Set HttpOnly flag also for session cookie

Aleksander Machniak

2012-07-24 0afe27901189a5416dc696eef32e2bc2e5fe3844

 program/include/rcube_output_html.php

@@ -68,7 +68,9 @@
        $this->set_env('x_frame_options', $this->config->get('x_frame_options', 'sameorigin'));

        // load the correct skin (in case user-defined)
        $this->set_skin($this->config->get('skin'));
        $skin = $this->config->get('skin');
        $this->set_skin($skin);
        $this->set_env('skin', $skin);

        // add common javascripts
        $this->add_script('var '.rcmail::JS_OBJECT_NAME.' = new rcube_webmail();', 'head_top');
@@ -933,7 +935,7 @@
            // make valid href to specific buttons
            if (in_array($attrib['command'], rcmail::$main_tasks)) {
                $attrib['href']    = $this->app->url(array('task' => $attrib['command']));
                $attrib['onclick'] = sprintf("%s.command('switch-task','%s');return false", rcmail::JS_OBJECT_NAME, $attrib['command']);
                $attrib['onclick'] = sprintf("%s.command('switch-task','%s',null,event); return false", rcmail::JS_OBJECT_NAME, $attrib['command']);
            }
            else if ($attrib['task'] && in_array($attrib['task'], rcmail::$main_tasks)) {
                $attrib['href'] = $this->app->url(array('action' => $attrib['command'], 'task' => $attrib['task']));
@@ -956,7 +958,7 @@
        }
        else if ($command && !$attrib['onclick']) {
            $attrib['onclick'] = sprintf(
                "return %s.command('%s','%s',this)",
                "return %s.command('%s','%s',this,event)",
                rcmail::JS_OBJECT_NAME,
                $command,
                $attrib['prop']
@@ -1229,21 +1231,21 @@
     */
    protected function file_callback($matches)
    {
       $file = $matches[3];
        $file = $matches[3];

        // correct absolute paths
       if ($file[0] == '/') {
           $file = $this->base_path . $file;
        if ($file[0] == '/') {
            $file = $this->base_path . $file;
        }

        // add file modification timestamp
       if (preg_match('/\.(js|css)$/', $file)) {
        if (preg_match('/\.(js|css)$/', $file)) {
            if ($fs = @filemtime($file)) {
                $file .= '?s=' . $fs;
            }
        }

       return $matches[1] . '=' . $matches[2] . $file . $matches[4];
        return $matches[1] . '=' . $matches[2] . $file . $matches[4];
    }


@@ -1485,7 +1487,7 @@
        if (empty($attrib['form'])) {
            $out = $this->form_tag(array(
                'name' => "rcmqsearchform",
                'onsubmit' => rcmail::JS_OBJECT_NAME . ".command('search');return false;",
                'onsubmit' => rcmail::JS_OBJECT_NAME . ".command('search'); return false",
                'style' => "display:inline"),
                $out);
        }
@@ -1564,16 +1566,20 @@
            'GB2312'       => 'GB2312 ('.$this->app->gettext('chinese').')',
        );

        if (!empty($_POST['_charset']))
           $set = $_POST['_charset'];
       else if (!empty($attrib['selected']))
           $set = $attrib['selected'];
       else
           $set = $this->get_charset();
        if (!empty($_POST['_charset'])) {
            $set = $_POST['_charset'];
        }
        else if (!empty($attrib['selected'])) {
            $set = $attrib['selected'];
        }
        else {
            $set = $this->get_charset();
        }

       $set = strtoupper($set);
       if (!isset($charsets[$set]))
           $charsets[$set] = $set;
        $set = strtoupper($set);
        if (!isset($charsets[$set])) {
            $charsets[$set] = $set;
        }

        $select = new html_select($field_attrib);
        $select->add(array_values($charsets), array_keys($charsets));