tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix some issues with secure cookies being overwritten by insecure site.

Browse Source 
Now, /publish/{edit,addeditor,login,logout} must be accessed via
https://; other pages should not be (but can be).
This commit is contained in:
tim
2014-04-24 09:56:25 +02:00
parent 7fc40728f5
commit a00c1b4c9d
7 changed files with 41 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
session.lib.php
+16 -12
View File
@@ -1,17 +1,21 @@
<?
require_once(realpath(dirname(__FILE__) . '/open_db.lib.php'));
session_cache_limiter('none');
session_set_cookie_params(strtotime('+1 year'), '/', '.xxx.org.za', TRUE, TRUE);
session_start();
$_SESSION['referrer'] = $_SERVER['REQUEST_URI'];
if (isset($_SESSION['editor'])) {
$is_admin = TRUE;
$username = $_SESSION['editor'];
} elseif (check_persistent_login()) {
$is_admin = TRUE;
$username = $_SESSION['editor'];
} else {
$is_admin = FALSE;
if (isset($_SERVER['HTTPS'])) {
session_cache_limiter('private');
session_set_cookie_params(strtotime('+1 year'), '/', '.xxx.org.za', TRUE, TRUE);
session_start();
if (isset($_SESSION['editor'])) {
$is_admin = TRUE;
$username = $_SESSION['editor'];
} elseif (check_persistent_login()) {
// check_persistent_login() sets $_SESSION['editor']
$is_admin = TRUE;
$username = $_SESSION['editor'];
} else {
$is_admin = FALSE;
}
}
function check_persistent_login() {