MFB: Added support for httpOnly flag for session extension and cookie

setting functions.

diff --git a/ext/session/php_session.h b/ext/session/php_session.h
index 9cc39126da83976285bef704c84d31f6042f1423..3086ffdfebf085f133db6416f7933cd873659d0b 100644 (file)
--- a/ext/session/php_session.h
+++ b/ext/session/php_session.h
@@ -103,6 +103,7 @@ typedef struct _php_ps_globals {
        char *cookie_path;
        char *cookie_domain;
        zend_bool  cookie_secure;
+       zend_bool  cookie_httponly;
        ps_module *mod;
        void *mod_data;
        php_session_status session_status;

diff --git a/ext/session/session.c b/ext/session/session.c
index 8729c092e32f0fbbbe82ae25e1aeca5476232292..b290ed2783f758e8c20d4b31f2272a22350858cb 100644 (file)
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -158,6 +158,7 @@ PHP_INI_BEGIN()
        STD_PHP_INI_ENTRY("session.cookie_path",        "/",         PHP_INI_ALL, OnUpdateString, cookie_path,        php_ps_globals,    ps_globals)
        STD_PHP_INI_ENTRY("session.cookie_domain",      "",          PHP_INI_ALL, OnUpdateString, cookie_domain,      php_ps_globals,    ps_globals)
        STD_PHP_INI_BOOLEAN("session.cookie_secure",    "",          PHP_INI_ALL, OnUpdateBool,   cookie_secure,      php_ps_globals,    ps_globals)
+       STD_PHP_INI_BOOLEAN("session.cookie_httponly",  "",          PHP_INI_ALL, OnUpdateBool,   cookie_httponly,    php_ps_globals,    ps_globals)
        STD_PHP_INI_BOOLEAN("session.use_cookies",      "1",         PHP_INI_ALL, OnUpdateBool,   use_cookies,        php_ps_globals,    ps_globals)
        STD_PHP_INI_BOOLEAN("session.use_only_cookies", "1",         PHP_INI_ALL, OnUpdateBool,   use_only_cookies,   php_ps_globals,    ps_globals)
        STD_PHP_INI_ENTRY("session.referer_check",      "",          PHP_INI_ALL, OnUpdateString, extern_referer_chk, php_ps_globals,    ps_globals)
@@ -902,6 +903,7 @@ static int php_session_cache_limiter(TSRMLS_D)
 #define COOKIE_PATH            "; path="
 #define COOKIE_DOMAIN  "; domain="
 #define COOKIE_SECURE  "; secure"
+#define COOKIE_HTTPONLY        "; HttpOnly"
 
 static void php_session_send_cookie(TSRMLS_D)
 {
@@ -955,6 +957,10 @@ static void php_session_send_cookie(TSRMLS_D)
                smart_str_appends(&ncookie, COOKIE_SECURE);
        }
 
+       if (PS(cookie_httponly)) {
+               smart_str_appends(&ncookie, COOKIE_HTTPONLY);
+       }
+
        smart_str_0(&ncookie);
        
        /*      'replace' must be 0 here, else a previous Set-Cookie
@@ -1186,13 +1192,13 @@ static zend_bool php_session_destroy(TSRMLS_D)
    Set session cookie parameters */
 PHP_FUNCTION(session_set_cookie_params)
 {
-       zval **lifetime, **path, **domain, **secure;
+       zval **lifetime, **path, **domain, **secure,  **httponly;
 
        if (!PS(use_cookies))
                return;
 
