From bad9694f6c1d7cba984d9ce0626b531e0ccdc3b9 Mon Sep 17 00:00:00 2001
From: Oscar Hinton <Hinton@users.noreply.github.com>
Date: Fri, 23 Feb 2024 14:54:41 +0100
Subject: [PATCH] [PM-6378] Add noreferrer to external admin urls (#3827)

---
 src/Admin/Views/Home/Index.cshtml                 | 9 ++++++---
 src/Admin/Views/Shared/_BillingInformation.cshtml | 5 +++--
 src/Admin/Views/Shared/_Layout.cshtml             | 3 ++-
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/src/Admin/Views/Home/Index.cshtml b/src/Admin/Views/Home/Index.cshtml
index 7589dc8afe..46665260c8 100644
--- a/src/Admin/Views/Home/Index.cshtml
+++ b/src/Admin/Views/Home/Index.cshtml
@@ -90,9 +90,12 @@
     </div>
     <div class="col-md">
         <ul class="list-unstyled">
-            <li><a href="https://github.com/bitwarden/server/releases" target="_blank">Check for Server updates</a></li>
-            <li><a href="https://github.com/bitwarden/clients/releases" target="_blank">Check for Web updates</a></li>
-            <li><a href="https://help.bitwarden.com/article/updating-on-premise/" target="_blank">How do I update?</a></li>
+            <li><a href="https://github.com/bitwarden/server/releases" target="_blank" rel="noreferrer">Check for Server
+                    updates</a></li>
+            <li><a href="https://github.com/bitwarden/clients/releases" target="_blank" rel="noreferrer">Check for Web
+                    updates</a></li>
+            <li><a href="https://help.bitwarden.com/article/updating-on-premise/" target="_blank" rel="noreferrer">How
+                    do I update?</a></li>
         </ul>
     </div>
 </div>
diff --git a/src/Admin/Views/Shared/_BillingInformation.cshtml b/src/Admin/Views/Shared/_BillingInformation.cshtml
index dab0587ef8..ba83bb9b50 100644
--- a/src/Admin/Views/Shared/_BillingInformation.cshtml
+++ b/src/Admin/Views/Shared/_BillingInformation.cshtml
@@ -24,13 +24,14 @@
                     {
                         <tr>
                             <td>@invoice.Date</td>
-                            <td><a target="_blank" href="@invoice.Url" title="View Invoice">@invoice.Number</a></td>
+                            <td><a target="_blank" rel="noreferrer" href="@invoice.Url" title="View Invoice">@invoice.Number</a>
+                            </td>
                             <td>@invoice.Amount.ToString("C")</td>
                             <td>@(invoice.Paid ? "Paid" : "Unpaid")</td>
                             @if (canDownloadInvoice) 
                             {
                                 <td>
-                                    <a target="_blank" href="@invoice.PdfUrl" title="Download Invoice">
+                                    <a target="_blank" rel="noreferrer" href="@invoice.PdfUrl" title="Download Invoice">
                                         <i class="fa fa-file-pdf-o"></i>
                                     </a>
                                 </td>
diff --git a/src/Admin/Views/Shared/_Layout.cshtml b/src/Admin/Views/Shared/_Layout.cshtml
index 37b893e643..ada39f7620 100644
--- a/src/Admin/Views/Shared/_Layout.cshtml
+++ b/src/Admin/Views/Shared/_Layout.cshtml
@@ -125,7 +125,8 @@
                     @if (GlobalSettings.SelfHosted)
                     {
                         <li class="nav-item">
-                            <a class="nav-link" href="https://help.bitwarden.com/hosting/" target="_blank">Docs</a>
+                            <a class="nav-link" href="https://help.bitwarden.com/hosting/" target="_blank"
+                                rel="noreferrer">Docs</a>
                         </li>
                     }
                 </ul>