Tighthen control on PHP sessions and session cookies

- use only cookies for session
- use http only cookies
- disable transparent session IDs

Signed-off-by: Michal Čihař <michal@cihar.com>

ChangeLog

@@ -7,6 +7,7 @@ phpMyAdmin - ChangeLog
 - issue        Fixed invalid Content-Length in some HTTP responses
 - issue #12394 Create view should require a view name
 - issue #12391 Message with 'Change password successfully' displayed, but does not take effect
+- issue        Tighthen control on PHP sessions and session cookies
 
 4.6.3 (2016-06-23)
 - issue #12249 Fixed cookie path on Windows

libraries/session.inc.php

@@ -41,15 +41,14 @@ if (!empty($path)) {
     session_save_path($path);
 }
 
-// but not all user allow cookies
-@ini_set('session.use_only_cookies', 'false');
-// do not force transparent session ids, see bug #3398788
-//@ini_set('session.use_trans_sid', 'true');
-@ini_set(
-    'url_rewriter.tags',
-    'a=href,frame=src,input=src,form=fakeentry,fieldset='
-);
-//ini_set('arg_separator.output', '&');
+// use cookies only
+@ini_set('session.use_only_cookies', '1');
+// strict session mode (do not accept random string as session ID)
+@ini_set('session.use_strict_mode', '1');
+// make the session cookie HttpOnly
+@ini_set('session.cookie_httponly', '1');
+// do not force transparent session ids
+@ini_set('session.use_trans_sid', '0');
 
 // delete session/cookies when browser is closed
 @ini_set('session.cookie_lifetime', '0');