Set HttpOnly flag also for session cookie

Aleksander Machniak

2012-07-24 0afe27901189a5416dc696eef32e2bc2e5fe3844

 program/include/rcube_output_html.php

@@ -68,7 +68,9 @@
        $this->set_env('x_frame_options', $this->config->get('x_frame_options', 'sameorigin'));

        // load the correct skin (in case user-defined)
        $this->set_skin($this->config->get('skin'));
        $skin = $this->config->get('skin');
        $this->set_skin($skin);
        $this->set_env('skin', $skin);

        // add common javascripts
        $this->add_script('var '.rcmail::JS_OBJECT_NAME.' = new rcube_webmail();', 'head_top');
@@ -933,7 +935,7 @@
            // make valid href to specific buttons
            if (in_array($attrib['command'], rcmail::$main_tasks)) {
                $attrib['href']    = $this->app->url(array('task' => $attrib['command']));
                $attrib['onclick'] = sprintf("%s.command('switch-task','%s');return false", rcmail::JS_OBJECT_NAME, $attrib['command']);
                $attrib['onclick'] = sprintf("%s.command('switch-task','%s',null,event); return false", rcmail::JS_OBJECT_NAME, $attrib['command']);
            }
            else if ($attrib['task'] && in_array($attrib['task'], rcmail::$main_tasks)) {
                $attrib['href'] = $this->app->url(array('action' => $attrib['command'], 'task' => $attrib['task']));
@@ -956,7 +958,7 @@
        }
        else if ($command && !$attrib['onclick']) {
            $attrib['onclick'] = sprintf(
                "return %s.command('%s','%s',this)",
                "return %s.command('%s','%s',this,event)",
                rcmail::JS_OBJECT_NAME,
                $command,
                $attrib['prop']
@@ -1485,7 +1487,7 @@
        if (empty($attrib['form'])) {
            $out = $this->form_tag(array(
                'name' => "rcmqsearchform",
                'onsubmit' => rcmail::JS_OBJECT_NAME . ".command('search');return false;",
                'onsubmit' => rcmail::JS_OBJECT_NAME . ".command('search'); return false",
                'style' => "display:inline"),
                $out);
        }