Add CSRF protection to every form that changes data.

The logout link carries the token too, and the cookies get SameSite=Lax.
2026-09-25 21:38:22 +02:00
parent f6bdf10228
commit 41c46a43c6
9 changed files with 53 additions and 5 deletions
@@ -5,7 +5,7 @@ require_once('./get_data.lib.php');
 $queue = get_queue();
 if ($queue) session_cache_limiter('nocache');
 else session_cache_limiter('none');
-session_set_cookie_params(strtotime('+1 year'), '/', '.xxx.org.za', TRUE, TRUE);
+session_set_cookie_params(array('lifetime' => strtotime('+1 year'), 'path' => '/', 'domain' => '.xxx.org.za', 'secure' => TRUE, 'httponly' => TRUE, 'samesite' => 'Lax'));
 session_start();
 if (isset($_SESSION['editor'])) {
  $is_admin = TRUE;