From 6716a24b6844ab2ec1ee7588f1cf024070c395ed Mon Sep 17 00:00:00 2001 From: Chen-Pang He Date: Thu, 5 Jun 2014 18:07:29 +0800 Subject: Send cookie only via HTTPS if a mod logs in via HTTPS, which is the case on this site --- inc/mod/auth.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'inc/mod/auth.php') diff --git a/inc/mod/auth.php b/inc/mod/auth.php index f2003dfe..697d06a1 100644 --- a/inc/mod/auth.php +++ b/inc/mod/auth.php @@ -69,13 +69,13 @@ function setCookies() { $mod['hash'][0] . // password ':' . $mod['hash'][1], // salt - time() + $config['cookies']['expire'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, false, $config['cookies']['httponly']); + time() + $config['cookies']['expire'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, $_SERVER['HTTPS'], $config['cookies']['httponly']); } function destroyCookies() { global $config; // Delete the cookies - setcookie($config['cookies']['mod'], 'deleted', time() - $config['cookies']['expire'], $config['cookies']['jail']?$config['cookies']['path'] : '/', null, false, true); + setcookie($config['cookies']['mod'], 'deleted', time() - $config['cookies']['expire'], $config['cookies']['jail']?$config['cookies']['path'] : '/', null, $_SERVER['HTTPS'], true); } function modLog($action, $_board=null) { -- cgit v1.3 From 23d6e8203806bba22b6444cd09e53da9fc7c501a Mon Sep 17 00:00:00 2001 From: czaks Date: Wed, 11 Jun 2014 02:04:59 +0200 Subject: $_SERVER[HTTPS] isn`t being always set; fixes #65 --- inc/mod/auth.php | 4 ++-- inc/mod/pages.php | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) (limited to 'inc/mod/auth.php') diff --git a/inc/mod/auth.php b/inc/mod/auth.php index 697d06a1..182f3ee2 100644 --- a/inc/mod/auth.php +++ b/inc/mod/auth.php @@ -69,13 +69,13 @@ function setCookies() { $mod['hash'][0] . // password ':' . $mod['hash'][1], // salt - time() + $config['cookies']['expire'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, $_SERVER['HTTPS'], $config['cookies']['httponly']); + time() + $config['cookies']['expire'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'], $config['cookies']['httponly']); } function destroyCookies() { global $config; // Delete the cookies - setcookie($config['cookies']['mod'], 'deleted', time() - $config['cookies']['expire'], $config['cookies']['jail']?$config['cookies']['path'] : '/', null, $_SERVER['HTTPS'], true); + setcookie($config['cookies']['mod'], 'deleted', time() - $config['cookies']['expire'], $config['cookies']['jail']?$config['cookies']['path'] : '/', null, isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'], true); } function modLog($action, $_board=null) { diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 5cb98085..0af16a9c 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -150,7 +150,7 @@ function mod_dashboard() { $latest = false; } - setcookie('update', serialize($latest), time() + $config['check_updates_time'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, $_SERVER['HTTPS'], true); + setcookie('update', serialize($latest), time() + $config['check_updates_time'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'], true); } if ($latest) -- cgit v1.3 From 7933abd271b5bb3578cd80f62302cc6ac8961b91 Mon Sep 17 00:00:00 2001 From: Chen-Pang He Date: Wed, 11 Jun 2014 12:07:45 +0800 Subject: Fix vichan #65 Conflicts: inc/mod/auth.php inc/mod/pages.php --- inc/mod/auth.php | 4 ++-- inc/mod/pages.php | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) (limited to 'inc/mod/auth.php') diff --git a/inc/mod/auth.php b/inc/mod/auth.php index 182f3ee2..01ed5b68 100644 --- a/inc/mod/auth.php +++ b/inc/mod/auth.php @@ -69,13 +69,13 @@ function setCookies() { $mod['hash'][0] . // password ':' . $mod['hash'][1], // salt - time() + $config['cookies']['expire'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'], $config['cookies']['httponly']); + time() + $config['cookies']['expire'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off', $config['cookies']['httponly']); } function destroyCookies() { global $config; // Delete the cookies - setcookie($config['cookies']['mod'], 'deleted', time() - $config['cookies']['expire'], $config['cookies']['jail']?$config['cookies']['path'] : '/', null, isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'], true); + setcookie($config['cookies']['mod'], 'deleted', time() - $config['cookies']['expire'], $config['cookies']['jail']?$config['cookies']['path'] : '/', null, !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off', true); } function modLog($action, $_board=null) { diff --git a/inc/mod/pages.php b/inc/mod/pages.php index 0af16a9c..05a24865 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -150,7 +150,7 @@ function mod_dashboard() { $latest = false; } - setcookie('update', serialize($latest), time() + $config['check_updates_time'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'], true); + setcookie('update', serialize($latest), time() + $config['check_updates_time'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off', true); } if ($latest) -- cgit v1.3