FSN#37542 prevent tabnabbing with our custom FcltMgr.windowopen which clears the window.opener

svn path=/Website/trunk/; revision=34632
2017-07-17 08:22:34 +00:00
parent 238f7e5266
commit 2c998c9af6
53 changed files with 78 additions and 107 deletions
--- a/APPL/ALG/alg_show_gebouw.asp
+++ b/APPL/ALG/alg_show_gebouw.asp
@@ -89,10 +89,9 @@ oRs.Close();
 <%  if (S("alg_fg_remote_maps") != "" && bld_x && bld_y) { %>
      function openMaps(bldKey)
      {
-          fwnd = window.open('../cad/ShowGoogleMap.asp?bld_key=' + bldKey, 'FGShow',
+          FcltMgr.windowopen('../cad/ShowGoogleMap.asp?bld_key=' + bldKey, 'FGShow',
                             "width=800, height=600, directories=no, location=no, menubar=no,"
                           + "resizable=yes, status=no, titlebar=yes, toolbar=no");
-          fwnd.focus()
          return;
      }
 <%  } %>
--- a/APPL/ALG/alg_show_locatie.asp
+++ b/APPL/ALG/alg_show_locatie.asp
@@ -86,10 +86,9 @@ oRs.Close();
 <%  if (S("alg_fg_remote_maps") != "" && loc_x && loc_y) {  %>
      function openMaps(locKey)
      {
-          fwnd = window.open('../cad/ShowGoogleMap.asp?loc_key=' + locKey, 'FGShow',
+          FcltMgr.windowopen('../cad/ShowGoogleMap.asp?loc_key=' + locKey, 'FGShow',
                             "width=800, height=600, directories=no, location=no, menubar=no,"
                           + "resizable=yes, status=no, titlebar=yes, toolbar=no");
-          fwnd.focus()
          return;
      }
 <%  } %>
--- a/APPL/API2/TESTER/api2_tester.asp
+++ b/APPL/API2/TESTER/api2_tester.asp
@@ -39,7 +39,7 @@ var fac_id = Request.QueryString("fac_id").Count > 0&&String(Request.QueryString
    <body style='background-color:#E5EAF1; font-family: Helvetica; font-size: 0.8em;'>
        <form method="post" onsubmit="doSubmit();return false;">
          <table>
-            <th colspan="2">FACILITOR API2 tester  -  FOR INTERNAL USE ONLY [ <a href="<%=safe.htmlattr(HTTP.urlzelf())%>/api2/" target="_blank">API reference</a> ]</th>
+            <th colspan="2">FACILITOR API2 tester  -  FOR INTERNAL USE ONLY [ <a href="<%=safe.htmlattr(HTTP.urlzelf())%>/api2/" target="_blank" rel="noopener noreferrer">API reference</a> ]</th>
            <tr><td><label>Format</label></td>
                <td><input type='radio' id='format' name='format' value='json' checked='1'>json</input>
                    <input type='radio' id='format' name='format' value='xml'>xml</input>
--- a/APPL/BES/bes_bestelling.asp
+++ b/APPL/BES/bes_bestelling.asp
@@ -198,8 +198,7 @@ transitParam = buildTransitParam(["punch", "voorraad", "mld_key", "artikel_key",
                            newWindow = true;
                      %>
                            punchwindow = true; // voorkomt 'hot'
-                            var wnd = window.open(punch_url);
-                            try { wnd.focus(); } catch (e) { };
+                            FcltMgr.windowopen(punch_url);
                      <% }  else { %>
                            window.location.href=punch_url;
                      <% } %>
--- a/APPL/BES/bes_bestelling.js
+++ b/APPL/BES/bes_bestelling.js
@@ -52,8 +52,7 @@ var bes_supAddress = "";

 function navigateToSupplier()
 {
-  fwnd = window.open(bes_supAddress, 'Supplier','');
-  try { fwnd.focus(); } catch (e) { };
+  FcltMgr.windowopen(bes_supAddress, 'Supplier','');
 }

 function onChangeArtikelgroep()
--- a/APPL/BES/bes_list.js
+++ b/APPL/BES/bes_list.js
@@ -55,7 +55,7 @@ function besSubmitCallback(json, textStatus)
      // Bij bulk acties opdrachtbon niet printen. (Meerder tegelijk openen geeft  ook foutmelding)
      // Bulk actie worden ook niet toegestaan als setting mld_order_autoprint is gezet
      url = "bes_opdr_xml.asp?opdr_key=" + json.opdr_key_array[0];
-      window.open(url).focus();
+      FcltMgr.windowopen(url);
    }
    FcltCallbackRefresh(json, textStatus);
  }
--- a/APPL/BES/bes_show_bestelling.asp
+++ b/APPL/BES/bes_show_bestelling.asp
@@ -113,7 +113,7 @@ FCLTHeader.Requires({plugins:["suggest","jQuery"],
    }

    function bes_print() {
-        window.open('./bes_opdr_xml.asp?bes_key='+'<% = bes_key %>').focus();
+        FcltMgr.windowopen('./bes_opdr_xml.asp?bes_key='+'<% = bes_key %>');
    }

