[object Object]

← back to Ventura Claw Leads

admin: add rel=noopener noreferrer on target=_blank links

7c04e29338da25c53069af87b39de4d55cd89824 · 2026-05-19 21:30:57 -0700 · Steve Abrams

The two admin "View your live profile" links opened in a new tab without
the rel pair, leaking window.opener and Referer to the public profile
page. Internal but still worth fixing — matches the rel pattern already
used on the public business.ejs external links.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

Diff

commit 7c04e29338da25c53069af87b39de4d55cd89824
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 21:30:57 2026 -0700

    admin: add rel=noopener noreferrer on target=_blank links
    
    The two admin "View your live profile" links opened in a new tab without
    the rel pair, leaking window.opener and Referer to the public profile
    page. Internal but still worth fixing — matches the rel pattern already
    used on the public business.ejs external links.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 views/admin/dashboard.ejs | 2 +-
 views/admin/profile.ejs   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/views/admin/dashboard.ejs b/views/admin/dashboard.ejs
index ddabcab..177595f 100644
--- a/views/admin/dashboard.ejs
+++ b/views/admin/dashboard.ejs
@@ -116,7 +116,7 @@
     <li><a href="/admin/profile">Edit your public profile</a> — make sure description, hours, contact, and Instagram are current.</li>
     <li><a href="/admin/billing">Pick a tier</a> — Free is fine; paid tiers unlock featured placement and category-sidebar feature.</li>
     <li><a href="/admin/team">Invite a teammate</a> — let multiple people respond to leads.</li>
-    <li><a href="/business/<%= currentBusiness.slug %>" target="_blank">View your live profile ↗</a></li>
+    <li><a href="/business/<%= currentBusiness.slug %>" target="_blank" rel="noopener noreferrer">View your live profile ↗</a></li>
   </ul>
 </section>
 
diff --git a/views/admin/profile.ejs b/views/admin/profile.ejs
index 0a93c2d..756aaab 100644
--- a/views/admin/profile.ejs
+++ b/views/admin/profile.ejs
@@ -4,7 +4,7 @@
 <section class="long-form" style="max-width:720px">
   <p class="kicker">Profile</p>
   <h1 class="display-sm">Edit your listing.</h1>
-  <p class="lede">Changes go live immediately on your public profile at <a href="/business/<%= biz.slug %>" target="_blank">/business/<%= biz.slug %></a>.</p>
+  <p class="lede">Changes go live immediately on your public profile at <a href="/business/<%= biz.slug %>" target="_blank" rel="noopener noreferrer">/business/<%= biz.slug %></a>.</p>
 
   <% if (ok) { %><p class="callout" style="background:#dcfce7;border-left:3px solid #16a34a;color:#166534;padding:12px 16px;margin:16px 0;border-radius:4px">Profile saved.</p><% } %>
   <% if (typeof photoOk !== 'undefined' && photoOk) { %><p class="callout" style="background:#dcfce7;border-left:3px solid #16a34a;color:#166534;padding:12px 16px;margin:16px 0;border-radius:4px">Photo updated.</p><% } %>

← 350a516 gitignore: exclude editor/snapshot backup files  ·  back to Ventura Claw Leads  ·  neighborhood: add sort + density grid controls 34665fb →