From 89af3c87e6882e670603652298b42d89ba4edc7e Mon Sep 17 00:00:00 2001
From: Kai Henseler <kai.henseler@strato.de>
Date: Wed, 29 Jul 2026 09:30:41 +0200
Subject: [PATCH] feat: Add security link protection and rel attribute

Add rel="noreferrer noopener" to external links in UserMenuItem
component for security.

Only render the Login & Security menu item if the security link
is configured, preventing empty links from appearing.

Signed-off-by: Kai Henseler <kai.henseler@strato.de>
---
 IONOS/src/components/userMenu/UserMenuItem.svelte | 6 +++++-
 core/templates/layout.user.php                    | 7 +++++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/IONOS/src/components/userMenu/UserMenuItem.svelte b/IONOS/src/components/userMenu/UserMenuItem.svelte
index afb5b92..a25366f 100644
--- a/IONOS/src/components/userMenu/UserMenuItem.svelte
+++ b/IONOS/src/components/userMenu/UserMenuItem.svelte
@@ -32,9 +32,13 @@ along with this program. If not, see <http://www.gnu.org/licenses/>.
 		link = '',
 		target = '_self',
 	}: Props = $props();
+
+	const rel = $derived(
+		target === '_blank' ? 'noreferrer noopener' : undefined,
+	);
 </script>
 
-<a href={link} class="option-content" {target}>
+<a href={link} class="option-content" {target} {rel}>
 	<div class="icon-and-label">
 		<ionos-icons {...{ [icon]: true }}></ionos-icons>
 		<div class="label">{label}</div>
diff --git a/core/templates/layout.user.php b/core/templates/layout.user.php
index c4901bf..43dde2a 100644
--- a/core/templates/layout.user.php
+++ b/core/templates/layout.user.php
@@ -104,13 +104,16 @@
 								link="<?php p(\OC::$server->get(\OCP\IURLGenerator::class)->linkToRoute('settings.PersonalSettings.index')) ?>"
 								data-qa="IONOS-USER-MENU-SETTINGS-TARGET"
 							></ionos-user-menu-item>
-							<ionos-user-menu-item
+							<?php $securityLink = \OC::$server->get(\OC\SystemConfig::class)->getValue('ionos_security_target_link'); ?>
+							<?php if ($securityLink !== '') { ?>
+								<ionos-user-menu-item
 									icon="accountkey"
 									label="<?php p($l->t('Login & Security')); ?>"
-									link="<?php p(\OC::$server->get(\OC\SystemConfig::class)->getValue('ionos_security_target_link')) ?>"
+									link="<?php p($securityLink) ?>"
 									target="_blank"
 									data-qa="IONOS-USER-MENU-LOGIN-SECURITY-TARGET"
 								></ionos-user-menu-item>
+							<?php } ?>
 							<ionos-user-menu-item
 								icon="help"
 								label="<?php p($l->t('Help & Support'),); ?>"