 </script>
--- a/APPL/BES/bes_show_opdr.asp
+++ b/APPL/BES/bes_show_opdr.asp
@@ -39,7 +39,7 @@ user.auth_required_or_abort(this_bestelopdr.canReadAny || this_bestelling.isVera
    <script>
      function bes_opdr_print()
      {
-          window.open("bes_opdr_xml.asp?opdr_key=<%=opdr_key%>").focus();
+          FcltMgr.windowopen("bes_opdr_xml.asp?opdr_key=<%=opdr_key%>");
      }

      function bes_opdr_sent()
--- a/APPL/BES/sel_items_tab.js
+++ b/APPL/BES/sel_items_tab.js
@@ -213,10 +213,9 @@ function AddItem(bes_item_info, aantal, urole, doCheckAmount)

 function openArtDetails(detailurl)
 {
-    var fwnd = window.open(detailurl, 'ArtDetInfo',
+    FcltMgr.windowopen(detailurl, 'ArtDetInfo',
       "width=800, height=600, directories=no,location=no,menubar=no,title='ArtDetInfo',"
       + "resizable=yes,status=no,titlebar=yes,toolbar=no,scrollbars=yes");
-    try { fwnd.focus(); } catch (e) { };
 }

 // Verwerk het resultaat van fetchArtikelInfo
--- a/APPL/BEZ/bez.js
+++ b/APPL/BEZ/bez.js
@@ -7,7 +7,7 @@

 function printBadge(pbez_key)
 {    // Printen van de bezoekers badge
-    window.open("bez_xml.asp?badge=1&bez_key=" + pbez_key, "", "resizable=0,scrollbars=0,menubar=0,width=500,height=400");
+    FcltMgr.windowopen("bez_xml.asp?badge=1&bez_key=" + pbez_key, "", "resizable=0,scrollbars=0,menubar=0,width=500,height=400");
 }

 function bezPoolCallback(data, text)
--- a/APPL/BEZ/bez_show_afspraak.asp
+++ b/APPL/BEZ/bez_show_afspraak.asp
@@ -101,7 +101,7 @@ var urlMail = "../shared/queuemail.asp?pcode=BEZMAI&defemail_key=" + bez_afspraa

        function bez_print()
        {
-          window.open('bez_xml.asp?afspr_key=<%=afspr_key%>');
+          FcltMgr.windowopen('bez_xml.asp?afspr_key=<%=afspr_key%>');
        }
    </script>
  </head>
--- a/APPL/CAD/ShowRoom.asp
+++ b/APPL/CAD/ShowRoom.asp
@@ -100,10 +100,9 @@ var params = "&vKey=<%=vKey%>&scenario_key=0"
 function onFullScreen()
 {
    var url = "./maximize.asp?x=x" + params;
-    var wnd = window.open(url,'FGShow',
+    FcltMgr.windowopen(url,'FGShow',
                    "directories=no,location=no,menubar=no,"
                  + "resizable=yes,status=no,titlebar=yes,toolbar=no");
-    wnd.focus();
    FcltMgr.closeDetail(window); // zelf kunnen we nu wel dicht
 }
 function MMap_onMapperLoad(pSLNKEvent)
--- a/APPL/CAD/default.asp
+++ b/APPL/CAD/default.asp
@@ -567,8 +567,7 @@ if (scenario_key != 0)
        url += "&DWGscale=" + data.DWGscale;
        url += "&pngURL=" + escape(pngURL);

-        var fwnd = window.open(url);
-        fwnd.focus();
+        FcltMgr.windowopen(url);
      }

      function MMap_onPrint(SlnkEvent)
@@ -667,10 +666,9 @@ if (scenario_key != 0)
        var loc_key = $("#locatiekey").val();
        if (loc_key >= 0)
        {
-          fwnd = window.open("../cad/ShowGoogleMap.asp?loc_key=" + loc_key, "FGShow",
+          FcltMgr.windowopen("../cad/ShowGoogleMap.asp?loc_key=" + loc_key, "FGShow",
                             "width=640,height=480,directories=no,location=no,menubar=no,"
                           + "resizable=yes,status=no,titlebar=yes,toolbar=no");
-          fwnd.focus()
          return;
        }
      }
@@ -681,10 +679,9 @@ if (scenario_key != 0)
        var bld_key = document.getElementById("gebouwkey");
        if (bld_key)
        {
-          fwnd = window.open("../cad/ShowGoogleMap.asp?bld_key=" + bld_key, 'FGShow',
+          FcltMgr.windowopen("../cad/ShowGoogleMap.asp?bld_key=" + bld_key, 'FGShow',
                             "width=640,height=480,directories=no,location=no,menubar=no,"
                           + "resizable=yes,status=no,titlebar=yes,toolbar=no");
-          fwnd.focus()
          return;
        }
      }
@@ -779,10 +776,9 @@ if (scenario_key != 0)
            var url = "./InfoBord.asp?floor_key=" + floor_key+getCustomParameters();
        else
            var url = "./maximize.asp?x=x" + getCustomParameters();
-        var wnd = window.open(url,'FGShow',
+        FcltMgr.windowopen(url,'FGShow',
                        "directories=no,location=no,menubar=no,"
                      + "resizable=yes,status=no,titlebar=yes,toolbar=no");
-        wnd.focus();
      }

      function scrollview($elm)
--- a/APPL/CAD/rap_alg2.asp
+++ b/APPL/CAD/rap_alg2.asp
@@ -73,10 +73,9 @@ else
      {
        return; // Toch maar niet, ruimte.asp werkt niet helemaal goed buiten zijn context

