extern/egroupware
1
0
Fork 1
mirror of https://github.com/EGroupware/egroupware.git synced 2025-08-09 16:35:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

* Security: allow to configure SameSite cookie attribute

Browse Source
This commit is contained in:
Ralf Becker
2020-07-27 14:03:48 +02:00
parent 074b884133
commit ca73a54d89
2 changed files with 32 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
api/src/Session.php
View File

@ -1668,11 +1668,29 @@ class Session
if(!headers_sent()) // gives only a warning, but can not send the cookie anyway
{
setcookie($cookiename, $cookievalue,
!$cookietime && $is_iOS ? time()+self::IOS_SESSION_COOKIE_LIFETIME : $cookietime,
is_null($cookiepath) ? self::$cookie_path : $cookiepath,self::$cookie_domain,
// if called via HTTPS, only send cookie for https and only allow cookie access via HTTP (true)
empty($GLOBALS['egw_info']['server']['insecure_cookies']) && Header\Http::schema() === 'https', true);
$options = [
'expires' => !$cookietime && $is_iOS ? time()+self::IOS_SESSION_COOKIE_LIFETIME : $cookietime,
'path' => is_null($cookiepath) ? self::$cookie_path : $cookiepath,
'domain' => self::$cookie_domain,
// if called via HTTPS, only send cookie for https
'secure' => empty($GLOBALS['egw_info']['server']['insecure_cookies']) && Header\Http::schema() === 'https',
'httponly' => true, // only allow cookie access via HTTP, not client-side via JavaScript
];
// admin specified to send SameSite cookie attribute AND we use PHP 7.3+
if (!empty($GLOBALS['egw_info']['server']['cookie_samesite_attribute']) &&
in_array($GLOBALS['egw_info']['server']['cookie_samesite_attribute'], ['Lax', 'Strict', 'None']))
{
$options['samesite'] = $GLOBALS['egw_info']['server']['cookie_samesite_attribute'];
}
if ((float)PHP_VERSION >= 7.3)
{
setcookie($cookiename, $cookievalue, $options);
}
else
{
setcookie($cookiename, $cookievalue,
$options['expires'], $options['path'], $options['domain'], $options['secure'], $options['httponly']);
}
}
}