gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #17387 from mauriciofauth/session-cookie-samesite-php72

Browse Source 
Add SameSite to session cookie for PHP 7.2
This commit is contained in:
Maurício Meneghini Fauth 2022-02-16 12:02:50 -03:00 committed by GitHub
commit 75823213f6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libraries/classes/Config.php
View File

@ -1091,10 +1091,7 @@ class Config
?int $validity = null,
bool $httponly = true
): bool {
global $cfg;
if (strlen($value) > 0 && $default !== null && $value === $default
) {
if (strlen($value) > 0 && $default !== null && $value === $default) {
// default value is used
if ($this->issetCookie($cookie)) {
// remove cookie
@ -1134,7 +1131,7 @@ class Config
$httpCookieName,
$value,
$validity,
$this->getRootPath() . '; samesite=' . $cfg['CookieSameSite'],
$this->getRootPath() . '; SameSite=' . $this->get('CookieSameSite'),
'',
$this->isHttps(),
$httponly
@ -1146,7 +1143,7 @@ class Config
'domain' => '',
'secure' => $this->isHttps(),
'httponly' => $httponly,
'samesite' => $cfg['CookieSameSite'],
'samesite' => $this->get('CookieSameSite'),
];
return setcookie(

10
libraries/classes/Session.php
View File

@ -153,10 +153,16 @@ class Session
}
}
$cookieSameSite = $config->get('CookieSameSite') ?? 'Strict';
$cookiePath = $config->getRootPath();
if (PHP_VERSION_ID < 70300) {
$cookiePath .= '; SameSite=' . $cookieSameSite;
}
// session cookie settings
session_set_cookie_params(
0,
$config->getRootPath(),
$cookiePath,
'',
$config->isHttps(),
true
@ -183,7 +189,7 @@ class Session
ini_set('session.cookie_httponly', '1');
if (PHP_VERSION_ID >= 70300) {
// add SameSite to the session cookie
ini_set('session.cookie_samesite', $config->get('CookieSameSite') ?? '');
ini_set('session.cookie_samesite', $cookieSameSite);
}
// do not force transparent session ids
ini_set('session.use_trans_sid', '0');