cvs: php-src / php.ini-dist php.ini-recommended /ext/session php_session.h session.c /ext/standard head.c head.h

iliaa Thu Aug 10 13:56:54 2006 UTC Modified files: /php-src php.ini-dist php.ini-recommended /php-src/ext/standard head.c head.h /php-src/ext/session php_session.h session.c Log: MFB: Added support for httpOnly flag for session extension and cookie setting functions.

http://cvs.php.net/viewvc.cgi/php-src/php.ini-dist?r1=1.250&r2=1.251&diff_format=u Index: php-src/php.ini-dist diff -u php-src/php.ini-dist:1.250 php-src/php.ini-dist:1.251 --- php-src/php.ini-dist:1.250 Wed Jun 28 15:07:14 2006 +++ php-src/php.ini-dist Thu Aug 10 13:56:54 2006 @@ -842,6 +842,9 @@ ; The domain for which the cookie is valid. session.cookie_domain = +; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript. +session.cookie_httponly = + ; Handler used to serialize data. php is the standard serializer of PHP. session.serialize_handler = php http://cvs.php.net/viewvc.cgi/php-src/php.ini-recommended?r1=1.199&r2=1.200&diff_format=u Index: php-src/php.ini-recommended diff -u php-src/php.ini-recommended:1.199 php-src/php.ini-recommended:1.200 --- php-src/php.ini-recommended:1.199 Wed Jun 28 15:07:14 2006 +++ php-src/php.ini-recommended Thu Aug 10 13:56:54 2006 @@ -873,6 +873,9 @@ ; The domain for which the cookie is valid. session.cookie_domain = +; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript. +session.cookie_httponly = + ; Handler used to serialize data. php is the standard serializer of PHP. session.serialize_handler = php http://cvs.php.net/viewvc.cgi/php-src/ext/standard/head.c?r1=1.88&r2=1.89&diff_format=u Index: php-src/ext/standard/head.c diff -u php-src/ext/standard/head.c:1.88 php-src/ext/standard/head.c:1.89 --- php-src/ext/standard/head.c:1.88 Sat Jun 3 11:19:43 2006 +++ php-src/ext/standard/head.c Thu Aug 10 13:56:54 2006 @@ -15,7 +15,7 @@ | Author: Rasmus Lerdorf <rasmus@lerdorf.on.ca> | +----------------------------------------------------------------------+ */ -/* $Id: head.c,v 1.88 2006/06/03 11:19:43 mike Exp $ */ +/* $Id: head.c,v 1.89 2006/08/10 13:56:54 iliaa Exp $ */ #include <stdio.h> #include "php.h" @@ -59,7 +59,7 @@ } -PHPAPI int php_setcookie(char *name, int name_len, char *value, int value_len, time_t expires, char *path, int path_len, char *domain, int domain_len, int secure, int url_encode TSRMLS_DC) +PHPAPI int php_setcookie(char *name, int name_len, char *value, int value_len, time_t expires, char *path, int path_len, char *domain, int domain_len, int secure, int url_encode, int httponly TSRMLS_DC) { char *cookie, *encoded_value = NULL; int len=sizeof("Set-Cookie: "); @@ -130,6 +130,9 @@ if (secure) { strcat(cookie, "; secure"); } + if (httponly) { + strcat(cookie, "; httponly"); + } ctr.line = cookie; ctr.line_len = strlen(cookie); @@ -141,22 +144,22 @@ /* php_set_cookie(name, value, expires, path, domain, secure) */ -/* {{{ proto bool setcookie(string name [, string value [, int expires [, string path [, string domain [, bool secure]]]]]) +/* {{{ proto bool setcookie(string name [, string value [, int expires [, string path [, string domain [, bool secure[, bool httponly]]]]]]) Send a cookie */ PHP_FUNCTION(setcookie) { char *name, *value = NULL, *path = NULL, *domain = NULL; long expires = 0; - zend_bool secure = 0; + zend_bool secure = 0, httponly = 0; int