L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-29312 prevent cookieless mode for security reasons

Browse Source
This commit is contained in:
Petr Skoda
2011-09-11 10:09:14 +02:00
parent 4f65f98942
commit f0a75425cb
2 changed files with 4 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/sessionlib.php
+4 -7
View File
@@ -106,7 +106,7 @@ abstract class session_stub implements moodle_session {
if (NO_MOODLE_COOKIES) {
// session not used at all
$CFG->usesid = 0;
$CFG->usesid = false;
$_SESSION = array();
$_SESSION['SESSION'] = new stdClass();
@@ -118,12 +118,9 @@ abstract class session_stub implements moodle_session {
$newsession = empty($_COOKIE['MoodleSession'.$CFG->sessioncookie]);
if (!empty($CFG->usesid) && $newsession) {
sid_start_ob();
} else {
$CFG->usesid = 0;
ini_set('session.use_trans_sid', '0');
}
// cookieless mode is prevented for security reasons
$CFG->usesid = false;
ini_set('session.use_trans_sid', '0');
session_name('MoodleSession'.$CFG->sessioncookie);
session_set_cookie_params(0, $CFG->sessioncookiepath, $CFG->sessioncookiedomain, $CFG->cookiesecure, $CFG->cookiehttponly);