-        fwnd = window.open('../alg/ruimte.asp?mode=ReadOnly&Key='+room_key, 'FGShowRoom',
+        FcltMgr.windowopen('../alg/ruimte.asp?mode=ReadOnly&Key='+room_key, 'FGShowRoom',
                "width=960,height=640,directories=no,location=no,menubar=no,"
                + "resizable=yes,status=no,titlebar=yes,toolbar=no");
-        fwnd.focus();
      }
    </script>
 </head>
--- a/APPL/CNT/cnt_show_contract.asp
+++ b/APPL/CNT/cnt_show_contract.asp
@@ -133,7 +133,7 @@ var urlMail = "../shared/queuemail.asp?pcode=CNTMAI&defemail_key=" + defemail_ke

      function cnt_print()
      {
-         window.open('./cnt_xml.asp?cnt_key='+<%=cnt_key%>);
+         FcltMgr.windowopen('./cnt_xml.asp?cnt_key='+<%=cnt_key%>);
      }

      function cnt_inactivate()
--- a/APPL/FAC/Facilitor.asp
+++ b/APPL/FAC/Facilitor.asp
@@ -489,7 +489,7 @@ if (device.test(device.isTouch)) { %>
   }); // jQuery.ready

 <%  if (__Logging & 2) { %>
-    window.open("./fac_StreamFile.asp?logger=0", "logger<%=customerId%>");
+    FcltMgr.windowopen("./fac_StreamFile.asp?logger=0", "logger<%=customerId%>");
    self.focus();
 <% }

--- a/APPL/FAC/about.asp
+++ b/APPL/FAC/about.asp
@@ -56,7 +56,7 @@ FCLTHeader.Generate(); %>
    BLOCK_START("aboutInfo", L("lcl_facilitor_appl")+' '+facilitorversion+' '+oRs("tijdstip").value);

    // users
-    var keyUserLabel = '<a href="../mgt/mgt_generic.asp?mode=list&columns=prs_perslid_naam_full,xd_user,funcodes&groupby=,,&table=FAC_V_LCRAP_KEY_STATS" target="_blank">'+L("lcl_key_users")+'</a>';
+    var keyUserLabel = '<a href="../mgt/mgt_generic.asp?mode=list&columns=prs_perslid_naam_full,xd_user,funcodes&groupby=,,&table=FAC_V_LCRAP_KEY_STATS" target="_blank" rel="noopener noreferrer">'+L("lcl_key_users")+'</a>';
    ROFIELDTR("fld", keyUserLabel, L("lcl_usrs_licensed")+": "+licensed_key_users+" \n"+ L("lcl_usrs_actual")+": "+ oRs("key_users").value
              + (oRs("key_users").value>licensed_key_users ? " \n"+L("lcl_keyactualexceedslicensed").format(oRs("key_users").value-licensed_key_users) : ""));

--- a/APPL/FAC/fac_menu.inc
+++ b/APPL/FAC/fac_menu.inc
@@ -81,7 +81,7 @@ function CreateItems(menuItems, pmode, start_collapsed, max_lines)
            {
                if (itm.href.slice(0,1) == "*")
                    itm.href = "../../" + itm.href.substr(1);
-                action = " onclick=\"FcltMgr.stopPropagation(event);window.open('" + safe.jsstring(itm.href) + "')\"";
+                action = " onclick=\"FcltMgr.stopPropagation(event);FcltMgr.windowopen('" + safe.jsstring(itm.href) + "')\"";
            } else if (itm.href.slice(0,11) == "javascript:") {
                action = " onclick=\"FcltMgr.stopPropagation(event);" + safe.htmlattr(itm.href) + "\"";
            } else {
@@ -163,7 +163,7 @@ function CreateMenuGroep(Koppen, pmode)
        %><li class="mklogo"<%=ttl%>><span class="menulinkkop"><%
        var kitm = menuKop;
        if (kitm.href.slice(0,7) == "http://" || kitm.href.slice(0,8) == "https://" || kitm.href.slice(0,11) == "javascript:"){
-        %><a href="<%=safe.htmlattr(kitm.href)%>" target="_blank"><%
+        %><a href="<%=safe.htmlattr(kitm.href)%>" target="_blank" rel="noopener noreferrer"><%
        } else {
        %><a onclick='FcltMgr.openDetail("<%=safe.htmlattr(kitm.href)%>", "<%=safe.htmlattr(menuKop.label)%>")'><%
        }
--- a/APPL/FAC/fac_nieuws_forum_proxy.asp
+++ b/APPL/FAC/fac_nieuws_forum_proxy.asp
@@ -61,7 +61,7 @@ for (var i = 0; i < data.posts.length; i++)
       }
       // Wordpress blijkt het al safe aan te leveren (&#0038;) dus hoeft hier geen safe.htmlattr en safe.html
       msgarr.push('<li title = "'+(data.posts[i].excerpt)+'">' + data.posts[i].date
-                              +  ' - <a href=' +data.posts[i].url+ ' target="_blank">'+(data.posts[i].title)+'</a></li>');
+                              +  ' - <a href=' +data.posts[i].url+ ' target="_blank" rel="noopener noreferrer">'+(data.posts[i].title)+'</a></li>');
    }
 }
 if (msgarr.length)
--- a/APPL/FAC/fac_report.asp
+++ b/APPL/FAC/fac_report.asp
@@ -98,11 +98,11 @@
                      <script type="text/javascript">
                        function rap_print()
                        {
-                            window.open("fac_report.asp?outputmode=1<%=safe.jsstring(transitQS())%>");
+                            FcltMgr.windowopen("fac_report.asp?outputmode=1<%=safe.jsstring(transitQS())%>");
                        }
                        function rap_excel()
                        {
-                            window.open("fac_report.asp?outputmode=2<%=safe.jsstring(transitQS())%>");
+                            FcltMgr.windowopen("fac_report.asp?outputmode=2<%=safe.jsstring(transitQS())%>");
                        }
                      </script>
                    <% } %>
@@ -160,7 +160,7 @@
            // "axes[...]._ticks.0.formatter is null or not an object" krijg je namelijk
            // https://bitbucket.org/cleonello/jqplot/issue/201/highlighter-plugin-causes-error-on-hover meldt min of meer hetzelfde
            FCLTHeader.Requires({  js: ["../Localscripts/jqPlot/dist/plugins/jqplot.pointLabels.js"]});
-        }        
+        }
    }

