From e03f8ccb0e7ec6379c18d4115684ff5aba835c30 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Mon, 3 Dec 2012 11:17:27 +0100 Subject: [PATCH] Bug 9102 : Followup Set HttpOnly on the CGISESSID cookie --- C4/Auth.pm | 29 +++++++++++++++++++---------- C4/Templates.pm | 1 + cataloguing/additem.pl | 1 + installer/InstallAuth.pm | 14 ++++++++++++-- 4 files changed, 33 insertions(+), 12 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 2ae23f8..e1530e8 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -264,12 +264,13 @@ sub get_template_and_user { $_->{'time'}, ) foreach @recentSearches; - # And then, delete the cookie's content - my $newsearchcookie = $in->{'query'}->cookie( - -name => 'KohaOpacRecentSearches', - -value => freeze([]), - -expires => '' - ); + # And then, delete the cookie's content + my $newsearchcookie = $in->{'query'}->cookie( + -name => 'KohaOpacRecentSearches', + -value => freeze([]), + -HttpOnly => 1, + -expires => '' + ); $cookie = [$cookie, $newsearchcookie]; } } @@ -630,8 +631,8 @@ sub checkauth { # when using authentication against multiple CAS servers, as configured in Auth_cas_servers.yaml my $casparam = $query->param('cas'); - if ( $userid = $ENV{'REMOTE_USER'} ) { - # Using Basic Authentication, no cookies required + if ( $userid = $ENV{'REMOTE_USER'} ) { + # Using Basic Authentication, no cookies required $cookie = $query->cookie( -name => 'CGISESSID', -value => '', @@ -1138,7 +1139,11 @@ sub check_api_auth { $sessionID = undef; return ("expired", undef, undef); } else { - my $cookie = $query->cookie( CGISESSID => $session->id ); + my $cookie = $query->cookie( + -name => 'CGISESSID', + -value => $session->id, + -HttpOnly => 1, + ); $session->param('lasttime',time()); my $flags = haspermission($userid, $flagsrequired); if ($flags) { @@ -1182,7 +1187,11 @@ sub check_api_auth { my $sessionID = $session->id; C4::Context->_new_userenv($sessionID); - my $cookie = $query->cookie(CGISESSID => $sessionID); + my $cookie = $query->cookie( + -name => 'CGISESSID', + -value => $sessionID, + -HttpOnly => 1, + ); if ( $return == 1 ) { my ( $borrowernumber, $firstname, $surname, diff --git a/C4/Templates.pm b/C4/Templates.pm index 507e077..78dcddd 100644 --- a/C4/Templates.pm +++ b/C4/Templates.pm @@ -305,6 +305,7 @@ sub setlanguagecookie { my $cookie = $query->cookie( -name => 'KohaOpacLanguage', -value => $language, + -HttpOnly => 1, -expires => '+3y' ); print $query->redirect( diff --git a/cataloguing/additem.pl b/cataloguing/additem.pl index 79a717c..43a99f7 100755 --- a/cataloguing/additem.pl +++ b/cataloguing/additem.pl @@ -419,6 +419,7 @@ if ($op eq "additem") { -name => 'LastCreatedItem', # We uri_escape the whole freezed structure so we're sure we won't have any encoding problems -value => uri_escape_utf8( freeze( $record ) ), + -HttpOnly => 1, -expires => '' ); diff --git a/installer/InstallAuth.pm b/installer/InstallAuth.pm index 5b99c1f..0015a14 100644 --- a/installer/InstallAuth.pm +++ b/installer/InstallAuth.pm @@ -262,7 +262,11 @@ sub checkauth { $session->param('emailaddress'), $session->param('branchprinter') ); - $cookie = $query->cookie( CGISESSID => $session->id ); + $cookie = $query->cookie( + -name => 'CGISESSID', + -value => $session->id, + -HttpOnly => 1, + ); $loggedin = 1; $userid = $session->param('cardnumber'); } @@ -298,7 +302,11 @@ sub checkauth { # printf L "%20s from %16s logged in at %30s.\n", $userid, # $ENV{'REMOTE_ADDR'}, $time; # close L; - $cookie = $query->cookie( CGISESSID => $sessionID ); + $cookie = $query->cookie( + -name => 'CGISESSID', + -value => $sessionID, + -HttpOnly => 1, + ); if ( $return == 2 ) { #Only superlibrarian should have access to this page. @@ -342,6 +350,7 @@ sub checkauth { $cookie = $query->cookie( -name => 'CGISESSID', -value => '', + -HttpOnly => 1, -expires => '' ); } @@ -382,6 +391,7 @@ sub checkauth { $cookie = $query->cookie( -name => 'CGISESSID', -value => $sessionID, + -HttpOnly => 1, -expires => '' ); print $query->header( -- 1.7.10.4