Allow setting httponly on auth cookies.

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 9dde253..b0aef12 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -1496,6 +1496,7 @@ $wgCookieDomain = '';
 $wgCookiePath = '/';
 $wgCookieSecure = ($wgProto == 'https');
 $wgDisableCookieCheck = false;
+$wgCookieHttpOnly = true;
 
 /** A list of cookies that vary the cache (for use by extensions) */
 $wgCacheVaryCookies = array();

diff --git a/includes/User.php b/includes/User.php
index b3a839e..686a8f8 100644 (file)
--- a/includes/User.php
+++ b/includes/User.php
@@ -1968,20 +1968,20 @@ class User {
        }
 
        function setCookies() {
-               global $wgCookieExpiration, $wgCookiePath, $wgCookieDomain, $wgCookieSecure, $wgCookiePrefix;
+               global $wgCookieExpiration, $wgCookiePath, $wgCookieDomain, $wgCookieSecure, $wgCookiePrefix, $wgCookieHttpOnly;;
                $this->load();
                if ( 0 == $this->mId ) return;
                $exp = time() + $wgCookieExpiration;
 
                $_SESSION['wsUserID'] = $this->mId;
-               setcookie( $wgCookiePrefix.'UserID', $this->mId, $exp, $wgCookiePath, $wgCookieDomain, $wgCookieSecure );
+               setcookie( $wgCookiePrefix.'UserID', $this->mId, $exp, $wgCookiePath, $wgCookieDomain, $wgCookieSecure, $wgCookieHttpOnly );
 
                $_SESSION['wsUserName'] = $this->getName();
-               setcookie( $wgCookiePrefix.'UserName', $this->getName(), $exp, $wgCookiePath, $wgCookieDomain, $wgCookieSecure );
+               setcookie( $wgCookiePrefix.'UserName', $this->getName(), $exp, $wgCookiePath, $wgCookieDomain, $wgCookieSecure, $wgCookieHttpOnly );
 
                $_SESSION['wsToken'] = $this->mToken;
                if ( 1 == $this->getOption( 'rememberpassword' ) ) {
-                       setcookie( $wgCookiePrefix.'Token', $this->mToken, $exp, $wgCookiePath, $wgCookieDomain, $wgCookieSecure );
+                       setcookie( $wgCookiePrefix.'Token', $this->mToken, $exp, $wgCookiePath, $wgCookieDomain, $wgCookieSecure, $wgCookieHttpOnly );
                } else {
                        setcookie( $wgCookiePrefix.'Token', '', time() - 3600 );
                }