Changeset 711 for trunk/lib

Timestamp:

Feb 13, 2020 4:47:07 AM (4 years ago)

Author:

anonymous

Message:

Add SameSite? option to App::setCookie

File:

• trunk/lib/App.inc.php (modified) (5 diffs)

trunk/lib/App.inc.php

@@ -1742 +1742 @@
     * @param    bool    $secure     Indicates that the cookie should only be transmitted over a secure HTTPS connection from the client.
     * @param    bool    $httponly   When TRUE the cookie will be made accessible only through the HTTP protocol (makes cookies unreadable to javascript).
+    * @param    string  $samesite   Value of the SameSite key ('None', 'Lax', or 'Strict'). PHP 7.3+ only.
     * @return   bool                True on success, false on error.
     * @author   Quinn Comendant <quinn@strangecode.com>
@@ -1747 +1748 @@
     * @since    02 May 2014 16:36:34
     */
-    public function setCookie($name, $value, $expire='+10 years', $path='/', $domain=null, $secure=null, $httponly=null)
+    public function setCookie($name, $value, $expire='+10 years', $path='/', $domain=null, $secure=null, $httponly=null, $samesite=null)
     {
         if (!is_scalar($name)) {
@@ -1762 +1763 @@
         $secure = $secure ?: getenv('HTTPS') == 'on';
         $httponly = $httponly ?: true;
+        $samesite = $samesite ?: 'Lax';
 
         // Make sure the expiration date is a valid 32bit integer.
@@ -1770 +1772 @@
         // Measure total cookie length and warn if larger than max recommended size of 4093.
         // https://stackoverflow.com/questions/640938/what-is-the-maximum-size-of-a-web-browsers-cookies-key
-        // The date the header name include 51 bytes: Set-Cookie: ; expires=Fri, 03-May-2024 00:04:47 GMT
-        $cookielen = strlen($name . $value . $path . $domain . ($secure ? '; secure' : '') . ($httponly ? '; httponly' : '')) + 51;
+        // The date and header name adds 51 bytes: Set-Cookie: ; expires=Fri, 03-May-2024 00:04:47 GMT
+        $cookielen = strlen($name . $value . $path . $domain . ($secure ? '; secure' : '') . ($httponly ? '; httponly' : '') . ($samesite ? '; SameSite=' . $samesite : '')) + 51;
         if ($cookielen > 4093) {
             $this->logMsg(sprintf('Cookie "%s" has a size greater than 4093 bytes (is %s bytes)', $key, $cookielen), LOG_NOTICE, __FILE__, __LINE__);
@@ -1777 +1779 @@
 
         // Ensure PHP version allow use of httponly.
-        if (version_compare(PHP_VERSION, '5.2.0', '>=')) {
+        if (version_compare(PHP_VERSION, '7.3.0', '>=')) {
+            $ret = setcookie($name, $value, [
+                'expires' => $expire,
+                'path' => $path,
+                'domain' => $domain,
+                'secure' => $secure,
+                'httponly' => $httponly,
+                'samesite' => $samesite,
+            ]);
+        } else if (version_compare(PHP_VERSION, '5.2.0', '>=')) {
             $ret = setcookie($name, $value, $expire, $path, $domain, $secure, $httponly);
         } else {