From 31e80b39fb20ad522ace6ebabe772336b8889cc9 Mon Sep 17 00:00:00 2001 From: Brion Vibber Date: Wed, 16 Apr 2008 23:06:51 +0000 Subject: [PATCH] Apply $wgCookieHttpOnly setting to the session cookie as well --- includes/GlobalFunctions.php | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/includes/GlobalFunctions.php b/includes/GlobalFunctions.php index 61e9e629dc..4dcc087950 100644 --- a/includes/GlobalFunctions.php +++ b/includes/GlobalFunctions.php @@ -2224,7 +2224,7 @@ function wfIsLocalURL( $url ) { * Initialise php session */ function wfSetupSession() { - global $wgSessionsInMemcached, $wgCookiePath, $wgCookieDomain, $wgCookieSecure; + global $wgSessionsInMemcached, $wgCookiePath, $wgCookieDomain, $wgCookieSecure, $wgCookieHttpOnly; if( $wgSessionsInMemcached ) { require_once( 'MemcachedSessions.php' ); } elseif( 'files' != ini_get( 'session.save_handler' ) ) { @@ -2232,7 +2232,13 @@ function wfSetupSession() { # application, it will end up failing. Try to recover. ini_set ( 'session.save_handler', 'files' ); } - session_set_cookie_params( 0, $wgCookiePath, $wgCookieDomain, $wgCookieSecure); + $httpOnlySafe = version_compare("5.2", PHP_VERSION, "<"); + if( $httpOnlySafe && $wgCookieHttpOnly ) { + session_set_cookie_params( 0, $wgCookiePath, $wgCookieDomain, $wgCookieSecure, $wgCookieHttpOnly ); + } else { + // PHP 5.1 throws warnings if you pass the HttpOnly parameter for 5.2. + session_set_cookie_params( 0, $wgCookiePath, $wgCookieDomain, $wgCookieSecure ); + } session_cache_limiter( 'private, must-revalidate' ); wfSuppressWarnings(); session_start(); -- 2.20.1