-       if (ZEND_NUM_ARGS() < 1 || ZEND_NUM_ARGS() > 4 ||
-               zend_get_parameters_ex(ZEND_NUM_ARGS(), &lifetime, &path, &domain, &secure) == FAILURE)
+       if (ZEND_NUM_ARGS() < 1 || ZEND_NUM_ARGS() > 5 ||
+               zend_get_parameters_ex(ZEND_NUM_ARGS(), &lifetime, &path, &domain, &secure, &httponly) == FAILURE)
                WRONG_PARAM_COUNT;
 
        convert_to_string_ex(lifetime);
@@ -1209,6 +1215,10 @@ PHP_FUNCTION(session_set_cookie_params)
                                convert_to_long_ex(secure);
                                zend_alter_ini_entry("session.cookie_secure", sizeof("session.cookie_secure"), Z_BVAL_PP(secure)?"1":"0", 1, PHP_INI_USER, PHP_INI_STAGE_RUNTIME);
                        }
+                           if (ZEND_NUM_ARGS() > 4) {
+                                   convert_to_long_ex(httponly);
+                                   zend_alter_ini_entry("session.cookie_httponly", sizeof("session.cookie_httponly"), Z_BVAL_PP(httponly)?"1":"0", 1, PHP_INI_USER, PHP_INI_STAGE_RUNTIME);
+                           }
                }
        }
 }
@@ -1228,6 +1238,7 @@ PHP_FUNCTION(session_get_cookie_params)
        add_assoc_string(return_value, "path", PS(cookie_path), 1);
        add_assoc_string(return_value, "domain", PS(cookie_domain), 1);
        add_assoc_bool(return_value, "secure", PS(cookie_secure));
+       add_assoc_bool(return_value, "httponly", PS(cookie_httponly));
 }
 /* }}} */
 

diff --git a/ext/standard/head.c b/ext/standard/head.c
index 44c5611b58993b1118f22738db8ae1100f926e66..2c273bc257ab029a2e100a51f8f0544252721053 100644 (file)
--- a/ext/standard/head.c
+++ b/ext/standard/head.c
@@ -59,7 +59,7 @@ PHPAPI int php_header(TSRMLS_D)
 }
 
 
-PHPAPI int php_setcookie(char *name, int name_len, char *value, int value_len, time_t expires, char *path, int path_len, char *domain, int domain_len, int secure, int url_encode TSRMLS_DC)
+PHPAPI int php_setcookie(char *name, int name_len, char *value, int value_len, time_t expires, char *path, int path_len, char *domain, int domain_len, int secure, int url_encode, int httponly TSRMLS_DC)
 {
        char *cookie, *encoded_value = NULL;
        int len=sizeof("Set-Cookie: ");
@@ -130,6 +130,9 @@ PHPAPI int php_setcookie(char *name, int name_len, char *value, int value_len, t
        if (secure) {
                strcat(cookie, "; secure");
        }
+       if (httponly) {
+               strcat(cookie, "; httponly");
+       }
 
        ctr.line = cookie;
        ctr.line_len = strlen(cookie);
@@ -141,22 +144,22 @@ PHPAPI int php_setcookie(char *name, int name_len, char *value, int value_len, t
 
 
 /* php_set_cookie(name, value, expires, path, domain, secure) */
-/* {{{ proto bool setcookie(string name [, string value [, int expires [, string path [, string domain [, bool secure]]]]])
+/* {{{ proto bool setcookie(string name [, string value [, int expires [, string path [, string domain [, bool secure[, bool httponly]]]]]])
    Send a cookie */
 PHP_FUNCTION(setcookie)
 {
        char *name, *value = NULL, *path = NULL, *domain = NULL;
        long expires = 0;
-       zend_bool secure = 0;
+       zend_bool secure = 0, httponly = 0;
        int name_len, value_len, path_len, domain_len;
 
-       if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|slssb", &name,
+       if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|slssbb", &name,
                                                          &name_len, &value, &value_len, &expires, &path,
-                                                         &path_len, &domain, &domain_len, &secure) == FAILURE) {
+                                                         &path_len, &domain, &domain_len, &secure, &httponly) == FAILURE) {
                return;
        }
 
