Changeset 633 for branches/1.1dev


Ignore:
Timestamp:
Aug 9, 2018 10:21:49 PM (6 years ago)
Author:
anonymous
Message:

Add disabled session_use_trans_sid to defaults

Location:
branches/1.1dev
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • branches/1.1dev/config/defaults.inc.php

    r570 r633  
    6868// Use php sessions?
    6969setDefault($CFG->enable_session, true);
     70
     71// Pass the session-id through URLs if cookies are not enabled?
     72// Disable this to prevent session ID theft.
     73setDefault($CFG->session_use_trans_sid, false);
    7074
    7175// Use mysql-based sessions?

  • branches/1.1dev/lib/App.inc.php

    r608 r633  
    546546    // - sessions are enabled
    547547    // - the link stays on our site
    548     // - transparent SID propogation with session.use_trans_sid is not being used OR url begins with protocol (using_trans_sid has no effect here)
     548    // - transparent SID propagation with session.use_trans_sid is not being used OR url begins with protocol (using_trans_sid has no effect here)
    549549    // OR
    550550    // - we must include the SID because we say so (it's used in a context where cookies will not be effective, ie. moving from http to https)
    … …  
    558558                    || !$CFG->session_use_cookies
    559559                )
     560                && $CFG->session_use_trans_sid
    560561                && $CFG->enable_session
    561562                && isMyDomain($url)
Note: See TracChangeset for help on using the changeset viewer.