    if (mode == "list")
--- a/APPL/FAC/fac_usrrap_list.asp
+++ b/APPL/FAC/fac_usrrap_list.asp
@@ -104,11 +104,11 @@ if (!nohtml) {
  <script type="text/javascript">
    function rap_print()
    {
-        window.open("fac_usrrap_list.asp?outputmode=1<%=safe.jsstring(transitQS())%>");
+        FcltMgr.windowopen("fac_usrrap_list.asp?outputmode=1<%=safe.jsstring(transitQS())%>");
    }
    function rap_excel()
    {
-        window.open("fac_usrrap_list.asp?outputmode=2<%=safe.jsstring(transitQS())%>");
+        FcltMgr.windowopen("fac_usrrap_list.asp?outputmode=2<%=safe.jsstring(transitQS())%>");
    }
  </script>
 <% } %>
--- a/APPL/FAC/header.inc
+++ b/APPL/FAC/header.inc
@@ -211,7 +211,7 @@ function generateHeaderFunctions (params)
        if (<%=S("help_window")?"false":"true"%>)
            FcltMgr.openDetail(url,'<%=L("lcl_help")%>');
        else
-            var newWindow = window.open('../../'+url);
+            FcltMgr.windowopen('../../'+url);
    }

    function myInfo()
--- a/APPL/FAC/prodsearch.asp
+++ b/APPL/FAC/prodsearch.asp
@@ -430,7 +430,7 @@ function suggest_box_resruimte (titel, histograms, kolom, params)
          {
              if (resData.url.slice(0,4) == "http")
              {
-                  window.open(resData.url);
+                  FcltMgr.windowopen(resData.url);
                  FcltMgr.stopPropagation(event);
              }
              else
--- a/APPL/FIN/fin_show_factuur.js
+++ b/APPL/FIN/fin_show_factuur.js
@@ -14,7 +14,7 @@ function fin_change(fin_status)

 function fin_print()
 {
-  window.open('./fin_xml.asp?fin_key=' + fin_key);
+  FcltMgr.windowopen('./fin_xml.asp?fin_key=' + fin_key);
 }

 function finMailCallback(data)
--- a/APPL/INS/ins_list.inc
+++ b/APPL/INS/ins_list.inc
@@ -338,10 +338,9 @@ function ins_list (pautfunction, params)
              { %>
                if (pxyknown == 1)
                {
-                  fwnd = window.open('../cad/ShowGoogleMap.asp?obj_key=' + insKey, 'FGShow',
+                  FcltMgr.windowopen('../cad/ShowGoogleMap.asp?obj_key=' + insKey, 'FGShow',
                                     "width=640, height=480, directories=no, location=no, menubar=no,"
                                   + "resizable=yes, status=no, titlebar=yes, toolbar=no");
-                  fwnd.focus()
                  return;
                }
 <%            } %>
--- a/APPL/INS/ins_show_deel.asp
+++ b/APPL/INS/ins_show_deel.asp
@@ -218,7 +218,7 @@ oRs.Close();
    <script type="text/javascript">
      function ins_print()
      {
-         window.open('./ins_xml.asp?ins_key='+<%=ins_key%>);
+         FcltMgr.windowopen('./ins_xml.asp?ins_key='+<%=ins_key%>);
      }
      function showHistory()
      {
--- a/APPL/INS/ins_show_srtdeel.asp
+++ b/APPL/INS/ins_show_srtdeel.asp
@@ -61,7 +61,7 @@ oRs.close();
    <script type="text/javascript">
      function ins_print()
      {
-        window.open('./ins_srtdeel_xml.asp?srtdeel_key=' + <%=srtdeel_key%>);
+        FcltMgr.windowopen('./ins_srtdeel_xml.asp?srtdeel_key=' + <%=srtdeel_key%>);
      }

      function ins_change()
--- a/APPL/Localscripts/FcltMgr.js
+++ b/APPL/Localscripts/FcltMgr.js
@@ -51,9 +51,9 @@ var FcltMgr =
                    url += "_titel_=" + escape(titel);
                }
                if (params.forcedeep)
-                    window.open("../../?JumpTo=" + escape(params.orgurl));
+                    FcltMgr.windowopen("../../?JumpTo=" + escape(params.orgurl));
                else
-                    window.open(url);
+                    FcltMgr.windowopen(url);
 //                FcltMgr.resized(window, params);
            },

