[object Object]

← back to Rentv

security(a11y): noopener noreferrer on JS-generated desk action anchors (completes 6f7c108)

943ac86b71889b5491472f970797d528e551c466 · 2026-08-08 15:17:33 -0700 · Steve Abrams

The regex fleet pass (6f7c108) missed this anchor because it's built inside a
JS template literal in admin-core.js, not raw HTML. HEAD now has 0 remaining
target=_blank anchors without noreferrer. Steve-approved via
pending-approval/rentv-deploy-hook-silent-fail-TK-10366.md (TK-10366).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

Diff

commit 943ac86b71889b5491472f970797d528e551c466
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat Aug 8 15:17:33 2026 -0700

    security(a11y): noopener noreferrer on JS-generated desk action anchors (completes 6f7c108)
    
    The regex fleet pass (6f7c108) missed this anchor because it's built inside a
    JS template literal in admin-core.js, not raw HTML. HEAD now has 0 remaining
    target=_blank anchors without noreferrer. Steve-approved via
    pending-approval/rentv-deploy-hook-silent-fail-TK-10366.md (TK-10366).
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 public/desk-assets/admin-core.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/public/desk-assets/admin-core.js b/public/desk-assets/admin-core.js
index 2f3b67c6..74ae5f38 100644
--- a/public/desk-assets/admin-core.js
+++ b/public/desk-assets/admin-core.js
@@ -14,7 +14,7 @@ window.ADM = (function () {
   const ASSR = ain => `https://portal.assessor.lacounty.gov/parceldetail/${enc(ain)}`;
   const loc = x => [x.city || x.hq_city, x.state_code || x.hq_state].filter(Boolean).join(', ');
 
-  const A = (href, icon, label) => `<a class="act" href="${href}" target="_blank" rel="noopener" onclick="event.stopPropagation()"><span class="i">${icon}</span>${label}</a>`;
+  const A = (href, icon, label) => `<a class="act" href="${href}" target="_blank" rel="noopener noreferrer" onclick="event.stopPropagation()"><span class="i">${icon}</span>${label}</a>`;
   // the inline action set for any record kind — the "like CRCP" click-outs
   function actions(kind, x) {
     if (kind === 'firms') return [A(LI_C(x.name), '🏢', 'LinkedIn'), A(WEB(x.name), '🌐', 'Website'), A(MAPS(x.name + ' ' + loc(x)), '📍', 'HQ / Map'), x.license_no ? A(DRE(x.license_no), '🪪', 'DRE') : '', A(GOOG(x.name + ' brokers ' + loc(x)), '🔎', 'Google')].filter(Boolean).join('');

← b09e3e76 auto-data-snapshot: 2026-08-08T15:15:29 (7 data files) — dat  ·  back to Rentv  ·  auto-data-snapshot: 2026-08-08T15:46:23 (7 data files) — dat 29162d7c →