From ffcf79ef0711f41b07e85eb7fdb8e3f9f09ca830 Mon Sep 17 00:00:00 2001
From: Tony Chau <90050474+fo5for@users.noreply.github.com>
Date: Sat, 15 Aug 2026 22:27:47 +0800
Subject: [PATCH] fix: open links in new tab

The addition of external link warning has changed the behavior of
opening links from opening in a new tab to opening in the same tab.
This restores the old behavior and opens all links in a new tab.

Signed-off-by: Tony Chau <90050474+fo5for@users.noreply.github.com>
---
 lib/links.js                 |  6 +-----
 locales/de.json              |  2 +-
 locales/en.json              |  2 +-
 public/docs/release-notes.md |  4 ++++
 public/js/extra.js           | 12 ++++++++++--
 public/views/link.ejs        |  7 +++++--
 6 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/lib/links.js b/lib/links.js
index 0f6dffd2..de1c0d80 100644
--- a/lib/links.js
+++ b/lib/links.js
@@ -1,10 +1,6 @@
 module.exports = {
   serveLinkWarningPage: function (req, res) {
     let targetURL = typeof req.query.url === 'string' ? req.query.url : ''
-    let noteURL = typeof req.query.note === 'string' ? req.query.note : ''
-    if (noteURL !== '' && !/^[\w-]+$/.test(noteURL)) {
-      noteURL = ''
-    }
     let valid = false
     try {
       targetURL = decodeURIComponent(targetURL)
@@ -20,8 +16,8 @@ module.exports = {
     res.render('link.ejs', {
       title: 'External link',
       valid,
-      noteURL,
       targetURL,
+      cspNonce: res.locals.nonce,
       opengraph: []
     })
   }
diff --git a/locales/de.json b/locales/de.json
index b587432f..057a488f 100644
--- a/locales/de.json
+++ b/locales/de.json
@@ -132,7 +132,7 @@
     "The content of that page is unrelated to HedgeDoc. Do not enter your HedgeDoc credentials there.": "Der Inhalt dieser Seite ist unabhängig von HedgeDoc. Dort keine HedgeDoc-Zugangsdaten eingeben.",
     "Do you want to continue?": "Fortfahren?",
     "Continue to external page": "Weiter zur externen Seite",
-    "Back to your note": "Zurück zur Notiz",
+    "Close": "Schließen",
     "Invalid link": "Ungültiger Link",
     "The provided link is not a valid URL.": "Die angegebene URL ist nicht gültig."
 }
\ No newline at end of file
diff --git a/locales/en.json b/locales/en.json
index faecada7..72c06213 100644
--- a/locales/en.json
+++ b/locales/en.json
@@ -132,7 +132,7 @@
     "Invalid link": "Invalid link",
     "Do you want to continue?": "Do you want to continue?",
     "Continue to external page": "Continue to external page",
-    "Back to your note": "Back to your note",
+    "Close": "Close",
     "The provided link is not a valid URL.": "The provided link is not a valid URL.",
     "The content of that page is unrelated to HedgeDoc. Do not enter your HedgeDoc credentials there.": "The content of that page is unrelated to HedgeDoc. Do not enter your HedgeDoc credentials there."
 }
diff --git a/public/docs/release-notes.md b/public/docs/release-notes.md
index 1deea67c..f1762edc 100644
--- a/public/docs/release-notes.md
+++ b/public/docs/release-notes.md
@@ -6,6 +6,10 @@
 
 - Automatically skip the login modal if no form-based login and exactly one external login provider is configured
 
+### Bugfixes
+
+- All links will be opened in new tabs instead of the same tab as the note. This was changed when the external link warning was implemented and now the old behavior is restored.
+
 ## <i class="fa fa-tag"></i> 1.11.1 <i class="fa fa-calendar-o"></i> 2026-07-24
 
 ### Security fixes
diff --git a/public/js/extra.js b/public/js/extra.js
index 6ab1cfaa..ec1ea1af 100644
--- a/public/js/extra.js
+++ b/public/js/extra.js
@@ -593,6 +593,7 @@ window.postProcess = postProcess
 // rewrite external links to go through the /_link warning page
 export function rewriteExternalLinks (view) {
   if (window.externalLinkWarning === false) {
+    view.find('a:not([href^="#"]):not([target])').attr('target', '_blank').attr('rel', 'noopener')
     return
   }
   const whitelist = window.externalLinkWhitelist || []
@@ -621,11 +622,18 @@ export function rewriteExternalLinks (view) {
       }
       return hostname === lowercaseDomain
     })) {
+      if (!anchor.attr('target')) {
+        anchor.attr('target', '_blank').attr('rel', 'noopener')
+      }
       return
     }
-    const noteURL = window.location.pathname.split('/').pop()
     const urlPath = window.urlpath ? `/${window.urlpath}` : ''
-    anchor.attr('href', `${window.location.origin}${urlPath}/_link?url=${encodeURIComponent(parsed.href)}&note=${noteURL}`)
+    const warningURL = `${window.location.origin}${urlPath}/_link?url=${encodeURIComponent(parsed.href)}`
+    anchor.attr('href', warningURL)
+    anchor.on('click', event => {
+      event.preventDefault()
+      window.open(warningURL, '_blank')
+    })
   })
 }
 window.rewriteExternalLinks = rewriteExternalLinks
diff --git a/public/views/link.ejs b/public/views/link.ejs
index 62b4e04a..52ae04a0 100644
--- a/public/views/link.ejs
+++ b/public/views/link.ejs
@@ -27,15 +27,18 @@
             <p><%= __('Do you want to continue?') %></p>
             <p>
                 <a class="btn btn-primary" href="<%- targetURL %>"><%= __('Continue to external page') %></a>
-                <a class="btn btn-default" href="<%- serverURL %>/<%- noteURL %>"><%= __('Back to your note') %></a>
+                <a class="btn btn-default" id="close-button"><%= __('Close') %></a>
             </p>
             <% } else { %>
             <p class="text-danger"><strong><%= __('The provided link is not a valid URL.') %></strong></p>
             <p>
-                <a class="btn btn-default" href="<%- serverURL %>/<%- noteURL %>"><%= __('Back to your note') %></a>
+                <a class="btn btn-default" id="close-button"><%= __('Close') %></a>
             </p>
             <% } %>
         </div>
     </div>
 </body>
+<script nonce="<%= cspNonce %>">
+    document.getElementById("close-button").addEventListener('click', _ => window.close())
+</script>
 </html>