From 77c6bac6a368fe8a6f0ea7e5d46e5012d4f68bdc Mon Sep 17 00:00:00 2001
From: "Cathy J. Fitzpatrick" <cathy@cathyjf.com>
Date: Fri, 21 Jun 2013 16:38:09 -0500
Subject: [PATCH] Links in sanitized HTML always have target="_blank"

---
 js/battledata.js | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/js/battledata.js b/js/battledata.js
index a9c03a8b2..c746e6fff 100644
--- a/js/battledata.js
+++ b/js/battledata.js
@@ -436,13 +436,13 @@ var Tools = {
 		};
 		var tagPolicy = function(tagName, attribs) {
 			if (html4.ELEMENTS[tagName] & html4.eflags['UNSAFE']) {
-				return undefined;
+				return;
 			}
-			// In addition to the normal whitelist, allow target='_blank'.
-			// html.sanitizeAttribs is not very customisable, so this a bit ugly.
-			var blankIdx = undefined;
+			var targetIdx;
 			var extra = {};
 			if (tagName === 'a') {
+				// Special handling of <a> tags.
+
 				for (var i = 0; i < attribs.length - 1; i += 2) {
 					switch (attribs[i]) {
 						case 'href':
@@ -451,9 +451,7 @@ var Tools = {
 							}
 							break;
 						case 'target':
-							if (attribs[i + 1] === '_blank') {
-								blankIdx = i + 1;
-							}
+							targetIdx = i + 1;
 							break;
 						case 'room':
 							// Special custom attribute for linking to a room.
@@ -470,8 +468,10 @@ var Tools = {
 				}
 			}
 			attribs = html.sanitizeAttribs(tagName, attribs, uriRewriter);
-			if (blankIdx !== undefined) {
-				attribs[blankIdx] = '_blank';
+			if (targetIdx !== undefined) {
+				attribs[targetIdx] = '_blank';
+			} else {
+				extra['target'] = '_blank';
 			}
 			for (var i in extra) {
 				attribs.push(i);