L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-11494 MDL-13623 - support for secure and httponly cookies; merged from MOODLE_19_STABLE

Browse Source
This commit is contained in:
skodak
2008-02-24 12:46:37 +00:00
parent a90e92a538
commit 4ea8df2173
4 changed files with 20 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/setup.php
+10 -2
View File
@@ -488,6 +488,14 @@ global $HTTPSPAGEREQUIRED;
/// Load up global environment variables
if (!isset($CFG->cookiesecure) or strpos($CFG->wwwroot, 'https://') !== 0) {
$CFG->cookiesecure = false;
}
if (!isset($CFG->cookiehttponly)) {
$CFG->cookiehttponly = false;
}
//discard session ID from POST, GET and globals to tighten security,
//this session fixation prevention can not be used in cookieless mode
if (empty($CFG->usesid)) {
@@ -509,7 +517,7 @@ global $HTTPSPAGEREQUIRED;
if (empty($nomoodlecookie)) {
session_name('MoodleSession'.$CFG->sessioncookie);
session_set_cookie_params(0, $CFG->sessioncookiepath);
session_set_cookie_params(0, $CFG->sessioncookiepath, '', $CFG->cookiesecure, $CFG->cookiehttponly);
@session_start();
if (! isset($_SESSION['SESSION'])) {
$_SESSION['SESSION'] = new object;
@@ -517,7 +525,7 @@ global $HTTPSPAGEREQUIRED;
if (!empty($_COOKIE['MoodleSessionTest'.$CFG->sessioncookie])) {
$_SESSION['SESSION']->has_timed_out = true;
}
setcookie('MoodleSessionTest'.$CFG->sessioncookie, $_SESSION['SESSION']->session_test, 0, $CFG->sessioncookiepath);
setcookie('MoodleSessionTest'.$CFG->sessioncookie, $_SESSION['SESSION']->session_test, 0, $CFG->sessioncookiepath, '', $CFG->cookiesecure, $CFG->cookiehttponly);
$_COOKIE['MoodleSessionTest'.$CFG->sessioncookie] = $_SESSION['SESSION']->session_test;
}
if (! isset($_SESSION['USER'])) {