Bugzilla – Attachment 106176 Details for
Bug 25360
Use secure flag for CGISESSID cookie
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 25360: Use secure flag for CGISESSID cookie when using HTTPS
Bug-25360-Use-secure-flag-for-CGISESSID-cookie-whe.patch (text/plain), 4.65 KB, created by
David Cook
on 2020-06-23 06:25:11 UTC
(
hide
)
Description:
Bug 25360: Use secure flag for CGISESSID cookie when using HTTPS
Filename:
MIME Type:
Creator:
David Cook
Created:
2020-06-23 06:25:11 UTC
Size:
4.65 KB
patch
obsolete
>From 8621b33e1cd7b5ee610327e64f3cca3361cd789a Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Mon, 4 May 2020 11:12:26 +1000 >Subject: [PATCH] Bug 25360: Use secure flag for CGISESSID cookie when using > HTTPS > >This patch adds the secure flag to the CGISESSID cookie when using HTTPS. >This prevents the cookie being used again over a normal HTTP >request. >--- > C4/Auth.pm | 16 ++++++++++++---- > C4/InstallAuth.pm | 8 ++++++-- > 2 files changed, 18 insertions(+), 6 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 6889c2532c..7b8c522edb 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -229,6 +229,7 @@ sub get_template_and_user { > -value => '', > -expires => '', > -HttpOnly => 1, >+ -secure => ( $ENV{HTTPS} ? 1 : 0 ), > ); > > $template->param( >@@ -829,6 +830,7 @@ sub checkauth { > -value => '', > -expires => '', > -HttpOnly => 1, >+ -secure => ( $ENV{HTTPS} ? 1 : 0 ), > ); > $loggedin = 1; > } >@@ -929,7 +931,8 @@ sub checkauth { > $cookie = $query->cookie( > -name => 'CGISESSID', > -value => $session->id, >- -HttpOnly => 1 >+ -HttpOnly => 1, >+ -secure => ( $ENV{HTTPS} ? 1 : 0 ), > ); > $session->param( 'lasttime', time() ); > unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... >@@ -958,7 +961,8 @@ sub checkauth { > $cookie = $query->cookie( > -name => 'CGISESSID', > -value => $session->id, >- -HttpOnly => 1 >+ -HttpOnly => 1, >+ -secure => ( $ENV{HTTPS} ? 1 : 0 ), > ); > my $pki_field = C4::Context->preference('AllowPKIAuth'); > if ( !defined($pki_field) ) { >@@ -1124,7 +1128,8 @@ sub checkauth { > $cookie = $query->cookie( > -name => 'CGISESSID', > -value => '', >- -HttpOnly => 1 >+ -HttpOnly => 1, >+ -secure => ( $ENV{HTTPS} ? 1 : 0 ), > ); > $info{'wrongip'} = 1; > } >@@ -1202,7 +1207,8 @@ sub checkauth { > $cookie = $query->cookie( > -name => 'CGISESSID', > -value => '', >- -HttpOnly => 1 >+ -HttpOnly => 1, >+ -secure => ( $ENV{HTTPS} ? 1 : 0 ), > ); > } > >@@ -1469,6 +1475,7 @@ sub check_api_auth { > -name => 'CGISESSID', > -value => $session->id, > -HttpOnly => 1, >+ -secure => ( $ENV{HTTPS} ? 1 : 0 ), > ); > $session->param( 'lasttime', time() ); > my $flags = haspermission( $userid, $flagsrequired ); >@@ -1523,6 +1530,7 @@ sub check_api_auth { > -name => 'CGISESSID', > -value => $sessionID, > -HttpOnly => 1, >+ -secure => ( $ENV{HTTPS} ? 1 : 0 ), > ); > if ( $return == 1 ) { > my ( >diff --git a/C4/InstallAuth.pm b/C4/InstallAuth.pm >index 987045df50..8d4d95377a 100644 >--- a/C4/InstallAuth.pm >+++ b/C4/InstallAuth.pm >@@ -266,6 +266,7 @@ sub checkauth { > -name => 'CGISESSID', > -value => $session->id, > -HttpOnly => 1, >+ -secure => ( $ENV{HTTPS} ? 1 : 0 ), > ); > $loggedin = 1; > $userid = $session->param('cardnumber'); >@@ -306,6 +307,7 @@ sub checkauth { > -name => 'CGISESSID', > -value => $sessionID, > -HttpOnly => 1, >+ -secure => ( $ENV{HTTPS} ? 1 : 0 ), > ); > if ( $return == 2 ) { > >@@ -351,7 +353,8 @@ sub checkauth { > -name => 'CGISESSID', > -value => '', > -HttpOnly => 1, >- -expires => '' >+ -expires => '', >+ -secure => ( $ENV{HTTPS} ? 1 : 0 ), > ); > } > if ($envcookie) { >@@ -393,7 +396,8 @@ sub checkauth { > -name => 'CGISESSID', > -value => $sessionID, > -HttpOnly => 1, >- -expires => '' >+ -expires => '', >+ -secure => ( $ENV{HTTPS} ? 1 : 0 ), > ); > print $query->header( > -type => 'text/html; charset=utf-8', >-- >2.16.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 25360
:
104244
|
104469
|
104470
|
104642
|
106176
|
106177
|
106178
|
107833
|
107834
|
108161
|
108162