@@ -1252,18 +1252,18 @@ var FcltMgr =
                    }
                });
        },
-        windowopen: function(url, params)
+        windowopen: function(url, name, specs, replace)
        {
-            params = params || {};
-            var wnd = window.open();
-            wnd.opener = null;
-            wnd.location = url;
+            var wnd       = window.open(null, name, specs, replace);
+            wnd.opener    = null;
+            wnd.location  = url;
            try {
                wnd.focus;
            }
            catch(e) {
-                // alert(e); ?
+                // FcltMgr.alert(e);
            }
+            return wnd;
        },
        confirm: function (tekst, params, fncallback)
        {
--- a/APPL/MLD/mld_edit_melding.js
+++ b/APPL/MLD/mld_edit_melding.js
@@ -101,8 +101,7 @@ function mld_submit_callback(json)
    {
        if (json.autoprint)
        {
-          var wnd = window.open('./mld_opdr_xml.asp?mld_key=' + json.mld_key,'pr_rep','resizable=1,scrollbars=1,menubar=1,toolbar=1');
-          wnd.focus();
+          FcltMgr.windowopen('./mld_opdr_xml.asp?mld_key=' + json.mld_key,'pr_rep','resizable=1,scrollbars=1,menubar=1,toolbar=1');
        }
        FcltMgr.closeDetail(window, json);
    }
--- a/APPL/MLD/mld_fe_menu.asp
+++ b/APPL/MLD/mld_fe_menu.asp
@@ -37,7 +37,7 @@ var lvl = getQParamInt("lvl", 1);
            if (p_url)
            {   // URL starting with '*' is interpreted like 'target=_new'
                if (p_url.slice(0,4) == "http")
-                    window.open(p_url);
+                    FcltMgr.windowopen(p_url);
                else
                    FcltMgr.openDetail(p_url, L("lcl_complain"));
            }
--- a/APPL/MLD/mld_opdr.asp
+++ b/APPL/MLD/mld_opdr.asp
@@ -140,8 +140,7 @@ var copyconfirm = getQParamInt("copyconfirm", 0) == 1;
        // nieuwe melding, ga verder in 'verynew' modus
        if (params.autoprint && !params.asksend /* JGL: && !params.queuemail lijkt mij niet onlogisch? */)
        {
-          var wnd = window.open('./mld_opdr_xml.asp?opdr_key=' + params.opdr_key, 'pr_rep', 'resizable=1,scrollbars=1,menubar=1,toolbar=1');
-          wnd.focus();
+          FcltMgr.windowopen('./mld_opdr_xml.asp?opdr_key=' + params.opdr_key, 'pr_rep', 'resizable=1,scrollbars=1,menubar=1,toolbar=1');
        }
        if (params.asksend) // blijkbaar niet volautomatisch
        {
--- a/APPL/MLD/mld_show_melding.js
+++ b/APPL/MLD/mld_show_melding.js
@@ -6,7 +6,7 @@
 */
 function mld_print()
 {
-   window.open('./mld_opdr_xml.asp?mld_key=' + mld_key);
+   FcltMgr.windowopen('./mld_opdr_xml.asp?mld_key=' + mld_key);
 }

 function mld_change(urole)
--- a/APPL/MLD/mld_show_note2.asp
+++ b/APPL/MLD/mld_show_note2.asp
@@ -95,7 +95,7 @@ var timestamp_notes = new Date();
      }
      function doPrint()
      {
-          window.open("./mld_show_note.asp?urole=<%=urole%>&mld_key=<%=mld_key%>&outputmode=1");
+          FcltMgr.windowopen("./mld_show_note.asp?urole=<%=urole%>&mld_key=<%=mld_key%>&outputmode=1");
      }

      function Upload()
--- a/APPL/MLD/mld_show_opdr.js
+++ b/APPL/MLD/mld_show_opdr.js
@@ -157,7 +157,7 @@ function opdr_list_invoice()

 function opdr_print()
 {
-  window.open('./mld_opdr_xml.asp?opdr_key=' + opdr_key);
+  FcltMgr.windowopen('./mld_opdr_xml.asp?opdr_key=' + opdr_key);
 }

