diff --git a/frappe/core/page/permission_manager/permission_manager_help.html b/frappe/core/page/permission_manager/permission_manager_help.html
index 9c88fbcd01..d2f4136082 100644
--- a/frappe/core/page/permission_manager/permission_manager_help.html
+++ b/frappe/core/page/permission_manager/permission_manager_help.html
@@ -36,6 +36,6 @@
 		<li>{%= __("Apart from System Manager, roles with Set User Permissions right can set permissions for other users for that Document Type.") %}</li>
 	</ol>
     <p>{%= __("If these instructions where not helpful, please add in your suggestions on GitHub Issues.") %}
-    	 <a href="https://github.com/frappe/frappe/issues" target="_blank">{%= __("Submit an Issue") %}</a>
+    	 <a href="https://github.com/frappe/frappe/issues" target="_blank" rel="noopener noreferrer">{%= __("Submit an Issue") %}</a>
     </p>
 </div>
diff --git a/frappe/desk/page/applications/application_row.html b/frappe/desk/page/applications/application_row.html
index 3d04c40349..bac68e2d60 100644
--- a/frappe/desk/page/applications/application_row.html
+++ b/frappe/desk/page/applications/application_row.html
@@ -5,7 +5,7 @@
 	<div class="media">
 		<div class="pull-right app-buttons">
 			<a class="btn btn-default btn-xs"
-                href="{{ app.app_url }}" target="_blank">{{ __("Website") }}</a>
+                href="{{ app.app_url }}" target="_blank" rel="noopener noreferrer">{{ __("Website") }}</a>
 			{% if (app.installed) { %}
 			<button class="btn btn-danger btn-xs btn-remove"
                 data-title="{{ app.app_title }}"
diff --git a/frappe/desk/page/backups/backups.html b/frappe/desk/page/backups/backups.html
index dca38315cc..0056b6814b 100644
--- a/frappe/desk/page/backups/backups.html
+++ b/frappe/desk/page/backups/backups.html
@@ -21,7 +21,7 @@
                 {{ f[1] }}
             </td>
             <td>
-                <a href="{{ f[0] }}" target="_blank">{{ f[0] }}</a>
+                <a href="{{ f[0] }}" target="_blank" rel="noopener noreferrer">{{ f[0] }}</a>
             </td>
             <td>
                 {{ f[2] }}
diff --git a/frappe/public/js/frappe/form/footer/timeline_item.html b/frappe/public/js/frappe/form/footer/timeline_item.html
index 214a18e33b..e30d330938 100755
--- a/frappe/public/js/frappe/form/footer/timeline_item.html
+++ b/frappe/public/js/frappe/form/footer/timeline_item.html
@@ -110,7 +110,7 @@
 					{% $.each(data.attachments, function(i, a) { %}
 					<div class="ellipsis">
 						<a href="{%= encodeURI(a.file_url).replace(/#/g, \'%23\') %}"
-							class="text-muted small" target="_blank">
+							class="text-muted small" target="_blank" rel="noopener noreferrer">
 							<i class="fa fa-paperclip"></i>
 							{%= a.file_url.split("/").slice(-1)[0] %}
 							{% if (a.is_private) { %}
diff --git a/frappe/public/js/frappe/misc/common.js b/frappe/public/js/frappe/misc/common.js
index eab3f8e6b2..c099ace141 100644
--- a/frappe/public/js/frappe/misc/common.js
+++ b/frappe/public/js/frappe/misc/common.js
@@ -4,7 +4,6 @@ frappe.avatar = function(user, css_class, title) {
 	if(user) {
 		// desk
 		var user_info = frappe.user_info(user);
-		var image = frappe.utils.get_file_link(user_info.image);
 	} else {
 		// website
 		user_info = {
diff --git a/frappe/public/js/frappe/query_string.js b/frappe/public/js/frappe/query_string.js
index adf494520b..6332181d76 100644
--- a/frappe/public/js/frappe/query_string.js
+++ b/frappe/public/js/frappe/query_string.js
@@ -23,7 +23,7 @@ function get_query_params(query_string) {
 		}
 
 		if (key in query_params) {
-			if (typeof query_params[key] === undefined) {
+			if (typeof query_params[key] === "undefined") {
 				query_params[key] = [];
 			} else if (typeof query_params[key] === "string") {
 				query_params[key] = [query_params[key]];
diff --git a/frappe/public/js/frappe/toolbar.js b/frappe/public/js/frappe/toolbar.js
index 55f8dc2f2e..a6a8931001 100755
--- a/frappe/public/js/frappe/toolbar.js
+++ b/frappe/public/js/frappe/toolbar.js
@@ -3,8 +3,6 @@
 
