Samesite-Cookies an (CSRF-Protection), check auf HTTPS raus, wir unterstützen nur noch HTTPS (e20e4af)

session/start.php

@@ -13,9 +13,8 @@ require_once('inc/base.php');
 
 session_name(config('session_name'));
 
-if ($_SERVER['HTTPS']) {
-    session_set_cookie_params(0, '/', '', true, true);
-}
+session_set_cookie_params(array('path' => '/', 'secure' => true,
+                                'httponly' => true, 'samesite' => 'Lax'));
 
 if (!session_start()) {
     logger(LOG_ERR, "session/start", "session", "Die session konnte nicht gestartet werden!");


...	...	@@ -13,9 +13,8 @@ require_once('inc/base.php');
13	13
14	14	session_name(config('session_name'));
15	15
16		-if ($_SERVER['HTTPS']) {
17		- session_set_cookie_params(0, '/', '', true, true);
18		-}
	16	+session_set_cookie_params(array('path' => '/', 'secure' => true,
	17	+ 'httponly' => true, 'samesite' => 'Lax'));
19	18
20	19	if (!session_start()) {
21	20	logger(LOG_ERR, "session/start", "session", "Die session konnte nicht gestartet werden!");
22	21

webinterface.git