diff options
| author | rvelices <rv-github@modusoptimus.com> | 2008-10-16 00:35:30 +0000 |
|---|---|---|
| committer | rvelices <rv-github@modusoptimus.com> | 2008-10-16 00:35:30 +0000 |
| commit | f7f8c1688ef30ecb2f40fe279ba34d250d4ec8be (patch) | |
| tree | 8d6fde76195c05586163fd33ed9df706367c30aa /include/functions_session.inc.php | |
| parent | 7807d6586a198c75e3d4f72c4b360bee061b817f (diff) | |
- security paranoia: protect session/remember me cookies from XSS attacks (works only if php>=5.2 and with IE/FF maybe others)
git-svn-id: http://piwigo.org/svn/branches/2.0@2756 68402e56-0260-453c-a942-63ccdbb3a9ee
Diffstat (limited to 'include/functions_session.inc.php')
| -rw-r--r-- | include/functions_session.inc.php | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/include/functions_session.inc.php b/include/functions_session.inc.php index dce1551ea..ed026a175 100644 --- a/include/functions_session.inc.php +++ b/include/functions_session.inc.php @@ -66,6 +66,7 @@ if (isset($conf['session_save_handler']) ini_set('session.use_cookies', $conf['session_use_cookies']); ini_set('session.use_only_cookies', $conf['session_use_only_cookies']); ini_set('session.use_trans_sid', intval($conf['session_use_trans_sid'])); + ini_set('session.cookie_httponly', 1); } session_name($conf['session_name']); session_set_cookie_params(0, cookie_path()); @@ -227,4 +228,4 @@ function pwg_unset_session_var($var) return true; } -?> +?>
\ No newline at end of file |