{"action":"created","issue":{"url":"https://api.github.com/repos/cakephp/cakephp/issues/9377","repository_url":"https://api.github.com/repos/cakephp/cakephp","labels_url":"https://api.github.com/repos/cakephp/cakephp/issues/9377/labels{/name}","comments_url":"https://api.github.com/repos/cakephp/cakephp/issues/9377/comments","events_url":"https://api.github.com/repos/cakephp/cakephp/issues/9377/events","html_url":"https://github.com/cakephp/cakephp/pull/9377","id":174131595,"number":9377,"title":"Fixed phishing vulnerability in HtmlHelper.php","user":{"login":"tspencer9303","id":17017642,"avatar_url":"https://avatars.githubusercontent.com/u/17017642?v=3","gravatar_id":"","url":"https://api.github.com/users/tspencer9303","html_url":"https://github.com/tspencer9303","followers_url":"https://api.github.com/users/tspencer9303/followers","following_url":"https://api.github.com/users/tspencer9303/following{/other_user}","gists_url":"https://api.github.com/users/tspencer9303/gists{/gist_id}","starred_url":"https://api.github.com/users/tspencer9303/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tspencer9303/subscriptions","organizations_url":"https://api.github.com/users/tspencer9303/orgs","repos_url":"https://api.github.com/users/tspencer9303/repos","events_url":"https://api.github.com/users/tspencer9303/events{/privacy}","received_events_url":"https://api.github.com/users/tspencer9303/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/cakephp/cakephp/labels/Enhancement","name":"Enhancement","color":"bfe5bf"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/cakephp/cakephp/milestones/99","html_url":"https://github.com/cakephp/cakephp/milestones/3.3.3","labels_url":"https://api.github.com/repos/cakephp/cakephp/milestones/99/labels","id":1954048,"number":99,"title":"3.3.3","description":"Bugfixes and minor features for 3.3.x","creator":{"login":"markstory","id":24086,"avatar_url":"https://avatars.githubusercontent.com/u/24086?v=3","gravatar_id":"","url":"https://api.github.com/users/markstory","html_url":"https://github.com/markstory","followers_url":"https://api.github.com/users/markstory/followers","following_url":"https://api.github.com/users/markstory/following{/other_user}","gists_url":"https://api.github.com/users/markstory/gists{/gist_id}","starred_url":"https://api.github.com/users/markstory/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/markstory/subscriptions","organizations_url":"https://api.github.com/users/markstory/orgs","repos_url":"https://api.github.com/users/markstory/repos","events_url":"https://api.github.com/users/markstory/events{/privacy}","received_events_url":"https://api.github.com/users/markstory/received_events","type":"User","site_admin":false},"open_issues":37,"closed_issues":41,"state":"open","created_at":"2016-08-22T02:32:21Z","updated_at":"2016-08-31T02:57:44Z","due_on":"2016-09-04T00:00:00Z","closed_at":null},"comments":8,"created_at":"2016-08-30T21:33:19Z","updated_at":"2016-08-31T03:11:57Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/cakephp/cakephp/pulls/9377","html_url":"https://github.com/cakephp/cakephp/pull/9377","diff_url":"https://github.com/cakephp/cakephp/pull/9377.diff","patch_url":"https://github.com/cakephp/cakephp/pull/9377.patch"},"body":"I recently came across an article that describes a phishing vulnerability. Instagram has already fixed the vulnerability on their site and I feel Cake users should do the same on their projects. Consider adding a configuration option to disable this feature due to using it to find the parent window.\r\n\r\nMost users won't need this feature to be disabled, and only should be disabled if the user directly knows the reasoning for doing so.\r\n\r\n[Article here](https://dev.to/ben/the-targetblank-vulnerability-by-example)\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/cakephp/cakephp/issues/comments/243646364","html_url":"https://github.com/cakephp/cakephp/pull/9377#issuecomment-243646364","issue_url":"https://api.github.com/repos/cakephp/cakephp/issues/9377","id":243646364,"user":{"login":"ADmad","id":142658,"avatar_url":"https://avatars.githubusercontent.com/u/142658?v=3","gravatar_id":"","url":"https://api.github.com/users/ADmad","html_url":"https://github.com/ADmad","followers_url":"https://api.github.com/users/ADmad/followers","following_url":"https://api.github.com/users/ADmad/following{/other_user}","gists_url":"https://api.github.com/users/ADmad/gists{/gist_id}","starred_url":"https://api.github.com/users/ADmad/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ADmad/subscriptions","organizations_url":"https://api.github.com/users/ADmad/orgs","repos_url":"https://api.github.com/users/ADmad/repos","events_url":"https://api.github.com/users/ADmad/events{/privacy}","received_events_url":"https://api.github.com/users/ADmad/received_events","type":"User","site_admin":false},"created_at":"2016-08-31T03:11:57Z","updated_at":"2016-08-31T03:11:57Z","body":"@jadb @chinpei215 https://medium.com/@Jamie_Farrelly/browsers-are-broken-but-nobody-cares-all-it-took-was-1-line-of-code-to-fix-it-f8af13c18cff#.g0p28wpur\r\n\r\nSo it seems the vulnerability only exists for `target=\"_blank\"`"}}
{"actor":{"display_login":"ADmad"}}