security: add rel=noopener noreferrer to all target=_blank external links

446b34f93ad27b2eeaee1c3a93150e0fdd1fe111 · 2026-05-19 08:16:17 -0700 · Steve Abrams

Facebook footer link and dw-fleet-nav sister-brand links upgraded from noopener to noopener noreferrer; the programmatic window.open fleet-tile handler now passes 'noopener,noreferrer' as windowFeatures.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M public/dw-fleet-nav.js
M public/index.html

Diff

commit 446b34f93ad27b2eeaee1c3a93150e0fdd1fe111
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 08:16:17 2026 -0700

    security: add rel=noopener noreferrer to all target=_blank external links
    
    Facebook footer link and dw-fleet-nav sister-brand links upgraded from noopener to noopener noreferrer; the programmatic window.open fleet-tile handler now passes 'noopener,noreferrer' as windowFeatures.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 public/dw-fleet-nav.js | 2 +-
 public/index.html      | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/public/dw-fleet-nav.js b/public/dw-fleet-nav.js
index 6fa2799..f2b546d 100644
--- a/public/dw-fleet-nav.js
+++ b/public/dw-fleet-nav.js
@@ -235,7 +235,7 @@ header .mobile-toggle.dw-fn-hidden { display: none !important; }
     });
     var s2 = '<div class="dw-fn-section"><h4>Sister Brands</h4>' +
       sister.map(function (f) {
-        return '<a class="dw-fn-link" href="' + f.url + '" target="_blank" rel="noopener">' + f.name + '</a>';
+        return '<a class="dw-fn-link" href="' + f.url + '" target="_blank" rel="noopener noreferrer">' + f.name + '</a>';
       }).join('') + '</div>';
 
     drawer.innerHTML = s1 + s2;
diff --git a/public/index.html b/public/index.html
index d7bb770..e1ae6dc 100644
--- a/public/index.html
+++ b/public/index.html
@@ -484,7 +484,7 @@ textarea:focus-visible,
 
     <div class="footer-col">
       <h4 data-i18n="footerH4Social">Social</h4>
-      <a class="fb-link" href="https://www.facebook.com/SteveAbramsDesigns.DesignerWallcoverings" target="_blank" rel="noopener">Facebook</a>
+      <a class="fb-link" href="https://www.facebook.com/SteveAbramsDesigns.DesignerWallcoverings" target="_blank" rel="noopener noreferrer">Facebook</a>
     </div>
   </div>
   <p class="footer-text" style="max-width:1400px;margin:0 auto 18px;padding-top:18px;border-top:1px solid var(--line);font-size:11px;line-height:1.6;color:var(--muted);opacity:0.85" data-i18n="cadFootnote">Prices shown in CAD, converted from USD wholesale at 1 USD = 1.36 CAD. Final CAD pricing confirmed at checkout. GST/PST applied at checkout based on shipping province.</p>
@@ -553,7 +553,7 @@ textarea:focus-visible,
       const isCurrent = n.dataset.slug === SLUG;
       n.querySelector('circle').setAttribute('fill-opacity', isCurrent ? '1' : '0.55');
     });
-    n.addEventListener('click', () => window.open('https://' + n.dataset.slug + '.com', '_blank'));
+    n.addEventListener('click', () => window.open('https://' + n.dataset.slug + '.com', '_blank', 'noopener,noreferrer'));
   });
 })();
 </script>

← abe9213 nav: remove dead /about links (3) — no About page or route e · back to Wallpapercanada · stage2: wire microsite catalog + admin CRUD + grid/list view e1c084e →