summaryrefslogtreecommitdiffstats
path: root/web/lib/aur.inc.php
diff options
context:
space:
mode:
authorLukas Fleischer <archlinux@cryptocrack.de>2011-08-11 16:31:25 +0200
committerLukas Fleischer <archlinux@cryptocrack.de>2011-08-12 00:09:24 +0200
commit00e4e0294f36f8e4a0c5926efdc16b31fcb4c788 (patch)
tree3ca217b603aee394fa328b5c81269d52bf24d6be /web/lib/aur.inc.php
parent1c9db1d1f14d5f83d8bd7dbbd535cf109680471f (diff)
downloadaurweb-00e4e0294f36f8e4a0c5926efdc16b31fcb4c788.tar.xz
Use secure and httponly session cookies
As discussed on the mailing list, enable "secure" and "httponly" for session cookies to prevent them from being transferred over insecure connections. Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Diffstat (limited to 'web/lib/aur.inc.php')
-rw-r--r--web/lib/aur.inc.php4
1 files changed, 2 insertions, 2 deletions
diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php
index 474ebee..f432697 100644
--- a/web/lib/aur.inc.php
+++ b/web/lib/aur.inc.php
@@ -47,7 +47,7 @@ function check_sid($dbh=NULL) {
# clear out the hacker's cookie, and send them to a naughty page
# why do you have to be so harsh on these people!?
#
- setcookie("AURSID", "", 1, "/");
+ setcookie("AURSID", "", 1, "/", null, !empty($_SERVER['HTTPS']), true);
unset($_COOKIE['AURSID']);
} elseif ($failed == 2) {
# session id timeout was reached and they must login again.
@@ -56,7 +56,7 @@ function check_sid($dbh=NULL) {
$q.= mysql_real_escape_string($_COOKIE["AURSID"]) . "'";
db_query($q, $dbh);
- setcookie("AURSID", "", 1, "/");
+ setcookie("AURSID", "", 1, "/", null, !empty($_SERVER['HTTPS']), true);
unset($_COOKIE['AURSID']);
} else {
# still logged in and haven't reached the timeout, go ahead