Use secure HTTPS cookies

diff --git a/docs/NEWS b/docs/NEWS
index 744a6f6ab13e1d058c5134a7330a7a6211000512..943183795fbb0f7a09f670daa5e3f59a3409e060 100644 (file)
--- a/docs/NEWS
+++ b/docs/NEWS
@@ -3,6 +3,9 @@
 Version 1.1-beta4 ()
 ------------------------------------------------------------------------
 
+    * Use seperate PHP session ID when using HTTPS login. Set 'secure'
+      cookie parameters when using HTTPS. Thanks to lynoure!
+
     * Added possibility for templates to define the sidebars they use.
       The template specifies this via the $template_config array in
       the config.inc.php file of a template. It looks like this:

diff --git a/include/functions_config.inc.php b/include/functions_config.inc.php
index 71be6a77ec94e2a217f1b1a829ed1846fa77b706..510076551e80fdc07355650ae16bfb1ef55eaaa0 100644 (file)
--- a/include/functions_config.inc.php
+++ b/include/functions_config.inc.php
@@ -559,7 +559,8 @@ function serendipity_JSsetCookie($name, $value) {
 function serendipity_setCookie($name,$value) {
     global $serendipity;
 
-    setcookie("serendipity[$name]", $value, time()+60*60*24*30, $serendipity['serendipityHTTPPath']);
+    $secure = !empty($_SERVER['HTTPS']) ? true : false;
+    setcookie("serendipity[$name]", $value, time()+60*60*24*30, $serendipity['serendipityHTTPPath'], $_SERVER['HTTP_HOST'], $secure);
     $_COOKIE[$name] = $value;
     $serendipity['COOKIE'][$name] = $value;
 }
@@ -1860,7 +1861,7 @@ function &serendipity_loadThemeOptions(&$template_config) {
 function serendipity_hasPluginPermissions($plugin) {
     static $forbidden = null;
     global $serendipity;
-    
+
     if (empty($serendipity['authorid'])) {
         return true;
     }

diff --git a/serendipity_config.inc.php b/serendipity_config.inc.php
index c3361f80138204e64fabff31fcc7013ae0cf416f..1de8dea54ebb116b4ac3efce0c51bd55a3be0746 100644 (file)
--- a/serendipity_config.inc.php
+++ b/serendipity_config.inc.php
@@ -9,6 +9,10 @@ if (defined('S9Y_FRAMEWORK')) {
 @define('S9Y_FRAMEWORK', true);
 
 if (!headers_sent()) {
+    if (!empty($_SERVER['HTTPS'])) {
+        @ini_set('session.name', 'SSLSID');
+        @ini_set('session.cookie_secure', '1');
+    }
     session_start();
 }