 function opdrMailCallback(data)
--- a/APPL/MRK/mrk_list.inc
+++ b/APPL/MRK/mrk_list.inc
@@ -64,7 +64,7 @@ function mrk_list (pautfunction, params)
                                               FcltMgr.stopPropagation(event); // This prevents the event from bubbling up to the onclick event handler for the line.
                                               var obj = event.srcElement || event.target;
                                               var src = obj.src;
-                                               window.open(src);
+                                               FcltMgr.windowopen(src);
                                             });
                            });
      </script>
--- a/APPL/MRK/mrk_show_bericht.asp
+++ b/APPL/MRK/mrk_show_bericht.asp
@@ -101,7 +101,7 @@ user.auth_required_or_abort(this_mrk.canReadAny);
                var imagePathFile = mrk.bericht_imageFile(vSubFolder, vBestandnaam);
                %><tr><td class='label'><label><%=L("lcl_mrk_foto")%></label></td>
                      <td><img title='<%=safe.htmlattr(vBestandnaam)%>'
-                               onclick='window.open("<%=safe.jsstring(imagePathFile)%>")'
+                               onclick='FcltMgr.windowopen("<%=safe.jsstring(imagePathFile)%>")'
                               class='photo' src='<%=safe.htmlattr(imagePathFile)%>'></td>
                  </tr>
                <%
--- a/APPL/MSG/msg_edit_message.asp
+++ b/APPL/MSG/msg_edit_message.asp
@@ -226,7 +226,7 @@ jQuery(document).ready(function()
 %>
  <tr>
    <td class="label"><label><%=L("lcl_mes_link")%>:</label></td>
-    <td colspan="3"><a class="fldmsgurl" href="<%=safe.htmlattr(ilink)%>" target="_blank"><%=ilink%></a></td>
+    <td colspan="3"><a class="fldmsgurl" href="<%=safe.htmlattr(ilink)%>" target="_blank" rel="noopener noreferrer"><%=ilink%></a></td>
  </tr>
 <% }

--- a/APPL/MSG/msg_show_message.asp
+++ b/APPL/MSG/msg_show_message.asp
@@ -149,7 +149,7 @@ function messageReply() {
    %>
      <tr>
        <td class="label"><label><%=L("lcl_mes_link")%>:</label></td>
-        <td colspan="3"><a class="fldmsgurl" href="<%=safe.htmlattr(ilink)%>" target="_blank"><%=ilink%></a></td>
+        <td colspan="3"><a class="fldmsgurl" href="<%=safe.htmlattr(ilink)%>" target="_blank" rel="noopener noreferrer"><%=ilink%></a></td>
      </tr>
    <% }

--- a/APPL/PRJ/prj_show_scenario.js
+++ b/APPL/PRJ/prj_show_scenario.js
@@ -23,7 +23,7 @@ function prj_graphics_floor(prj_key, flr_key)

 function prj_report(prj_key)
 {
-  window.open("./prj_xml.asp?prj_key=" + prj_key);
+  FcltMgr.windowopen("./prj_xml.asp?prj_key=" + prj_key);
 }

 function prj_submit(prj_key)
--- a/APPL/PRS/prs_phonebook_list.asp
+++ b/APPL/PRS/prs_phonebook_list.asp
@@ -54,8 +54,7 @@ var met_foto = getQParam("pb_photo","off")=="on";

    function doPhoto(key)
    {
-       photo = window.open('ShowPictures.asp?prs_key='+key,'PhotoWin', 'scrollbars=no width=320,height=320,resizable=no');
-       photo.focus();
+       FcltMgr.windowopen('ShowPictures.asp?prs_key='+key,'PhotoWin', 'scrollbars=no width=320,height=320,resizable=no');
    }

    function doMailing(rowArray, isMulti)
@@ -73,7 +72,7 @@ var met_foto = getQParam("pb_photo","off")=="on";
      var mailer = mailString.join("; ");
      if (mailer.length <= bulk_mail_max)
      {
-        window.open("mailto:" + mailer);
+        FcltMgr.windowopen("mailto:" + mailer);
      }
      else
      {
--- a/APPL/RES/res_edit_rsv_ruimte.asp
+++ b/APPL/RES/res_edit_rsv_ruimte.asp
@@ -1012,8 +1012,7 @@ FCLTHeader.Requires({plugins: ["jQuery", "kenmerk"],

      function res_info(url)
      {
-        var wnd = window.open(url);
-        try { wnd.focus() } catch(e) {};
+        FcltMgr.windowopen(url);
      }

      jQuery(document).ready(function() {
--- a/APPL/RES/res_reservering.asp
+++ b/APPL/RES/res_reservering.asp
@@ -327,9 +327,7 @@ if (showMldFrame && urole == 'fe') // fe krijgt geen Add knop. Als er dan ook ge

      function res_print()
      {
-        var wnd = window.open('../res/res_xml.asp?res_key=<%=rrr.reservering_key%>');
-        wnd.focus()
-        // doet de XSL maar: wnd.print();
+        FcltMgr.windowopen('../res/res_xml.asp?res_key=<%=rrr.reservering_key%>');
      }

      function res_mail()
@@ -599,7 +597,7 @@ if (options.length > 1) {
                       + "             FROM res_artikel ra1"
                       + "            WHERE ra1.res_discipline_key = rd.ins_discipline_key"
                       + "              AND ra1.res_artikel_key = " + res_artikel_key + ")"
-                     : "")                     
+                     : "")
                   + (res_ruimte_key > 0 // Alleen die activiteitsoorten die mogelijk zijn in deze ruimte.
                     ? " AND sa.res_srtactiviteit_key IN (SELECT rs.res_srtactiviteit_key"
                       + "                                  FROM res_ruimte rr"
--- a/APPL/RES/res_show_rsv_ruimte.asp
+++ b/APPL/RES/res_show_rsv_ruimte.asp
@@ -276,15 +276,12 @@ FCLTHeader.Requires({plugins: ["jQuery"]})
        // Share&Meet in een IFRAME gaf anders session expired
        // TODO: Conditioneel maken
        url += "<%= "&fac_id=" + customerId + "&userauth=" + user_key + "&userhmac=" + safe.url(protectHMAC.create(String(user_key))) %>";
-        var wnd = window.open(url);
-        try { wnd.focus() } catch(e) {};
-        // doet de XSL maar: wnd.print();
+        FcltMgr.windowopen(url);
      }

