </p>
@@ -418,7 +418,7 @@ if (typeof document !== "undefined") {
         if (list) {
           list.hidden = false;
           list.innerHTML = "<b>Open your demo rentals:</b>" + slugs
-            .map(s => ` <a href="rental.html?id=${encodeURIComponent(s)}" target="_blank">/${s}</a>`)
+            .map(s => ` <a href="rental.html?id=${encodeURIComponent(s)}" target="_blank" rel="noopener noreferrer">/${s}</a>`)
             .join(" · ");
         }
       } catch (e) {
← 1f8f8d2 add canonical .gitignore per standing rule · back to Malden House · (newest)