From b39d9d67466af374ef76143bfef295730b5b690a Mon Sep 17 00:00:00 2001
From: Johannes Meyer <johannes.meyer@icinga.com>
Date: Wed, 21 Jul 2021 08:24:54 +0200
Subject: [PATCH] LinkTransformer: Don't open external urls in iFrames

fixes #4449
---
 library/Icinga/Web/Helper/Markdown/LinkTransformer.php | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/library/Icinga/Web/Helper/Markdown/LinkTransformer.php b/library/Icinga/Web/Helper/Markdown/LinkTransformer.php
index 47873d259..4fd69a790 100644
--- a/library/Icinga/Web/Helper/Markdown/LinkTransformer.php
+++ b/library/Icinga/Web/Helper/Markdown/LinkTransformer.php
@@ -60,10 +60,12 @@ class LinkTransformer extends HTMLPurifier_AttrTransform
             $attr['class'] = 'with-thumbnail';
         }
 
-        if ((! isset($attr['target']) || ! in_array($attr['target'], ['_blank', '_self']))
-            && ($useIframe || $url->isExternal())
-        ) {
-            $attr['href'] = Url::fromPath('iframe', ['url' => $url])->getAbsoluteUrl();
+        if ((! isset($attr['target']) || ! in_array($attr['target'], ['_blank', '_self']))) {
+            if ($useIframe) {
+                $attr['href'] = Url::fromPath('iframe', ['url' => $url])->getAbsoluteUrl();
+            } elseif ($url->isExternal()) {
+                $attr['target'] = '_blank';
+            }
         }
 
         return $attr;