General: Remove noreferrer from wp_targeted_link_rel() and other uses.

When `noopener noreferrer` was originally added in #37941 and related tickets, the `noreferrer` bit was specifically included due to Firefox not supporting `noopener` at the time.

Since `noopener` has been supported by all major browsers for a while, it should now be safe to remove the `noreferrer` attribute from core.

Props Mista-Flo, audrasjb, joostdevalk, jonoaldersonwp, peterwilsoncc, elgameel.
Fixes #49558.

git-svn-id: https://develop.svn.wordpress.org/trunk@49215 602fd350-edb4-49c9-b593-d223f7449a82

src/wp-includes/class-walker-nav-menu.php

@@ -173,7 +173,7 @@ class Walker_Nav_Menu extends Walker {
 		$atts['title']  = ! empty( $item->attr_title ) ? $item->attr_title : '';
 		$atts['target'] = ! empty( $item->target ) ? $item->target : '';
 		if ( '_blank' === $item->target && empty( $item->xfn ) ) {
-			$atts['rel'] = 'noopener noreferrer';
+			$atts['rel'] = 'noopener';
 		} else {
 			$atts['rel'] = $item->xfn;
 		}

src/wp-includes/comment.php

@@ -3647,7 +3647,7 @@ function wp_comments_personal_data_exporter( $email_address, $page = 1 ) {
 				case 'comment_link':
 					$value = get_comment_link( $comment->comment_ID );
 					$value = sprintf(
-						'<a href="%s" target="_blank" rel="noreferrer noopener">%s</a>',
+						'<a href="%s" target="_blank" rel="noopener">%s</a>',
 						esc_url( $value ),
 						esc_html( $value )
 					);

src/wp-includes/formatting.php

@@ -3153,9 +3153,10 @@ function wp_rel_ugc( $text ) {
 }
 
 /**
- * Adds rel noreferrer and noopener to all HTML A elements that have a target.
+ * Adds `rel="noopener"` to all HTML A elements that have a target.
  *
  * @since 5.1.0
+ * @since 5.6.0 Removed 'noreferrer' relationship.
  *
  * @param string $text Content that may contain HTML A elements.
  * @return string Converted content.
@@ -3188,15 +3189,15 @@ function wp_targeted_link_rel( $text ) {
 }
 
 /**
- * Callback to add rel="noreferrer noopener" string to HTML A element.
+ * Callback to add `rel="noopener"` string to HTML A element.
  *
- * Will not duplicate existing noreferrer and noopener values
- * to prevent from invalidating the HTML.
+ * Will not duplicate an existing 'noopener' value to avoid invalidating the HTML.
  *
  * @since 5.1.0
+ * @since 5.6.0 Removed 'noreferrer' relationship.
  *
- * @param array $matches Single Match
- * @return string HTML A Element with rel noreferrer noopener in addition to any existing values
+ * @param array $matches Single match.
+ * @return string HTML A Element with `rel="noopener"` in addition to any existing values.
  */
 function wp_targeted_link_rel_callback( $matches ) {
 	$link_html          = $matches[1];
@@ -3219,7 +3220,7 @@ function wp_targeted_link_rel_callback( $matches ) {
 	 * @param string $rel       The rel values.
 	 * @param string $link_html The matched content of the link tag including all HTML attributes.
 	 */
-	$rel = apply_filters( 'wp_targeted_link_rel', 'noopener noreferrer', $link_html );
+	$rel = apply_filters( 'wp_targeted_link_rel', 'noopener', $link_html );
 
 	// Return early if no rel values to be added or if no actual target attribute.
 	if ( ! $rel || ! isset( $atts['target'] ) ) {

src/wp-includes/functions.php

@@ -7540,7 +7540,7 @@ function wp_direct_php_update_button() {
 
 	echo '<p class="button-container">';
 	printf(
-		'<a class="button button-primary" href="%1$s" target="_blank" rel="noopener noreferrer">%2$s <span class="screen-reader-text">%3$s</span><span aria-hidden="true" class="dashicons dashicons-external"></span></a>',
+		'<a class="button button-primary" href="%1$s" target="_blank" rel="noopener">%2$s <span class="screen-reader-text">%3$s</span><span aria-hidden="true" class="dashicons dashicons-external"></span></a>',
 		esc_url( $direct_update_url ),
 		__( 'Update PHP' ),
 		/* translators: Accessibility text. */

src/wp-includes/media-template.php

@@ -160,7 +160,7 @@ function wp_print_media_templates() {
 		/* translators: 1: Link to tutorial, 2: Additional link attributes, 3: Accessibility text. */
 		__( '<a href="%1$s" %2$s>Describe the purpose of the image%3$s</a>. Leave empty if the image is purely decorative.' ),
 		esc_url( 'https://www.w3.org/WAI/tutorials/images/decision-tree' ),
-		'target="_blank" rel="noopener noreferrer"',
+		'target="_blank" rel="noopener"',
 		sprintf(
 			'<span class="screen-reader-text"> %s</span>',
 			/* translators: Accessibility text. */

src/wp-includes/widgets/class-wp-widget-custom-html.php

@@ -146,7 +146,7 @@ class WP_Widget_Custom_HTML extends WP_Widget {
 		/** This filter is documented in wp-includes/widgets/class-wp-widget-text.php */
 		$content = apply_filters( 'widget_text', $instance['content'], $simulated_text_widget_instance, $this );
 
-		// Adds noreferrer and noopener relationships, without duplicating values, to all HTML A elements that have a target.
+		// Adds 'noopener' relationship, without duplicating values, to all HTML A elements that have a target.
 		$content = wp_targeted_link_rel( $content );
 
 		/**

src/wp-includes/widgets/class-wp-widget-text.php

@@ -331,7 +331,7 @@ class WP_Widget_Text extends WP_Widget {
 
 		$text = preg_replace_callback( '#<(video|iframe|object|embed)\s[^>]*>#i', array( $this, 'inject_video_max_width_style' ), $text );
 
-		// Adds noreferrer and noopener relationships, without duplicating values, to all HTML A elements that have a target.
+		// Adds 'noopener' relationship, without duplicating values, to all HTML A elements that have a target.
 		$text = wp_targeted_link_rel( $text );
 
 		?>