cvs: php-src(PHP_5_2) / NEWS php.ini-dist php.ini-recommended /ext/session php_session.h session.c /ext/standard head.c head.h

iliaa Thu Aug 10 13:50:56 2006 UTC Modified files: (Branch: PHP_5_2) /php-src php.ini-dist php.ini-recommended NEWS /php-src/ext/standard head.c head.h /php-src/ext/session php_session.h session.c Log: Added support for httpOnly flag for session extension and cookie setting functions. # Original patch by Scott MacVicar

http://cvs.php.net/viewvc.cgi/php-src/php.ini-dist?r1=1.231.2.10.2.3&r2=1.231.2.10.2.4&diff_format=u Index: php-src/php.ini-dist diff -u php-src/php.ini-dist:1.231.2.10.2.3 php-src/php.ini-dist:1.231.2.10.2.4 --- php-src/php.ini-dist:1.231.2.10.2.3 Fri Jun 16 14:09:00 2006 +++ php-src/php.ini-dist Thu Aug 10 13:50:55 2006 @@ -915,6 +915,9 @@ ; The domain for which the cookie is valid. session.cookie_domain = +; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript. +session.cookie_httponly = + ; Handler used to serialize data. php is the standard serializer of PHP. session.serialize_handler = php http://cvs.php.net/viewvc.cgi/php-src/php.ini-recommended?r1=1.179.2.11.2.2&r2=1.179.2.11.2.3&diff_format=u Index: php-src/php.ini-recommended diff -u php-src/php.ini-recommended:1.179.2.11.2.2 php-src/php.ini-recommended:1.179.2.11.2.3 --- php-src/php.ini-recommended:1.179.2.11.2.2 Mon Jun 5 16:25:25 2006 +++ php-src/php.ini-recommended Thu Aug 10 13:50:55 2006 @@ -970,6 +970,9 @@ ; The domain for which the cookie is valid. session.cookie_domain = +; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript. +session.cookie_httponly = + ; Handler used to serialize data. php is the standard serializer of PHP. session.serialize_handler = php http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.194&r2=1.2027.2.547.2.195&diff_format=u Index: php-src/NEWS diff -u php-src/NEWS:1.2027.2.547.2.194 php-src/NEWS:1.2027.2.547.2.195 --- php-src/NEWS:1.2027.2.547.2.194 Wed Aug 9 15:27:42 2006 +++ php-src/NEWS Thu Aug 10 13:50:56 2006 @@ -1,6 +1,8 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? Aug 2006, PHP 5.2.0RC2 +- Added support for httpOnly flag for session extension and cookie setting + functions. (Scott MacVicar, Ilia) - Added version specific registry keys to allow different configurations for different php version. (Richard, Dmitry) - In addition to path to php.ini, PHPRC now may specify full file name. (Dmitry) http://cvs.php.net/viewvc.cgi/php-src/ext/standard/head.c?r1=1.84.2.1&r2=1.84.2.1.2.1&diff_format=u Index: php-src/ext/standard/head.c diff -u php-src/ext/standard/head.c:1.84.2.1 php-src/ext/standard/head.c:1.84.2.1.2.1 --- php-src/ext/standard/head.c:1.84.2.1 Sun Jan 1 12:50:14 2006 +++ php-src/ext/standard/head.c Thu Aug 10 13:50:56 2006 @@ -15,7 +15,7 @@ | Author: Rasmus Lerdorf <rasmus@lerdorf.on.ca> | +----------------------------------------------------------------------+ */ -/* $Id: head.c,v 1.84.2.1 2006/01/01 12:50:14 sniper Exp $ */ +/* $Id: head.c,v 1.84.2.1.2.1 2006/08/10 13:50:56 iliaa Exp $ */ #include <stdio.h> #include "php.h" @@ -60,7 +60,7 @@ } -PHPAPI int php_setcookie(char *name, int name_len, char *value, int value_len, time_t expires, char *path, int path_len, char *domain, int domain_len, int secure, int url_encode TSRMLS_DC) +PHPAPI int php_setcookie(char *name, int name_len, char *value, int value_len, time_t expires, char *path, int path_len, char *domain, int domain_len, int secure, int url_encode, int httponly TSRMLS_DC) { char *cookie, *encoded_value = NULL; int len=sizeof("Set-Cookie: "); @@ -131,6 +131,9 @@ if (secure) { strcat(cookie, "; secure"); } + if (httponly) { + strcat(cookie, "; httponly"); + } ctr.line = cookie; ctr.line_len = strlen(cookie); @@ -142,22 +145,22 @@ /* php_set_cookie(name, value, expires, path, domain, secure) */ -/* {{{ proto bool setcookie(string name [, string value [, int expires [, string path [, string domain [, bool secure]]]]]) +/* {{{ proto bool setcookie(string name [, string value [, int expires [, string path [, string domain [, bool secure[, bool httponly]]]]]]) Send a cookie */ PHP_FUNCTION(setcookie) { char *name, *value = NULL, *path = NULL, *domain = NULL; long expires = 0; - zend_bool secure = 0; + zend_bool secure = 0, httponly = 0; int name_len, value_len, path_len, domain_len; - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|slssb", &name, + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|slssbb", &name, &name_len, &value, &value_len, &expires, &path, - &path_len, &domain, &domain_len, &secure) == FAILURE) { + &path_len, &domain, &domain_len, &secure, &httponly) == FAILURE) { return; } - if (php_setcookie(name, name_len, value, value_len, expires, path, path_len, domain, domain_len, secure, 1 TSRMLS_CC) == SUCCESS) { + if (php_setcookie(name, name_len, value, value_len, expires, path, path_len, domain, domain_len, secure, 1, httponly TSRMLS_CC) == SUCCESS) { RETVAL_TRUE; } else { RETVAL_FALSE; @@ -165,22 +168,22 @@ } /* }}} */ -/* {{{ proto bool setrawcookie(string name [, string value [, int expires [, string path [, string domain [, bool secure]]]]]) +/* {{{ proto bool setrawcookie(string name [, string value [, int expires [, string path [, string domain [, bool secure[, bool httponly]]]]]]) Send a cookie with no url encoding of the value */ PHP_FUNCTION(setrawcookie) { char *name, *value = NULL, *path = NULL, *domain = NULL; long expires = 0; - zend_bool secure = 0; + zend_bool secure = 0, httponly = 0; int name_len, value_len, path_len, domain_len; - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|slssb", &name, + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|slssbb", &name, &name_len, &value, &value_len, &expires, &path, - &path_len, &domain, &domain_len, &secure) == FAILURE) { + &path_len, &domain, &domain_len, &secure, &httponly) == FAILURE) { return; } - if (php_setcookie(name, name_len, value, value_len, expires, path, path_len, domain, domain_len, secure, 0 TSRMLS_CC) == SUCCESS) { + if (php_setcookie(name, name_len, value, value_len, expires, path, path_len, domain, domain_len, secure, 0, httponly TSRMLS_CC) == SUCCESS) { RETVAL_TRUE; } else { RETVAL_FALSE; http://cvs.php.net/viewvc.cgi/php-src/ext/standard/head.h?r1=1.28.2.1&r2=1.28.2.1.2.1&diff_format=u Index: php-src/ext/standard/head.h diff -u php-src/ext/standard/head.h:1.28.2.1 php-src/ext/standard/head.h:1.28.2.1.2.1 --- php-src/ext/standard/head.h:1.28.2.1 Sun Jan 1 12:50:14 2006 +++ php-src/ext/standard/head.h Thu Aug 10 13:50:56 2006 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: head.h,v 1.28.2.1 2006/01/01 12:50:14 sniper Exp $ */ +/* $Id: head.h,v 1.28.2.1.2.1 2006/08/10 13:50:56 iliaa Exp $ */ #ifndef HEAD_H #define HEAD_H @@ -29,6 +29,6 @@ PHP_FUNCTION(headers_list); PHPAPI int php_header(TSRMLS_D); -PHPAPI int php_setcookie(char *name, int name_len, char *value, int value_len, time_t expires, char *path, int path_len, char *domain, int domain_len, int secure, int url_encode TSRMLS_DC); +PHPAPI int php_setcookie(char *name, int name_len, char *value, int value_len, time_t expires, char *path, int path_len, char *domain, int domain_len, int secure, int url_encode, int httponly TSRMLS_DC); #endif http://cvs.php.net/viewvc.cgi/php-src/ext/session/php_session.h?r1=1.101.2.2.2.1&r2=1.101.2.2.2.2&diff_format=u Index: php-src/ext/session/php_session.h diff -u php-src/ext/session/php_session.h:1.101.2.2.2.1 php-src/ext/session/php_session.h:1.101.2.2.2.2 --- php-src/ext/session/php_session.h:1.101.2.2.2.1 