view website/issues/html/_generic.item.html @ 6282:d30501bafdfb

issue2551098: markdown links missing rel="noreferer nofollow" Links generated by all markdown backends are missing the noopener and nofollow relation that roundup's normal text -> html core adds to prevent security issues and link spam. Now rel="nofollow" is added to links generated by markdown2 backends and rel="nofollow noopener" for mistune and markdown backends. Markdown2 isn't as programable as the other two backends so I used the built-in nofollow support. This means that a user that generates a link that opens in a new window can manpulate the parent window.
author John Rouillard <rouilj@ieee.org>
date Sat, 31 Oct 2020 14:51:16 -0400
parents c2d0d3e9099d
children
line wrap: on
line source

<tal:block metal:use-macro="templates/page/macros/icing">
<title metal:fill-slot="head_title" i18n:translate=""
 ><span tal:replace="python:context._classname.capitalize()"
 i18n:name="class" /> editing - <span i18n:name="tracker"
 tal:replace="config/TRACKER_NAME" /></title>
<tal:block metal:fill-slot="body_title" i18n:translate=""
 ><span tal:replace="python:context._classname.capitalize()"
 i18n:name="class" /> editing</tal:block>

<td class="content" metal:fill-slot="content">

<p tal:condition="python:not (context.is_view_ok()
 or request.user.hasRole('Anonymous'))" i18n:translate="">
 You are not allowed to view this page.</p>

<p tal:condition="python:not context.is_view_ok()
 and request.user.hasRole('Anonymous')" i18n:translate="">
 Please login with your username and password.</p>

<div tal:condition="context/is_view_ok">

<form method="POST" onSubmit="return submit_once()"
      enctype="multipart/form-data" tal:condition="context/is_view_ok"
      tal:attributes="action context/designator">

<input type="hidden" name="@template" value="item">

<table class="form">

<tr tal:repeat="prop python:db[context._classname].properties()">
 <tal:block tal:condition="python:prop._name not in ('id',
   'creator', 'creation', 'actor', 'activity')">
  <th tal:content="prop/_name"></th>
  <td tal:content="structure python:context[prop._name].field()"></td>
 </tal:block>
</tr>
<tr>
 <td>&nbsp;</td>
 <td colspan=3 tal:content="structure context/submit">
  submit button will go here
 </td>
</tr>
</table>

</form>

<tal:block tal:condition="context/id" tal:replace="structure context/history" />

</div>

</td>

</tal:block>

Roundup Issue Tracker: http://roundup-tracker.org/