mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

set cookie secure if forcessl is enabled 

This also moves session_start in lib/base.php down a bit because we need
OC::$SERVERROOT to get the config settings.

Signed-off-by: Florian Pritz <bluewind@xinu.at>
This commit is contained in:
Florian Pritz 2011-09-23 13:52:10 +02:00
parent 037d0e9640
commit c7d4e72341
4 changed files with 23 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
apps/user_openid/phpmyid.php
View File

@ -1069,6 +1069,9 @@ function destroy_assoc_handle ( $id ) {
session_write_close();
session_id($id);
if (OC_Config::getValue( "forcessl", false )) {
ini_set("session.cookie_secure", "on");
}
session_start();
session_destroy();
@ -1194,6 +1197,9 @@ function new_assoc ( $expiration ) {
session_write_close();
}
if (OC_Config::getValue( "forcessl", false )) {
ini_set("session.cookie_secure", "on");
}
session_start();
session_regenerate_id('false');
@ -1265,6 +1271,9 @@ function secret ( $handle ) {
}
session_id($handle);
if (OC_Config::getValue( "forcessl", false )) {
ini_set("session.cookie_secure", "on");
}
session_start();
debug('Started session to acquire key: ' . session_id());
@ -1467,6 +1476,9 @@ function user_session () {
global $proto, $profile;
session_name('phpMyID_Server');
if (OC_Config::getValue( "forcessl", false )) {
ini_set("session.cookie_secure", "on");
}
@session_start();
$profile['authorized'] = (isset($_SESSION['auth_username'])

2
files/ajax/timezone.php
View File

@ -1,4 +1,6 @@
<?php
// FIXME: this should start a secure session if forcessl is enabled
// see lib/base.php for an example
session_start();
$_SESSION['timezone'] = $_GET['time'];
?>

6
lib/base.php
View File

@ -80,8 +80,6 @@ class OC{
date_default_timezone_set('Europe/Berlin');
ini_set('arg_separator.output','&amp;');
ini_set('session.cookie_httponly','1;');
session_start();
// calculate the documentroot
OC::$DOCUMENTROOT=realpath($_SERVER['DOCUMENT_ROOT']);
@ -102,6 +100,7 @@ class OC{
// redirect to https site if configured
if( OC_Config::getValue( "forcessl", false )){
ini_set("session.cookie_secure", "on");
if(!isset($_SERVER['HTTPS']) or $_SERVER['HTTPS'] != 'on') {
$url = "https://". $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'];
header("Location: $url");
@ -109,6 +108,9 @@ class OC{
}
}
ini_set('session.cookie_httponly','1;');
session_start();
// Add the stuff we need always
OC_Util::addScript( "jquery-1.6.4.min" );
OC_Util::addScript( "jquery-ui-1.8.14.custom.min" );

7
lib/user.php
View File

@ -348,9 +348,10 @@ class OC_User {
* @param string $username username to be set
*/
public static function setMagicInCookie($username, $token){
setcookie("oc_username", $username, time()+60*60*24*15);
setcookie("oc_token", $token, time()+60*60*24*15);
setcookie("oc_remember_login", true, time()+60*60*24*15);
$secure_cookie = OC_Config::getValue("forcessl", false);
setcookie("oc_username", $username, time()+60*60*24*15, '', '', $secure_cookie);
setcookie("oc_token", $token, time()+60*60*24*15, '', '', $secure_cookie);
setcookie("oc_remember_login", true, time()+60*60*24*15, '', '', $secure_cookie);
}
/**