From ebc3c2e2f7d9408db7e5335d63fdd2a003c3d79a Mon Sep 17 00:00:00 2001 From: rvelices Date: Thu, 16 Oct 2008 00:38:26 +0000 Subject: merge 2755 and 2756 from branch 2.0 to trunk - 2755 fix vulnerability http://www.milw0rm.com/exploits/6755 - 2756 security paranoia: protect session/remember me cookies from XSS attacks (works only if php>=5.2 and with IE/FF maybe others) git-svn-id: http://piwigo.org/svn/trunk@2757 68402e56-0260-453c-a942-63ccdbb3a9ee --- include/functions_session.inc.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include/functions_session.inc.php') diff --git a/include/functions_session.inc.php b/include/functions_session.inc.php index dce1551ea..ed026a175 100644 --- a/include/functions_session.inc.php +++ b/include/functions_session.inc.php @@ -66,6 +66,7 @@ if (isset($conf['session_save_handler']) ini_set('session.use_cookies', $conf['session_use_cookies']); ini_set('session.use_only_cookies', $conf['session_use_only_cookies']); ini_set('session.use_trans_sid', intval($conf['session_use_trans_sid'])); + ini_set('session.cookie_httponly', 1); } session_name($conf['session_name']); session_set_cookie_params(0, cookie_path()); @@ -227,4 +228,4 @@ function pwg_unset_session_var($var) return true; } -?> +?> \ No newline at end of file -- cgit v1.2.3