From 2fd5540fca889200b3577042494e48fd0720ff12 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?= <mauricio@fauth.dev>
Date: Tue, 15 Feb 2022 18:53:08 -0300
Subject: [PATCH] Add SameSite to session cookie for PHP 7.2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Related to #16981

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
---
 libraries/classes/Config.php  |  9 +++------
 libraries/classes/Session.php | 10 ++++++++--
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/libraries/classes/Config.php b/libraries/classes/Config.php
index 6aa9b8202f..ccf5cdcfda 100644
--- a/libraries/classes/Config.php
+++ b/libraries/classes/Config.php
@@ -1091,10 +1091,7 @@ class Config
         ?int $validity = null,
         bool $httponly = true
     ): bool {
-        global $cfg;
-
-        if (strlen($value) > 0 && $default !== null && $value === $default
-        ) {
+        if (strlen($value) > 0 && $default !== null && $value === $default) {
             // default value is used
             if ($this->issetCookie($cookie)) {
                 // remove cookie
@@ -1134,7 +1131,7 @@ class Config
                     $httpCookieName,
                     $value,
                     $validity,
-                    $this->getRootPath() . '; samesite=' . $cfg['CookieSameSite'],
+                    $this->getRootPath() . '; SameSite=' . $this->get('CookieSameSite'),
                     '',
                     $this->isHttps(),
                     $httponly
@@ -1146,7 +1143,7 @@ class Config
                 'domain' => '',
                 'secure' => $this->isHttps(),
                 'httponly' => $httponly,
-                'samesite' => $cfg['CookieSameSite'],
+                'samesite' => $this->get('CookieSameSite'),
             ];
 
             return setcookie(
diff --git a/libraries/classes/Session.php b/libraries/classes/Session.php
index 2da22a8a32..5882fb05a4 100644
--- a/libraries/classes/Session.php
+++ b/libraries/classes/Session.php
@@ -153,10 +153,16 @@ class Session
             }
         }
 
+        $cookieSameSite = $config->get('CookieSameSite') ?? 'Strict';
+        $cookiePath = $config->getRootPath();
+        if (PHP_VERSION_ID < 70300) {
+            $cookiePath .= '; SameSite=' . $cookieSameSite;
+        }
+
         // session cookie settings
         session_set_cookie_params(
             0,
-            $config->getRootPath(),
+            $cookiePath,
             '',
             $config->isHttps(),
             true
@@ -183,7 +189,7 @@ class Session
         ini_set('session.cookie_httponly', '1');
         if (PHP_VERSION_ID >= 70300) {
             // add SameSite to the session cookie
-            ini_set('session.cookie_samesite', $config->get('CookieSameSite') ?? '');
+            ini_set('session.cookie_samesite', $cookieSameSite);
         }
         // do not force transparent session ids
         ini_set('session.use_trans_sid', '0');