diff options
| -rw-r--r-- | inc/config.php | 3 | ||||
| -rw-r--r-- | inc/mod/auth.php | 2 |
2 files changed, 4 insertions, 1 deletions
diff --git a/inc/config.php b/inc/config.php index f0e3ea9f..ba336d48 100644 --- a/inc/config.php +++ b/inc/config.php @@ -1070,6 +1070,9 @@ // Replace ?/config with a simple text editor for editing inc/instance-config.php. $config['mod']['config_editor_php'] = false; + // Whether or not you can access the mod cookie in JavaScript. Most users should not need to change this. + $config['mod']['cookie_httponly'] = true; + /* * ==================== * Mod permissions diff --git a/inc/mod/auth.php b/inc/mod/auth.php index bfab0f7e..5f449e0f 100644 --- a/inc/mod/auth.php +++ b/inc/mod/auth.php @@ -72,7 +72,7 @@ function setCookies() { $mod['hash'][0] . // password ':' . $mod['hash'][1], // salt - time() + $config['cookies']['expire'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, false, true); + time() + $config['cookies']['expire'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, false, $config['mod']['cookie_httponly']); } function destroyCookies() { |