name_len, value_len, path_len, domain_len; - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|slssb", &name, + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|slssbb", &name, &name_len, &value, &value_len, &expires, &path, - &path_len, &domain, &domain_len, &secure) == FAILURE) { + &path_len, &domain, &domain_len, &secure, &httponly) == FAILURE) { return; } - if (php_setcookie(name, name_len, value, value_len, expires, path, path_len, domain, domain_len, secure, 1 TSRMLS_CC) == SUCCESS) { + if (php_setcookie(name, name_len, value, value_len, expires, path, path_len, domain, domain_len, secure, 1, httponly TSRMLS_CC) == SUCCESS) { RETVAL_TRUE; } else { RETVAL_FALSE; @@ -164,22 +167,22 @@ } /* }}} */ -/* {{{ proto bool setrawcookie(string name [, string value [, int expires [, string path [, string domain [, bool secure]]]]]) +/* {{{ proto bool setrawcookie(string name [, string value [, int expires [, string path [, string domain [, bool secure[, bool httponly]]]]]]) Send a cookie with no url encoding of the value */ PHP_FUNCTION(setrawcookie) { char *name, *value = NULL, *path = NULL, *domain = NULL; long expires = 0; - zend_bool secure = 0; + zend_bool secure = 0, httponly = 0; int name_len, value_len, path_len, domain_len; - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|slssb", &name, + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|slssbb", &name, &name_len, &value, &value_len, &expires, &path, - &path_len, &domain, &domain_len, &secure) == FAILURE) { + &path_len, &domain, &domain_len, &secure, &httponly) == FAILURE) { return; } - if (php_setcookie(name, name_len, value, value_len, expires, path, path_len, domain, domain_len, secure, 0 TSRMLS_CC) == SUCCESS) { + if (php_setcookie(name, name_len, value, value_len, expires, path, path_len, domain, domain_len, secure, 0, httponly TSRMLS_CC) == SUCCESS) { RETVAL_TRUE; } else { RETVAL_FALSE; http://cvs.php.net/viewvc.cgi/php-src/ext/standard/head.h?r1=1.29&r2=1.30&diff_format=u Index: php-src/ext/standard/head.h diff -u php-src/ext/standard/head.h:1.29 php-src/ext/standard/head.h:1.30 --- php-src/ext/standard/head.h:1.29 Sun Jan 1 13:09:55 2006 +++ php-src/ext/standard/head.h Thu Aug 10 13:56:54 2006 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: head.h,v 1.29 2006/01/01 13:09:55 sniper Exp $ */ +/* $Id: head.h,v 1.30 2006/08/10 13:56:54 iliaa Exp $ */ #ifndef HEAD_H #define HEAD_H @@ -29,6 +29,6 @@ PHP_FUNCTION(headers_list); PHPAPI int php_header(TSRMLS_D); -PHPAPI int php_setcookie(char *name, int name_len, char *value, int value_len, time_t expires, char *path, int path_len, char *domain, int domain_len, int secure, int url_encode TSRMLS_DC); +PHPAPI int php_setcookie(char *name, int name_len, char *value, int value_len, time_t expires, char *path, int path_len, char *domain, int domain_len, int secure, int url_encode, int httponly TSRMLS_DC); #endif http://cvs.php.net/viewvc.cgi/php-src/ext/session/php_session.h?r1=1.107&r2=1.108&diff_format=u Index: php-src/ext/session/php_session.h diff -u php-src/ext/session/php_session.h:1.107 php-src/ext/session/php_session.h:1.108 --- php-src/ext/session/php_session.h:1.107 Thu Jul 27 15:36:43 2006 +++ php-src/ext/session/php_session.h Thu Aug 10 13:56:54 2006 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: php_session.h,v 1.107 2006/07/27 15:36:43 iliaa Exp $ */ +/* $Id: php_session.h,v 1.108 2006/08/10 13:56:54 