Thu Jul 27 15:33:16 2006 +++ php-src/ext/session/php_session.h Thu Aug 10 13:50:56 2006 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: php_session.h,v 1.101.2.2.2.1 2006/07/27 15:33:16 iliaa Exp $ */ +/* $Id: php_session.h,v 1.101.2.2.2.2 2006/08/10 13:50:56 iliaa Exp $ */ #ifndef PHP_SESSION_H #define PHP_SESSION_H @@ -103,6 +103,7 @@ char *cookie_path; char *cookie_domain; zend_bool cookie_secure; + zend_bool cookie_httponly; ps_module *mod; void *mod_data; php_session_status session_status; http://cvs.php.net/viewvc.cgi/php-src/ext/session/session.c?r1=1.417.2.8.2.10&r2=1.417.2.8.2.11&diff_format=u Index: php-src/ext/session/session.c diff -u php-src/ext/session/session.c:1.417.2.8.2.10 php-src/ext/session/session.c:1.417.2.8.2.11 --- php-src/ext/session/session.c:1.417.2.8.2.10 Wed Aug 2 09:16:52 2006 +++ php-src/ext/session/session.c Thu Aug 10 13:50:56 2006 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: session.c,v 1.417.2.8.2.10 2006/08/02 09:16:52 tony2001 Exp $ */ +/* $Id: session.c,v 1.417.2.8.2.11 2006/08/10 13:50:56 iliaa Exp $ */ #ifdef HAVE_CONFIG_H #include "config.h" @@ -165,6 +165,7 @@ STD_PHP_INI_ENTRY("session.cookie_path", "/", PHP_INI_ALL, OnUpdateString, cookie_path, php_ps_globals, ps_globals) STD_PHP_INI_ENTRY("session.cookie_domain", "", PHP_INI_ALL, OnUpdateString, cookie_domain, php_ps_globals, ps_globals) STD_PHP_INI_BOOLEAN("session.cookie_secure", "", PHP_INI_ALL, OnUpdateBool, cookie_secure, php_ps_globals, ps_globals) + STD_PHP_INI_BOOLEAN("session.cookie_httponly", "", PHP_INI_ALL, OnUpdateBool, cookie_httponly, php_ps_globals, ps_globals) STD_PHP_INI_BOOLEAN("session.use_cookies", "1", PHP_INI_ALL, OnUpdateBool, use_cookies, php_ps_globals, ps_globals) STD_PHP_INI_BOOLEAN("session.use_only_cookies", "0", PHP_INI_ALL, OnUpdateBool, use_only_cookies, php_ps_globals, ps_globals) STD_PHP_INI_ENTRY("session.referer_check", "", PHP_INI_ALL, OnUpdateString, extern_referer_chk, php_ps_globals, ps_globals) @@ -1012,6 +1013,7 @@ #define COOKIE_PATH "; path=" #define COOKIE_DOMAIN "; domain=" #define COOKIE_SECURE "; secure" +#define COOKIE_HTTPONLY "; HttpOnly" static void php_session_send_cookie(TSRMLS_D) { @@ -1065,6 +1067,10 @@ smart_str_appends(&ncookie, COOKIE_SECURE); } + if (PS(cookie_httponly)) { + smart_str_appends(&ncookie, COOKIE_HTTPONLY); + } + smart_str_0(&ncookie); /* 'replace' must be 0 here, else a previous Set-Cookie @@ -1296,13 +1302,13 @@ Set session cookie parameters */ PHP_FUNCTION(session_set_cookie_params) { - zval **lifetime, **path, **domain, **secure; + zval **lifetime, **path, **domain, **secure, **httponly; if (!PS(use_cookies)) return; - if (ZEND_NUM_ARGS() < 1 || ZEND_NUM_ARGS() > 4 || - zend_get_parameters_ex(ZEND_NUM_ARGS(), &lifetime, &path, &domain, &secure) == FAILURE) + if (ZEND_NUM_ARGS() < 1 || ZEND_NUM_ARGS() > 5 || + zend_get_parameters_ex(ZEND_NUM_ARGS(), &lifetime, &path, &domain, &secure, &httponly) == FAILURE) WRONG_PARAM_COUNT; convert_to_string_ex(lifetime); @@ -1319,6 +1325,10 @@ convert_to_long_ex(secure); zend_alter_ini_entry("session.cookie_secure", sizeof("session.cookie_secure"), Z_BVAL_PP(secure)?"1":"0", 1, PHP_INI_USER, PHP_INI_STAGE_RUNTIME); } + if (ZEND_NUM_ARGS() > 4) { + convert_to_long_ex(httponly); + zend_alter_ini_entry("session.cookie_httponly", sizeof("session.cookie_httponly"), Z_BVAL_PP(httponly)?"1":"0", 1, PHP_INI_USER, PHP_INI_STAGE_RUNTIME); + } } } } @@ -1338,6 +1348,7 @@ add_assoc_string(return_value, "path", PS(cookie_path), 1); add_assoc_string(return_value, "domain", PS(cookie_domain), 1); add_assoc_bool(return_value, "secure", PS(cookie_secure)); + add_assoc_bool(return_value, "httponly", PS(cookie_httponly)); } /* }}} */