@@ -, +, @@ HTTPS --- C4/Auth.pm | 16 ++++++++++++---- C4/InstallAuth.pm | 8 ++++++-- 2 files changed, 18 insertions(+), 6 deletions(-) --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -229,6 +229,7 @@ sub get_template_and_user { -value => '', -expires => '', -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); $template->param( @@ -829,6 +830,7 @@ sub checkauth { -value => '', -expires => '', -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); $loggedin = 1; } @@ -929,7 +931,8 @@ sub checkauth { $cookie = $query->cookie( -name => 'CGISESSID', -value => $session->id, - -HttpOnly => 1 + -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); $session->param( 'lasttime', time() ); unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... @@ -958,7 +961,8 @@ sub checkauth { $cookie = $query->cookie( -name => 'CGISESSID', -value => $session->id, - -HttpOnly => 1 + -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); my $pki_field = C4::Context->preference('AllowPKIAuth'); if ( !defined($pki_field) ) { @@ -1124,7 +1128,8 @@ sub checkauth { $cookie = $query->cookie( -name => 'CGISESSID', -value => '', - -HttpOnly => 1 + -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); $info{'wrongip'} = 1; } @@ -1202,7 +1207,8 @@ sub checkauth { $cookie = $query->cookie( -name => 'CGISESSID', -value => '', - -HttpOnly => 1 + -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); } @@ -1469,6 +1475,7 @@ sub check_api_auth { -name => 'CGISESSID', -value => $session->id, -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); $session->param( 'lasttime', time() ); my $flags = haspermission( $userid, $flagsrequired ); @@ -1523,6 +1530,7 @@ sub check_api_auth { -name => 'CGISESSID', -value => $sessionID, -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); if ( $return == 1 ) { my ( --- a/C4/InstallAuth.pm +++ a/C4/InstallAuth.pm @@ -266,6 +266,7 @@ sub checkauth { -name => 'CGISESSID', -value => $session->id, -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); $loggedin = 1; $userid = $session->param('cardnumber'); @@ -306,6 +307,7 @@ sub checkauth { -name => 'CGISESSID', -value => $sessionID, -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); if ( $return == 2 ) { @@ -351,7 +353,8 @@ sub checkauth { -name => 'CGISESSID', -value => '', -HttpOnly => 1, - -expires => '' + -expires => '', + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); } if ($envcookie) { @@ -393,7 +396,8 @@ sub checkauth { -name => 'CGISESSID', -value => $sessionID, -HttpOnly => 1, - -expires => '' + -expires => '', + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); print $query->header( -type => 'text/html; charset=utf-8', --