      function res_outlook()
      {
-        var wnd = window.open('../res/res_outlook.asp?res_key=<%=rrr.reservering_key%>&print_rsv_ruimte_key=<%=rsv_ruimte_key%>');
-        wnd.focus()
+        FcltMgr.windowopen('../res/res_outlook.asp?res_key=<%=rrr.reservering_key%>&print_rsv_ruimte_key=<%=rsv_ruimte_key%>');
      }

      function resNoShow(row)
@@ -318,8 +315,7 @@ FCLTHeader.Requires({plugins: ["jQuery"]})
      function res_touch()
      {
        var url = '../pda/reserveringen.asp?res_ruimte_key=<%=rrr.res_ruimte_key%>&qrc=1';
-        var wnd = window.open(url);
-        try { wnd.focus() } catch(e) {};
+        FcltMgr.windowopen(url);
      }

      function fac_like()
@@ -334,8 +330,7 @@ FCLTHeader.Requires({plugins: ["jQuery"]})

      function res_info(url)
      {
-        var wnd = window.open(url);
-        try { wnd.focus() } catch(e) {};
+        FcltMgr.windowopen(url);
      }
    </script>
  </head>
--- a/APPL/SCF/scaffolding_show.inc
+++ b/APPL/SCF/scaffolding_show.inc
@@ -211,12 +211,12 @@ function scaffolding_show(model, scf_params)
            %>
            function scf_export(key)
            {
-                window.open(url); // Doet automatisch een GET
+                FcltMgr.windowopen(url); // Doet automatisch een GET
            }

            function scf_print()
            {
-                window.open("<%=scf_params.this_fullpath%>?mode=print&id=<%=key%><%=transit%>");
+                FcltMgr.windowopen("<%=scf_params.this_fullpath%>?mode=print&id=<%=key%><%=transit%>");
            }
        </script>
      </head>
--- a/APPL/SLE/sle_show_srtdeel.asp
+++ b/APPL/SLE/sle_show_srtdeel.asp
@@ -53,7 +53,7 @@ oRs.close();
    <script type="text/javascript">
      function sle_print()
      {
-        window.open('./ins_srtdeel_xml.asp?ins_srtdeel_key=' + <%=ins_srtdeel_key%>);
+        FcltMgr.windowopen('./ins_srtdeel_xml.asp?ins_srtdeel_key=' + <%=ins_srtdeel_key%>);
      }

      function sle_change()
--- a/APPL/Shared/BijlagenForm.asp
+++ b/APPL/Shared/BijlagenForm.asp
@@ -302,7 +302,7 @@ if (fso.FolderExists(params.AttachPath))
                else
                { %>
                  <div id="filename">
-                  <a href="#" onclick='parent.window.open("<%=protectQS.create(OpenFlexFile(fileArray[i].vFileName)+"&doSave=1")%>").focus(); return false;'>
+                  <a href="#" onclick='parent.FcltMgr.windowopen("<%=protectQS.create(OpenFlexFile(fileArray[i].vFileName)+"&doSave=1")%>"); return false;'>
                    <%=safe.html(fileArray[i].vFileName)%>
                  </a>
                </div>
--- a/APPL/Shared/iface.inc
+++ b/APPL/Shared/iface.inc
@@ -281,7 +281,7 @@ function ROFIELD(pclass, plabel, pvalue, params)

    if (params.infoPointer.NewWindow)
    {
-        var fnclick = "window.open(\"" + safe.jsstring(prot_url) + "\")";
+        var fnclick = "FcltMgr.windowopen(\"" + safe.jsstring(prot_url) + "\")";
    }
    else if (params.infoPointer.Modal)
    {
--- a/APPL/Shared/kenmerk_common.inc
+++ b/APPL/Shared/kenmerk_common.inc
@@ -113,7 +113,7 @@ function BijlagenButton(pModule, pNiveau, pKey, tmpfolder, pKenmerk_key,
                var href = protectQS.create(OpenFlexFile(pModule, pNiveau, pKey, pKenmerk_key, lijst[file]));
            //var html = "<a href='" + safe.htmlattr(href) + "' target='_new'>" + safe.html(lijst[file]) + "</a>";
            var html = '<span class="details fldflexM" " readonly=1'
-                     + ' onclick=\'window.open("' + safe.jsstring(href) + '")\'>' + safe.html(lijst[file]) + '</span>';
+                     + ' onclick=\'FcltMgr.windowopen("' + safe.jsstring(href) + '")\'>' + safe.html(lijst[file]) + '</span>';

