aboutsummaryrefslogtreecommitdiffstats
path: root/include/functions_session.inc.php
diff options
context:
space:
mode:
authorrvelices <rv-github@modusoptimus.com>2008-10-16 00:38:26 +0000
committerrvelices <rv-github@modusoptimus.com>2008-10-16 00:38:26 +0000
commitebc3c2e2f7d9408db7e5335d63fdd2a003c3d79a (patch)
treed2b00fb200eab5f807b6eac33e8e692031227a1b /include/functions_session.inc.php
parenteb667c7711d61d0c757f2202af6c2e61cba7d1ac (diff)
merge 2755 and 2756 from branch 2.0 to trunk
- 2755 fix vulnerability http://www.milw0rm.com/exploits/6755 - 2756 security paranoia: protect session/remember me cookies from XSS attacks (works only if php>=5.2 and with IE/FF maybe others) git-svn-id: http://piwigo.org/svn/trunk@2757 68402e56-0260-453c-a942-63ccdbb3a9ee
Diffstat (limited to '')
-rw-r--r--include/functions_session.inc.php3
1 files changed, 2 insertions, 1 deletions
diff --git a/include/functions_session.inc.php b/include/functions_session.inc.php
index dce1551ea..ed026a175 100644
--- a/include/functions_session.inc.php
+++ b/include/functions_session.inc.php
@@ -66,6 +66,7 @@ if (isset($conf['session_save_handler'])
ini_set('session.use_cookies', $conf['session_use_cookies']);
ini_set('session.use_only_cookies', $conf['session_use_only_cookies']);
ini_set('session.use_trans_sid', intval($conf['session_use_trans_sid']));
+ ini_set('session.cookie_httponly', 1);
}
session_name($conf['session_name']);
session_set_cookie_params(0, cookie_path());
@@ -227,4 +228,4 @@ function pwg_unset_session_var($var)
return true;
}
-?>
+?> \ No newline at end of file