erp5_crm: show attachments having filename only in EmailDocument_viewAttachmentListRenderer.

also add rel="noopener noreferrer" for security.

bt5/erp5_crm/SkinTemplateItem/portal_skins/erp5_crm/EmailDocument_viewAttachmentListRenderer.zpt

-<tal:block tal:define="information_list here/getAttachmentInformationList">
+<tal:block tal:define="information_list python: [x for x in here.getAttachmentInformationList() if x['filename'] != x['uid']]">
   <ul>
     <li tal:repeat="information information_list">
-      <a target="_blank" tal:content="information/filename | information/uid" tal:attributes="href python:'%s/getAttachmentData?index:int=%s' % (context.absolute_url(), information['index'])"/>
+      <a target="_blank" rel="noopener noreferrer" tal:content="information/filename | information/uid" tal:attributes="href python:'%s/getAttachmentData?index:int=%s' % (context.absolute_url(), information['index'])"/>
       (<tal:block tal:content="information/content_type" />)
     </li>
   </ul>

[Romain Courteaud]

To reduce XSS attack vectors, getAttachmentData must always be returned with the Content-Disposition: attachment header.

Even when the part does not contain a filename (which is not the case currently)

Instead of using target="_blank", why don't we use the download attribute, which is more user friendly has it does not open a blank tab.