Bugzilla – Attachment 13504 Details for
Bug 9102
[SECURITY] We should set httponly on our session cookie
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 9102 : Set HttpOnly on the CGISESSID cookie
Bug-9102--Set-HttpOnly-on-the-CGISESSID-cookie.patch (text/plain), 2.04 KB, created by
Chris Cormack
on 2012-11-18 07:02:43 UTC
(
hide
)
Description:
Bug 9102 : Set HttpOnly on the CGISESSID cookie
Filename:
MIME Type:
Creator:
Chris Cormack
Created:
2012-11-18 07:02:43 UTC
Size:
2.04 KB
patch
obsolete
>From 9ef78060707dd9ce90b1874081d2a93b53789f35 Mon Sep 17 00:00:00 2001 >From: Chris Cormack <chrisc@catalyst.net.nz> >Date: Sun, 18 Nov 2012 20:01:37 +1300 >Subject: [PATCH] Bug 9102 : Set HttpOnly on the CGISESSID cookie > >--- > C4/Auth.pm | 18 ++++++++++++++---- > 1 file changed, 14 insertions(+), 4 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 705eda0..f771e41 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -635,7 +635,8 @@ sub checkauth { > $cookie = $query->cookie( > -name => 'CGISESSID', > -value => '', >- -expires => '' >+ -expires => '', >+ -HttpOnly => 1, > ); > $loggedin = 1; > } >@@ -705,7 +706,10 @@ sub checkauth { > $userid = undef; > } > else { >- $cookie = $query->cookie( CGISESSID => $session->id ); >+ $cookie = $query->cookie( >+ -name => 'CGISESSID', >+ -value => $session->id, >+ -HttpOnly => 1); > $session->param('lasttime',time()); > unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... > $flags = haspermission($userid, $flagsrequired); >@@ -722,7 +726,10 @@ sub checkauth { > my $session = get_session("") or die "Auth ERROR: Cannot get_session()"; > my $sessionID = $session->id; > C4::Context->_new_userenv($sessionID); >- $cookie = $query->cookie( CGISESSID => $sessionID ); >+ $cookie = $query->cookie( >+ -name => 'CGISESSID', >+ -value => $session->id, >+ -HttpOnly => 1); > $userid = $query->param('userid'); > if ( ( $cas && $query->param('ticket') ) > || $userid >@@ -914,7 +921,10 @@ sub checkauth { > { > # successful login > unless ($cookie) { >- $cookie = $query->cookie( CGISESSID => '' ); >+ $cookie = $query->cookie( >+ -name => 'CGISESSID', >+ -value => '', >+ -HttpOnly => 1); > } > return ( $userid, $cookie, $sessionID, $flags ); > } >-- >1.7.10.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 9102
:
13504
|
13539
|
13580
|
13838
|
14384
|
14618
|
14994