From 64f033d3b9d3fd698927500eb5fd2db8f88b9986 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 26 Jul 2016 16:21:39 +0200 Subject: [PATCH] Tighthen control on PHP sessions and session cookies MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - use only cookies for session - use http only cookies - disable transparent session IDs Signed-off-by: Michal Čihař --- ChangeLog | 1 + libraries/session.inc.php | 17 ++++++++--------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/ChangeLog b/ChangeLog index 036e6a8b96..916bce49f5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -7,6 +7,7 @@ phpMyAdmin - ChangeLog - issue Fixed invalid Content-Length in some HTTP responses - issue #12394 Create view should require a view name - issue #12391 Message with 'Change password successfully' displayed, but does not take effect +- issue Tighthen control on PHP sessions and session cookies 4.6.3 (2016-06-23) - issue #12249 Fixed cookie path on Windows diff --git a/libraries/session.inc.php b/libraries/session.inc.php index ffdfdce0f4..f1b3d23897 100644 --- a/libraries/session.inc.php +++ b/libraries/session.inc.php @@ -41,15 +41,14 @@ if (!empty($path)) { session_save_path($path); } -// but not all user allow cookies -@ini_set('session.use_only_cookies', 'false'); -// do not force transparent session ids, see bug #3398788 -//@ini_set('session.use_trans_sid', 'true'); -@ini_set( - 'url_rewriter.tags', - 'a=href,frame=src,input=src,form=fakeentry,fieldset=' -); -//ini_set('arg_separator.output', '&'); +// use cookies only +@ini_set('session.use_only_cookies', '1'); +// strict session mode (do not accept random string as session ID) +@ini_set('session.use_strict_mode', '1'); +// make the session cookie HttpOnly +@ini_set('session.cookie_httponly', '1'); +// do not force transparent session ids +@ini_set('session.use_trans_sid', '0'); // delete session/cookies when browser is closed @ini_set('session.cookie_lifetime', '0');