iliaa Exp $ */ #ifndef PHP_SESSION_H #define PHP_SESSION_H @@ -103,6 +103,7 @@ char *cookie_path; char *cookie_domain; zend_bool cookie_secure; + zend_bool cookie_httponly; ps_module *mod; void *mod_data; php_session_status session_status; http://cvs.php.net/viewvc.cgi/php-src/ext/session/session.c?r1=1.445&r2=1.446&diff_format=u Index: php-src/ext/session/session.c diff -u php-src/ext/session/session.c:1.445 php-src/ext/session/session.c:1.446 --- php-src/ext/session/session.c:1.445 Wed Aug 2 09:15:13 2006 +++ php-src/ext/session/session.c Thu Aug 10 13:56:54 2006 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: session.c,v 1.445 2006/08/02 09:15:13 tony2001 Exp $ */ +/* $Id: session.c,v 1.446 2006/08/10 13:56:54 iliaa Exp $ */ #ifdef HAVE_CONFIG_H #include "config.h" @@ -158,6 +158,7 @@ STD_PHP_INI_ENTRY("session.cookie_path", "/", PHP_INI_ALL, OnUpdateString, cookie_path, php_ps_globals, ps_globals) STD_PHP_INI_ENTRY("session.cookie_domain", "", PHP_INI_ALL, OnUpdateString, cookie_domain, php_ps_globals, ps_globals) STD_PHP_INI_BOOLEAN("session.cookie_secure", "", PHP_INI_ALL, OnUpdateBool, cookie_secure, php_ps_globals, ps_globals) + STD_PHP_INI_BOOLEAN("session.cookie_httponly", "", PHP_INI_ALL, OnUpdateBool, cookie_httponly, php_ps_globals, ps_globals) STD_PHP_INI_BOOLEAN("session.use_cookies", "1", PHP_INI_ALL, OnUpdateBool, use_cookies, php_ps_globals, ps_globals) STD_PHP_INI_BOOLEAN("session.use_only_cookies", "1", PHP_INI_ALL, OnUpdateBool, use_only_cookies, php_ps_globals, ps_globals) STD_PHP_INI_ENTRY("session.referer_check", "", PHP_INI_ALL, OnUpdateString, extern_referer_chk, php_ps_globals, ps_globals) @@ -902,6 +903,7 @@ #define COOKIE_PATH "; path=" #define COOKIE_DOMAIN "; domain=" #define COOKIE_SECURE "; secure" +#define COOKIE_HTTPONLY "; HttpOnly" static void php_session_send_cookie(TSRMLS_D) { @@ -955,6 +957,10 @@ smart_str_appends(&ncookie, COOKIE_SECURE); } + if (PS(cookie_httponly)) { + smart_str_appends(&ncookie, COOKIE_HTTPONLY); + } + smart_str_0(&ncookie); /* 'replace' must be 0 here, else a previous Set-Cookie @@ -1186,13 +1192,13 @@ Set session cookie parameters */ PHP_FUNCTION(session_set_cookie_params) { - zval **lifetime, **path, **domain, **secure; + zval **lifetime, **path, **domain, **secure, **httponly; if (!PS(use_cookies)) return; - if (ZEND_NUM_ARGS() < 1 || ZEND_NUM_ARGS() > 4 || - zend_get_parameters_ex(ZEND_NUM_ARGS(), &lifetime, &path, &domain, &secure) == FAILURE) + if (ZEND_NUM_ARGS() < 1 || ZEND_NUM_ARGS() > 5 || + zend_get_parameters_ex(ZEND_NUM_ARGS(), &lifetime, &path, &domain, &secure, &httponly) == FAILURE) WRONG_PARAM_COUNT; convert_to_string_ex(lifetime); @@ -1209,6 +1215,10 @@ convert_to_long_ex(secure); zend_alter_ini_entry("session.cookie_secure", sizeof("session.cookie_secure"), Z_BVAL_PP(secure)?"1":"0", 1, PHP_INI_USER, PHP_INI_STAGE_RUNTIME); } + if (ZEND_NUM_ARGS() > 4) { + convert_to_long_ex(httponly); + zend_alter_ini_entry("session.cookie_httponly", sizeof("session.cookie_httponly"), Z_BVAL_PP(httponly)?"1":"0", 1, PHP_INI_USER, PHP_INI_STAGE_RUNTIME); + } } } } @@ -1228,6 +1238,7 @@ add_assoc_string(return_value, "path", PS(cookie_path), 1); add_assoc_string(return_value, "domain", PS(cookie_domain), 1); add_assoc_bool(return_value, "secure", PS(cookie_secure)); + add_assoc_bool(return_value, "httponly", PS(cookie_httponly)); } /* }}} */