Changeset 2757 for trunk/include/functions_session.inc.php

Timestamp:

Oct 16, 2008, 2:38:26 AM (16 years ago)

Author:

rvelices

Message:

merge 2755 and 2756 from branch 2.0 to trunk

• 2755 fix vulnerability ​http://www.milw0rm.com/exploits/6755
• 2756 security paranoia: protect session/remember me cookies from XSS attacks (works only if php>=5.2 and with IE/FF maybe others)

File:

• trunk/include/functions_session.inc.php (modified) (1 diff)

trunk/include/functions_session.inc.php

@@ -67 +67 @@
     ini_set('session.use_only_cookies', $conf['session_use_only_cookies']);
     ini_set('session.use_trans_sid', intval($conf['session_use_trans_sid']));
+    ini_set('session.cookie_httponly', 1);
   }
   session_name($conf['session_name']);