           filehtmlarr.push(html);
        }
@@ -992,9 +992,9 @@ function listKenmerk(sql, module, key, props)
          else if (readonlyfield && val && !missing) // rechtstreeks openen
          {
            if (kdim == 'xxx')
-                var fnclick = "parent.window.open('" + protectQS.create(OpenFlexFile(module, niveau, key, kkey, val, { mime_type: "image/png", contentdp: "inline" })) + "')";
+                var fnclick = "parent.FcltMgr.windowopen('" + protectQS.create(OpenFlexFile(module, niveau, key, kkey, val, { mime_type: "image/png", contentdp: "inline" })) + "')";
            else
-                var fnclick = "parent.window.open('" + protectQS.create(OpenFlexFile(module, niveau, key, kkey, val)) + "')";
+                var fnclick = "parent.FcltMgr.windowopen('" + protectQS.create(OpenFlexFile(module, niveau, key, kkey, val)) + "')";
            kvClick = " onclick='" + safe.htmlattr(fnclick) + "'";
          }
          else if (readonlyfield && val && missing) // Waarschuwen
--- a/APPL/Shared/kenmerk_js.asp
+++ b/APPL/Shared/kenmerk_js.asp
@@ -172,15 +172,13 @@ function checkKenmerk(field, show, ktype, klen, kdec, kmin, kmax)
 // Poweruser IE feature: Ctrl ingedrukt opent DWF bestanden toch 'gewoon'
 function openDoc(filepath)
 {
-  var fwnd;
 <%if (S("view_dwf_with_slnkdwf"))
  { %>
    if (!(window.event && event.ctrlKey) && filepath.toUpperCase().match('.DWF'))
-      fwnd = window.open("../SLNKDwf/ShowDWF.asp?relfile=" + filepath,'facDoc',"");
+      FcltMgr.windowopen("../SLNKDwf/ShowDWF.asp?relfile=" + filepath,'facDoc',"");
    else
 <%} %>
-      fwnd = window.open(filepath, 'facDoc', "");
-  try { fwnd.focus(); } catch (e) { };
+      FcltMgr.windowopen(filepath, 'facDoc', "");
 }

 //Data komt terug van de closeModal
--- a/APPL/Shared/logger.js
+++ b/APPL/Shared/logger.js
@@ -9,7 +9,7 @@
 function showSQL(sql)
 {
    window.genericsql = sql;
-    var url = "../mgt/mgt_genericsql.asp?sql=opener";
+    var url = "../mgt/mgt_genericsql.asp?sql=opener"; // requires window.opener and is safe
    window.open(url);
 }

--- a/APPL/Shared/resultset_table_v2.inc
+++ b/APPL/Shared/resultset_table_v2.inc
@@ -93,7 +93,7 @@ var postformHTML = '';
 if (Request.ServerVariables("REQUEST_METHOD") == "POST")
 {
   var postformHTML = '<div id=\"postform\">'
-                    + '<form id=\"printform\" name=\"printform\" target=\"_blank\" method=\"post\">'
+                    + '<form id=\"printform\" name=\"printform\" target=\"_blank\" rel=\"noopener noreferrer\" method=\"post\">'
                    + '<input type=\"hidden\" id=\"outputmode\" name=\"outputmode\" value=\"0\">' // input outputmode wordt gezet in doOutput()
                    + '<input type=\"hidden\" id=\"autosortby\" name=\"autosortby\" value=\"0\">' // input autosortby wordt gezet in doOutput()
                    + '<input type=\"hidden\" id=\"showall\" name=\"showall\" value=\"1\">';
--- a/APPL/Shared/show_foto.asp
+++ b/APPL/Shared/show_foto.asp
@@ -47,9 +47,8 @@ oRs.close();
    <script type="text/javascript">
      function ShowPicture(imageName)
      {
-        newWindow = window.open(imageName, "newWindow", "resizable=yes, scrollbars=yes");
+        newWindow = FcltMgr.windowopen(imageName, "newWindow", "resizable=yes, scrollbars=yes");
      	newWindow.document.close();
-      	newWindow.focus();
      }
    </script>
  </head>
--- a/APPL/SlnkDwf/ToonIMG.js
+++ b/APPL/SlnkDwf/ToonIMG.js
@@ -649,8 +649,7 @@ function onPrintEv(evt)
 {
    if (!evt) evt=window.event;

-    var newWindow = window.open("PrintEmbedded.asp?qryWhat="+escape(qryWhat));
-    newWindow.focus();
+    FcltMgr.windowopen("PrintEmbedded.asp?qryWhat="+escape(qryWhat));
    return;
 }

@@ -662,8 +661,7 @@ function onPrint(evt)
    if (!evt) evt=window.event;
    if (evt.ctrlKey && isDwfViewerInstalled)
    {
-        newWindow = window.open("PrintEmbedded.asp?qryWhat="+escape(qryWhat));
-        newWindow.focus();
+        FcltMgr.windowopen("PrintEmbedded.asp?qryWhat="+escape(qryWhat));
        return;
    }
    if (_FireEvent("onPrint"))
@@ -686,8 +684,7 @@ function PrintDialog_callback(printParams)
                          + "&sheetsY=" + printParams.sheetsY
                          + "&img="+escape(qryWhat + gSLNKEvent.qryDWGSize + "&ForPrint=1") ;

-    newWindow = window.open(qryPrint);
-    newWindow.focus();
+    FcltMgr.windowopen(qryPrint);
 }

 function PrintDialog(evt)