3

https://dev.to/ben/the-targetblank-vulnerability-by-example

I've been reading more about this lately and would like to make sure my website(s) are secure. I assume a simple search and replace should fix the issue but though I'd come to the community to check.

I know I have used this string of code in my CMS Pages and possibly Static Blocks as well. It is probably peppered into some custom .html and .phtml pages in my design folders too. Since I can use Dreamweaver on a copy of my site to update the .(p)html files, how can I use phpMyAdmin to update the strings controlled by magento?

I'd like to change the following string from this:

target="_blank"

To this:

target="_blank" rel="noopener noreferrer"

In all CMS Pages, Static Blocks, Product Descriptions, and Short Descriptions (catalog_product_entity_text & catalog_product_flat_#) - as that is where a search is showing the most results.

Are there any issues I should be aware of? Anyone else reading this should follow the golden rule of always making a DB backup before applying any changes like this.

Thanks!

3

First, identifiy the tables and columns you need to change:

  • cms_page.content
  • cms_block.content
  • catalog_product_entity_text.value
  • catalog_category_entity_text.value
  • (and maybe more?)

(no need to update the index tables like the flat catalog manually, better rebuild the indexes afterwards)

Then run an SQL query for each, like this:

UPDATE cms_page SET content = REPLACE(content, 'target="_blank"', 'target="_blank" rel="noopener noreferrer"');
       ^^^^^^^^     ^^^^^^^           ^^^^^^^
        table       column            column
  • 2
    You might want to add a little unix command to grep the target="blank" from the template as well as some developers tend to add hardcoded stuff there. Also it'd be good to check with target='_blank' with single quote as some people use single quote to declare attributes. – Raphael at Digital Pianism Sep 1 '16 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.