-       if (php_setcookie(name, name_len, value, value_len, expires, path, path_len, domain, domain_len, secure, 1 TSRMLS_CC) == SUCCESS) {
+       if (php_setcookie(name, name_len, value, value_len, expires, path, path_len, domain, domain_len, secure, 1, httponly TSRMLS_CC) == SUCCESS) {
                RETVAL_TRUE;
        } else {
                RETVAL_FALSE;
@@ -164,22 +167,22 @@ PHP_FUNCTION(setcookie)
 }
 /* }}} */
 
-/* {{{ proto bool setrawcookie(string name [, string value [, int expires [, string path [, string domain [, bool secure]]]]])
+/* {{{ proto bool setrawcookie(string name [, string value [, int expires [, string path [, string domain [, bool secure[, bool httponly]]]]]])
    Send a cookie with no url encoding of the value */
 PHP_FUNCTION(setrawcookie)
 {
        char *name, *value = NULL, *path = NULL, *domain = NULL;
        long expires = 0;
-       zend_bool secure = 0;
+       zend_bool secure = 0, httponly = 0;
        int name_len, value_len, path_len, domain_len;
 
-       if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|slssb", &name,
+       if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|slssbb", &name,
                                                          &name_len, &value, &value_len, &expires, &path,
-                                                         &path_len, &domain, &domain_len, &secure) == FAILURE) {
+                                                         &path_len, &domain, &domain_len, &secure, &httponly) == FAILURE) {
                return;
        }
 
-       if (php_setcookie(name, name_len, value, value_len, expires, path, path_len, domain, domain_len, secure, 0 TSRMLS_CC) == SUCCESS) {
+       if (php_setcookie(name, name_len, value, value_len, expires, path, path_len, domain, domain_len, secure, 0, httponly TSRMLS_CC) == SUCCESS) {
                RETVAL_TRUE;
        } else {
                RETVAL_FALSE;

diff --git a/ext/standard/head.h b/ext/standard/head.h
index cfaee9da0eb854b217073f49dc3124b9c2d74760..118105889ce5b57b4b8c7a88c501edd940d64d22 100644 (file)
--- a/ext/standard/head.h
+++ b/ext/standard/head.h
@@ -29,6 +29,6 @@ PHP_FUNCTION(headers_sent);
 PHP_FUNCTION(headers_list);
 
 PHPAPI int php_header(TSRMLS_D);
-PHPAPI int php_setcookie(char *name, int name_len, char *value, int value_len, time_t expires, char *path, int path_len, char *domain, int domain_len, int secure, int url_encode TSRMLS_DC);
+PHPAPI int php_setcookie(char *name, int name_len, char *value, int value_len, time_t expires, char *path, int path_len, char *domain, int domain_len, int secure, int url_encode, int httponly TSRMLS_DC);
 
 #endif

diff --git a/php.ini-dist b/php.ini-dist
index 87d7449981c1f43175090ae05d8222e30733f5ac..0bb253929ab6fce3a96ea6773703406a817b0d43 100644 (file)
--- a/php.ini-dist
+++ b/php.ini-dist
@@ -842,6 +842,9 @@ session.cookie_path = /
 ; The domain for which the cookie is valid.
 session.cookie_domain =
 
+; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript.
+session.cookie_httponly = 
+
 ; Handler used to serialize data.  php is the standard serializer of PHP.
 session.serialize_handler = php
 

diff --git a/php.ini-recommended b/php.ini-recommended
index 3c5184441f78ee7732f5fcf0145fa1b25e11338c..8f20cc2bc1252a33b9a11cd5e9ed625cdf44ace8 100644 (file)
--- a/php.ini-recommended
+++ b/php.ini-recommended
@@ -873,6 +873,9 @@ session.cookie_path = /
 ; The domain for which the cookie is valid.
 session.cookie_domain =
 
+; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript.
+session.cookie_httponly = 
+
 ; Handler used to serialize data.  php is the standard serializer of PHP.
 session.serialize_handler = php