 $(document).on("toolbar_setup", function() {
 	var help_links = [];
-	var support_link = "#upgrade";
-	var chat_link = "#upgrade";
 	var limits = frappe.boot.limits;
 
 	if(frappe.boot.expiry_message) {
@@ -24,7 +22,7 @@ $(document).on("toolbar_setup", function() {
 	}
 
 	if(limits.support_email) {
-		support_link = 'mailto:'+frappe.boot.limits.support_email;
+		var support_link = 'mailto:'+frappe.boot.limits.support_email;
 		help_links.push('<li><a href="'+support_link+'">' + frappe._('Email Support') + '</a></li>');
 	}
 
diff --git a/frappe/public/js/frappe/ui/toolbar/navbar.html b/frappe/public/js/frappe/ui/toolbar/navbar.html
index a9f137e43e..fb49d558b3 100644
--- a/frappe/public/js/frappe/ui/toolbar/navbar.html
+++ b/frappe/public/js/frappe/ui/toolbar/navbar.html
@@ -28,7 +28,7 @@
 					    {%= __("My Settings") %}</a></li>
 					<li><a href="#" onclick="return frappe.ui.toolbar.clear_cache();">
 					    {%= __("Reload") %}</a></li>
-					<li><a href="/index" target="_blank">
+					<li><a href="/index" target="_blank" rel="noopener noreferrer">
 						{%= __("View Website") %}</a></li>
 					<li><a href="#background_jobs">
 						{%= __("Background Jobs") %}</a></li>
@@ -54,7 +54,7 @@
 					<li class="divider"></li>
 					<li>
 						<a data-link-type="documentation"
-							data-path="/documentation/index" target="_blank">{{ __("Documentation") }}</a>
+							data-path="/documentation/index" target="_blank" rel="noopener noreferrer">{{ __("Documentation") }}</a>
 					</li>
 					<li class="divider documentation-links"></li>
 					<li><a href="#" onclick="return frappe.ui.toolbar.show_about();">
diff --git a/frappe/public/js/frappe/views/reports/grid_report.js b/frappe/public/js/frappe/views/reports/grid_report.js
index 96a4e6182e..aa5d69d8c9 100644
--- a/frappe/public/js/frappe/views/reports/grid_report.js
+++ b/frappe/public/js/frappe/views/reports/grid_report.js
@@ -767,7 +767,6 @@ frappe.views.TreeGridReport = frappe.views.GridReportWithPlot.extend({
 	},
 	tree_formatter: function (row, cell, value, columnDef, dataContext) {
 		var me = frappe.cur_grid_report;
-		value = value.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;");
 		var data = me.data;
 		var spacer = "<span style='display:inline-block;height:1px;width:" +
 			(15 * dataContext["indent"]) + "px'></span>";
diff --git a/frappe/public/js/frappe/views/reports/query_report.js b/frappe/public/js/frappe/views/reports/query_report.js
index 789923d752..cde2ce9a0f 100644
--- a/frappe/public/js/frappe/views/reports/query_report.js
+++ b/frappe/public/js/frappe/views/reports/query_report.js
@@ -228,7 +228,6 @@ frappe.views.QueryReport = Class.extend({
 
 			//Render Report in HTML
 			var html = frappe.render_template("print_template", {
-				columns:columns,
 				content:content,
 				title:__(this.report_name),
 				base_url: base_url,
diff --git a/frappe/website/doctype/web_form/templates/web_form.html b/frappe/website/doctype/web_form/templates/web_form.html
index bd314ca7a2..a1cbbb0240 100644
--- a/frappe/website/doctype/web_form/templates/web_form.html
+++ b/frappe/website/doctype/web_form/templates/web_form.html
@@ -35,7 +35,7 @@
 	{%- if allow_print and not is_list and not _login_required -%}
 	<div class='text-right'>
 		<a class='text-muted small' href='/printview?doctype={{ doc.doctype}}&name={{ doc.name }}
-			{%- if print_format -%}&format={{ print_format }}{%- endif -%}' target="_blank">
+			{%- if print_format -%}&format={{ print_format }}{%- endif -%}' target="_blank" rel="noopener noreferrer">
 			<i class='fa fa-print'></i> {{ _("Print") }}</a>
 	</div>
 	{%- endif -%}
@@ -250,7 +250,7 @@
 	<div class="row">
 		<div class="col-sm-9">
 			<p class="text-muted">
-				<a class="btn btn-default btn-sm" href="{{ doc.route }}" target="_blank">
+				<a class="btn btn-default btn-sm" href="{{ doc.route }}" target="_blank" rel="noopener noreferrer">
 					{{ web_page_link_text }}</a>
 			</p>
 		</div>
diff --git a/frappe/website/js/web_form.js b/frappe/website/js/web_form.js
index 2457e1c15e..33e2ed3b87 100644
--- a/frappe/website/js/web_form.js
+++ b/frappe/website/js/web_form.js
@@ -166,7 +166,7 @@ frappe.ready(function() {
 			$(this).find('[data-child-row=1]').each(function() {
 				if(!$(this).hasClass('hidden')) {
 					frappe.mandatory_missing_in_last_doc = [];
-					var d = get_data_for_doctype($(this), doctype, true);
+					var d = get_data_for_doctype($(this), doctype);
 
 					// set name of child record (if set)
 					var name = $(this).attr('data-name');