* Make setting of HttpOnly flag more explicit.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@660566 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/docs/manual/mod/mod_rewrite.xml b/docs/manual/mod/mod_rewrite.xml
index c995ab82f25c9b6c93c6db8f1f7b2f60fb64c24e..c9e4fa0af152b9a9f856229c01925274fa6994d1 100644 (file)
--- a/docs/manual/mod/mod_rewrite.xml
+++ b/docs/manual/mod/mod_rewrite.xml
@@ -1260,7 +1260,7 @@ cannot use <code>$N</code> in the substitution string!
         is the lifetime of the cookie in minutes, and the optional 
         <em>path</em> is the path of the cookie. If <em>secure</em>
         is set to 'true' or '1', the cookie is only transmitted via secured
-        connections. If <em>httponly</em> is set to any string, the
+        connections. If <em>httponly</em> is set to 'true' or '1', the
         <code>HttpOnly</code> flag is used, making the cookie inaccessible
         to JavaScript code on browsers that support this feature.</dd>
 

diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
index 91d2a69090e91418640bafb0d74699596478fc23..4abf898db624decbb5a901d75e45df36e0d2c00f 100644 (file)
--- a/modules/mappers/mod_rewrite.c
+++ b/modules/mappers/mod_rewrite.c
@@ -2492,10 +2492,12 @@ static void add_cookie(request_rec *r, char *s)
                                  "; domain=", domain,
                                  expires ? "; expires=" : NULL,
                                  expires ? exp_time : NULL,
-                                 secure ? ((strcasecmp(secure, "true") == 0
-                                           || strcasecmp(secure, "1") == 0) ?
-                                           "; secure" : NULL) : NULL,
-                                 httponly ? "; HttpOnly" : NULL, 
+                                 (secure && (!strcasecmp(secure, "true")
+                                             || !strcasecmp(secure, "1"))) ?
+                                  "; secure" : NULL,
+                                 (httponly && (!strcasecmp(httponly, "true")
+                                               || !strcasecmp(httponly, "1"))) ?
+                                  "; HttpOnly" : NULL,
                                  NULL);
 
             apr_table_addn(rmain->err_headers_out, "Set-Cookie", cookie);