From c38f460aa661687254ba598352a9fe6fde13767a Mon Sep 17 00:00:00 2001 From: ryan Date: Wed, 3 Sep 2008 18:24:28 +0000 Subject: [PATCH] Try out httponly for auth cookies. see #7677 git-svn-id: http://svn.automattic.com/wordpress/trunk@8798 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/pluggable.php | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php index ad18ea5012..a57aa3ff52 100644 --- a/wp-includes/pluggable.php +++ b/wp-includes/pluggable.php @@ -634,11 +634,20 @@ function wp_set_auth_cookie($user_id, $remember = false, $secure = '') { do_action('set_auth_cookie', $auth_cookie, $expire, $expiration, $user_id, $scheme); do_action('set_logged_in_cookie', $logged_in_cookie, $expire, $expiration, $user_id, 'logged_in'); - setcookie($auth_cookie_name, $auth_cookie, $expire, PLUGINS_COOKIE_PATH, COOKIE_DOMAIN, $secure); - setcookie($auth_cookie_name, $auth_cookie, $expire, ADMIN_COOKIE_PATH, COOKIE_DOMAIN, $secure); - setcookie(LOGGED_IN_COOKIE, $logged_in_cookie, $expire, COOKIEPATH, COOKIE_DOMAIN); - if ( COOKIEPATH != SITECOOKIEPATH ) - setcookie(LOGGED_IN_COOKIE, $logged_in_cookie, $expire, SITECOOKIEPATH, COOKIE_DOMAIN); + // Set httponly if the php version is >= 5.2.0 + if ( version_compare(phpversion(), '5.2.0', 'ge') ) { + setcookie($auth_cookie_name, $auth_cookie, $expire, PLUGINS_COOKIE_PATH, COOKIE_DOMAIN, $secure, true); + setcookie($auth_cookie_name, $auth_cookie, $expire, ADMIN_COOKIE_PATH, COOKIE_DOMAIN, $secure, true); + setcookie(LOGGED_IN_COOKIE, $logged_in_cookie, $expire, COOKIEPATH, COOKIE_DOMAIN, false, true); + if ( COOKIEPATH != SITECOOKIEPATH ) + setcookie(LOGGED_IN_COOKIE, $logged_in_cookie, $expire, SITECOOKIEPATH, COOKIE_DOMAIN, false, true); + } else { + setcookie($auth_cookie_name, $auth_cookie, $expire, PLUGINS_COOKIE_PATH, COOKIE_DOMAIN, $secure); + setcookie($auth_cookie_name, $auth_cookie, $expire, ADMIN_COOKIE_PATH, COOKIE_DOMAIN, $secure); + setcookie(LOGGED_IN_COOKIE, $logged_in_cookie, $expire, COOKIEPATH, COOKIE_DOMAIN); + if ( COOKIEPATH != SITECOOKIEPATH ) + setcookie(LOGGED_IN_COOKIE, $logged_in_cookie, $expire, SITECOOKIEPATH, COOKIE_DOMAIN); + } } endif;