Re: httpOnly Cookies [tiny enhancement]

Hello, as suggested by Andi and Nuno, setcookie() and setrawcookie() should not take more than six parameters. Overloading the function with an array as the third parameter is preferred. The patch in the attachment considers these suggestions. To not break compatibility with existing code, the cookie functions can still be called like this: bool setcookie ( string name [, string value [, int expire [, string path [, string domain [, bool secure ]]] ) bool setrawcookie ( string name [, string value [, int expire [, string path [, string domain [, bool secure]]]]) Additionally, they now may be called this way: bool setcookie ( string name, string value, indexed_array parameters) bool setrawcookie ( string name, string value, indexed_array parameters) The indexed array 'parameters' is expected to be: array( {int|string} expires [, string path [, domain [, bool secure [,bool httponly]]]] ) If 'expires' is an int, it will be treated the usual way. If it is a string, the string is expected to be tokenized like this: Y:M:D:h:m:s Meaning: How many years (Y) [365 days], months (M) [30 days], days (D), hours (h), minutes (m) and secondes (s) from now on, shall the cookie be valid? Examples: The following calls to setcookie() are all equivalent: setcookie("test","101",mktime()+60*60,"/","localhost",1) setcookie("test","101",array(mktime()+60*60,"/","localhost",1)) setcookie("test","101",array("0:0:0:1:0:0","/","localhost",1)) setcookie("test","101",array(":::1","/","localhost",1)) Of course, if you want a httpOnly cookie, you should call setcookie("test","101",array(":::1","/","localhost",1,1)) ------ Patches for httpOnly session cookies are the same as before. Again, I hope this is useful and not bug-ridden... Jochen [ ext/standard/head.c.patch ; ext/standard/head.h.patch ]

Attachment: [text/x-patch] head.c.patch
Attachment: [text/x-patch] head.h.patch