From febb7f9987c06b24e4779a6da089899badf46e92 Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Mon, 4 May 2020 11:12:26 +1000
Subject: [PATCH] Bug 25360: Use secure flag for CGISESSID cookie when using
 HTTPS

This patch adds the secure flag to the CGISESSID cookie when using HTTPS.
This prevents the cookie being used again over a normal HTTP
request.
---
 C4/Auth.pm        | 16 ++++++++++++----
 C4/InstallAuth.pm |  8 ++++++--
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 295eb27ece..95c03e4312 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -244,6 +244,7 @@ sub get_template_and_user {
                 -value    => '',
                 -expires  => '',
                 -HttpOnly => 1,
+                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
             );
 
             $template->param(
@@ -862,6 +863,7 @@ sub checkauth {
             -value    => '',
             -expires  => '',
             -HttpOnly => 1,
+            -secure => ( $ENV{HTTPS} ? 1 : 0 ),
         );
         $loggedin = 1;
     }
@@ -993,7 +995,8 @@ sub checkauth {
             $cookie = $query->cookie(
                 -name     => 'CGISESSID',
                 -value    => $session->id,
-                -HttpOnly => 1
+                -HttpOnly => 1,
+                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
             );
             $session->param( 'lasttime', time() );
             unless ( $sessiontype && $sessiontype eq 'anon' ) {    #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
@@ -1022,7 +1025,8 @@ sub checkauth {
         $cookie = $query->cookie(
             -name     => 'CGISESSID',
             -value    => $session->id,
-            -HttpOnly => 1
+            -HttpOnly => 1,
+            -secure => ( $ENV{HTTPS} ? 1 : 0 ),
         );
         my $pki_field = C4::Context->preference('AllowPKIAuth');
         if ( !defined($pki_field) ) {
@@ -1215,7 +1219,8 @@ sub checkauth {
                             $cookie = $query->cookie(
                                 -name     => 'CGISESSID',
                                 -value    => '',
-                                -HttpOnly => 1
+                                -HttpOnly => 1,
+                                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
                             );
                             $info{'wrongip'} = 1;
                         }
@@ -1304,7 +1309,8 @@ sub checkauth {
             $cookie = $query->cookie(
                 -name     => 'CGISESSID',
                 -value    => '',
-                -HttpOnly => 1
+                -HttpOnly => 1,
+                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
             );
         }
 
@@ -1720,6 +1726,7 @@ sub check_api_auth {
                     -name     => 'CGISESSID',
                     -value    => $session->id,
                     -HttpOnly => 1,
+                    -secure => ( $ENV{HTTPS} ? 1 : 0 ),
                 );
                 $session->param( 'lasttime', time() );
                 my $flags = haspermission( $userid, $flagsrequired );
@@ -1774,6 +1781,7 @@ sub check_api_auth {
                 -name     => 'CGISESSID',
                 -value    => $sessionID,
                 -HttpOnly => 1,
+                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
             );
             if ( $return == 1 ) {
                 my (
diff --git a/C4/InstallAuth.pm b/C4/InstallAuth.pm
index 67319b3db6..223ed2cb32 100644
--- a/C4/InstallAuth.pm
+++ b/C4/InstallAuth.pm
@@ -267,6 +267,7 @@ sub checkauth {
                 -name     => 'CGISESSID',
                 -value    => $session->id,
                 -HttpOnly => 1,
+                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
             );
             $loggedin = 1;
             $userid   = $session->param('cardnumber');
@@ -307,6 +308,7 @@ sub checkauth {
                 -name     => 'CGISESSID',
                 -value    => $sessionID,
                 -HttpOnly => 1,
+                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
             );
             if ( $return == 2 ) {
 
@@ -352,7 +354,8 @@ sub checkauth {
                 -name    => 'CGISESSID',
                 -value   => '',
                 -HttpOnly => 1,
-                -expires => ''
+                -expires => '',
+                -secure => ( $ENV{HTTPS} ? 1 : 0 ),
             );
         }
         if ($envcookie) {
@@ -394,7 +397,8 @@ sub checkauth {
         -name    => 'CGISESSID',
         -value   => $sessionID,
         -HttpOnly => 1,
-        -expires => ''
+        -expires => '',
+        -secure => ( $ENV{HTTPS} ? 1 : 0 ),
     );
     print $query->header(
         -type    => 'text/html; charset=utf-8',
-- 
2.16.4