Attachment 13580 Details for Bug 9102 – Bug 9102 : Set HttpOnly on the CGISESSID cookie

[patch] Bug 9102 : Set HttpOnly on the CGISESSID cookie

Bug-9102--Set-HttpOnly-on-the-CGISESSID-cookie.patch (text/plain), 3.00 KB, created by Kyle M Hall (khall) on 2012-11-21 13:40:11 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kyle M Hall (khall)

Created: 2012-11-21 13:40:11 UTC

Size: 3.00 KB

patch

obsolete

>From 5c10cfcad67a1c71de0563b07c77f66d936eb463 Mon Sep 17 00:00:00 2001
>From: Chris Cormack <chrisc@catalyst.net.nz>
>Date: Sun, 18 Nov 2012 20:01:37 +1300
>Subject: [PATCH] Bug 9102 : Set HttpOnly on the CGISESSID cookie
>Content-Type: text/plain; charset="utf-8"
>
>Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
>---
> C4/Auth.pm |   32 +++++++++++++++++++++++---------
> 1 files changed, 23 insertions(+), 9 deletions(-)
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index 705eda0..2ae23f8 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -633,13 +633,15 @@ sub checkauth {
>     if ( $userid = $ENV{'REMOTE_USER'} ) {
>         # Using Basic Authentication, no cookies required
>         $cookie = $query->cookie(
>-            -name    => 'CGISESSID',
>-            -value   => '',
>-            -expires => ''
>+            -name     => 'CGISESSID',
>+            -value    => '',
>+            -expires  => '',
>+            -HttpOnly => 1,
>         );
>         $loggedin = 1;
>     }
>-    elsif ( $sessionID = $query->cookie("CGISESSID")) {     # assignment, not comparison
>+    elsif ( $sessionID = $query->cookie("CGISESSID") )
>+    {    # assignment, not comparison
>         my $session = get_session($sessionID);
>         C4::Context->_new_userenv($sessionID);
>         my ($ip, $lasttime, $sessiontype);
>@@ -705,8 +707,12 @@ sub checkauth {
>             $userid    = undef;
>         }
>         else {
>-            $cookie = $query->cookie( CGISESSID => $session->id );
>-            $session->param('lasttime',time());
>+            $cookie = $query->cookie(
>+                -name     => 'CGISESSID',
>+                -value    => $session->id,
>+                -HttpOnly => 1
>+            );
>+            $session->param( 'lasttime', time() );
>             unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
>                 $flags = haspermission($userid, $flagsrequired);
>                 if ($flags) {
>@@ -722,8 +728,12 @@ sub checkauth {
>         my $session = get_session("") or die "Auth ERROR: Cannot get_session()";
>         my $sessionID = $session->id;
>         C4::Context->_new_userenv($sessionID);
>-        $cookie = $query->cookie( CGISESSID => $sessionID );
>-        $userid = $query->param('userid');
>+        $cookie = $query->cookie(
>+            -name     => 'CGISESSID',
>+            -value    => $session->id,
>+            -HttpOnly => 1
>+        );
>+    $userid = $query->param('userid');
>         if (   ( $cas && $query->param('ticket') )
>             || $userid
>             || ( my $pki_field = C4::Context->preference('AllowPKIAuth') ) ne
>@@ -914,7 +924,11 @@ sub checkauth {
>     {
>         # successful login
>         unless ($cookie) {
>-            $cookie = $query->cookie( CGISESSID => '' );
>+            $cookie = $query->cookie(
>+                -name     => 'CGISESSID',
>+                -value    => '',
>+                -HttpOnly => 1
>+            );
>         }
>         return ( $userid, $cookie, $sessionID, $flags );
>     }
>-- 
>1.7.2.5

Actions: View | Diff | Splinter Review

Attachments on bug 9102: 13504 | 13539 | 13580 | 13838 | 14384 | 14618 | 14994