From 901178d594998ede1897e4f1cff67d1a5d6785b7 Mon Sep 17 00:00:00 2001 From: martin762 <55557240+martin762@users.noreply.github.com> Date: Wed, 1 May 2024 16:53:29 +0100 Subject: [PATCH 1/3] Add cookie prefix '-__Secure-' to cookies MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The PR will modify the 'GetCookieName' functtion by hard coding the prefix ' __Secure-' to each cookie name when 'isHttps()' is true, Apparently the prefix will be recognise d and enforced by most browsers (ignored by the older ones).Update Config.php The raison d'aitre for this PR is contained in my issue # 18608. This PR will replace the line 953, part of the GetCookieName function : return $cookieName . ( $this->isHttps ? '_https' : '' ); with the amended line: return ( $this->isHttps() ? '__Secure-' : '’ ) . $cookieName . ( $this->isHttps() ? '_https' : ‘’ ); Signed-off-by: martin762 Signed-off-by: Maurício Meneghini Fauth Signed-off-by: faissaloux --- libraries/classes/Config.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libraries/classes/Config.php b/libraries/classes/Config.php index a0d6edafc3..24cd4b7d00 100644 --- a/libraries/classes/Config.php +++ b/libraries/classes/Config.php @@ -1023,7 +1023,7 @@ class Config */ public function getCookieName(string $cookieName): string { - return $cookieName . ( $this->isHttps() ? '_https' : '' ); + return ($this->isHttps() ? '__Secure-' : '') . $cookieName . ($this->isHttps() ? '_https' : ''); } /** From f8cf6a7a8fc6952d27c85d8abdb0a27165ed939d Mon Sep 17 00:00:00 2001 From: faissaloux Date: Wed, 15 Jan 2025 15:27:45 +0100 Subject: [PATCH 2/3] fix varbinary equal search Signed-off-by: faissaloux --- libraries/classes/Table/Search.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libraries/classes/Table/Search.php b/libraries/classes/Table/Search.php index b29fbf54dc..90228432ea 100644 --- a/libraries/classes/Table/Search.php +++ b/libraries/classes/Table/Search.php @@ -197,6 +197,8 @@ final class Search && $func_type !== 'BETWEEN' && $func_type !== 'NOT BETWEEN' ) { + $quot = $names === 'varbinary' ? '' : $quot; + return $backquoted_name . ' ' . $func_type . ' ' . $quot . $this->dbi->escapeString($criteriaValues) . $quot; } From 4d25a41b89c4e7e45913851e369dad738d1fe615 Mon Sep 17 00:00:00 2001 From: faissaloux Date: Wed, 15 Jan 2025 23:49:01 +0100 Subject: [PATCH 3/3] add quotes to only simple string value, if starts with '0x' don't Signed-off-by: faissaloux --- libraries/classes/Table/Search.php | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libraries/classes/Table/Search.php b/libraries/classes/Table/Search.php index 90228432ea..98713958a3 100644 --- a/libraries/classes/Table/Search.php +++ b/libraries/classes/Table/Search.php @@ -167,7 +167,10 @@ final class Search // strings to numbers and numbers to strings as necessary // during the comparison if ( - preg_match('@char|binary|blob|text|set|date|time|year|uuid@i', $types) + ( + preg_match('@char|binary|blob|text|set|date|time|year|uuid@i', $types) + && !str_starts_with($criteriaValues, '0x') + ) || mb_strpos(' ' . $func_type, 'LIKE') ) { $quot = '\''; @@ -197,8 +200,6 @@ final class Search && $func_type !== 'BETWEEN' && $func_type !== 'NOT BETWEEN' ) { - $quot = $names === 'varbinary' ? '' : $quot; - return $backquoted_name . ' ' . $func_type . ' ' . $quot . $this->dbi->escapeString($criteriaValues) . $quot; }