Set HttpOnly flag also for session cookie

Aleksander Machniak

2012-07-24 0afe27901189a5416dc696eef32e2bc2e5fe3844

 program/include/rcube_output_html.php

@@ -17,10 +17,7 @@
 +-----------------------------------------------------------------------+
 | Author: Thomas Bruederli <roundcube@gmail.com>                        |
 +-----------------------------------------------------------------------+

 $Id$

 */
*/


/**
@@ -71,13 +68,15 @@
        $this->set_env('x_frame_options', $this->config->get('x_frame_options', 'sameorigin'));

        // load the correct skin (in case user-defined)
        $this->set_skin($this->config->get('skin'));
        $skin = $this->config->get('skin');
        $this->set_skin($skin);
        $this->set_env('skin', $skin);

        // add common javascripts
        $this->add_script('var '.JS_OBJECT_NAME.' = new rcube_webmail();', 'head_top');
        $this->add_script('var '.rcmail::JS_OBJECT_NAME.' = new rcube_webmail();', 'head_top');

        // don't wait for page onload. Call init at the bottom of the page (delayed)
        $this->add_script(JS_OBJECT_NAME.'.init();', 'docready');
        $this->add_script(rcmail::JS_OBJECT_NAME.'.init();', 'docready');

        $this->scripts_path = 'program/js/';
        $this->include_script('jquery.min.js');
@@ -183,7 +182,7 @@
     */
    public function add_gui_object($obj, $id)
    {
        $this->add_script(JS_OBJECT_NAME.".gui_object('$obj', '$id');");
        $this->add_script(rcmail::JS_OBJECT_NAME.".gui_object('$obj', '$id');");
    }


@@ -457,7 +456,7 @@
    {
        $out = '';
        if (!$this->framed && !empty($this->js_env)) {
            $out .= JS_OBJECT_NAME . '.set_env('.self::json_serialize($this->js_env).");\n";
            $out .= rcmail::JS_OBJECT_NAME . '.set_env('.self::json_serialize($this->js_env).");\n";
        }
        if (!empty($this->js_labels)) {
            $this->command('add_label', $this->js_labels);
@@ -470,7 +469,7 @@
            $parent = $this->framed || preg_match('/^parent\./', $method);
            $out .= sprintf(
                "%s.%s(%s);\n",
                ($parent ? 'if(window.parent && parent.'.JS_OBJECT_NAME.') parent.' : '') . JS_OBJECT_NAME,
                ($parent ? 'if(window.parent && parent.'.rcmail::JS_OBJECT_NAME.') parent.' : '') . rcmail::JS_OBJECT_NAME,
                preg_replace('/^parent\./', '', $method),
                implode(',', $args)
            );
@@ -644,7 +643,7 @@
                "\$_SESSION['\\1']",
                "\$this->app->config->get('\\1',get_boolean('\\3'))",
                "\$this->env['\\1']",
                "rcube_ui::get_input_value('\\1', rcube_ui::INPUT_GPC)",
                "rcube_utils::get_input_value('\\1', rcube_utils::INPUT_GPC)",
                "\$_COOKIE['\\1']",
                "\$this->browser->{'\\1'}",
                $this->template_name,
@@ -770,6 +769,13 @@
                        if (preg_match('/Revision:\s(\d+)/', @shell_exec('svn info'), $regs))
                          $ver .= ' [SVN r'.$regs[1].']';
                    }
                    else if (is_file(INSTALL_PATH . '.git/index')) {
                        if (preg_match('/Date:\s+([^\n]+)/', @shell_exec('git log -1'), $regs)) {
                            if ($date = date('Ymd.Hi', strtotime($regs[1]))) {
                                $ver .= ' [GIT '.$date.']';
                            }
                        }
                    }
                    $content = html::quote($ver);
                }
                else if ($object == 'steptitle') {
@@ -812,7 +818,7 @@
                        }
                        break;
                    case 'request':
                        $value = rcube_ui::get_input_value($name, rcube_ui::INPUT_GPC);
                        $value = rcube_utils::get_input_value($name, rcube_utils::INPUT_GPC);
                        break;
                    case 'session':
                        $value = $_SESSION[$name];
@@ -917,7 +923,7 @@
        if ($attrib['command']) {
            $this->add_script(sprintf(
                "%s.register_button('%s', '%s', '%s', '%s', '%s', '%s');",
                JS_OBJECT_NAME,
                rcmail::JS_OBJECT_NAME,
                $command,
                $attrib['id'],
                $attrib['type'],
@@ -929,7 +935,7 @@
            // make valid href to specific buttons
            if (in_array($attrib['command'], rcmail::$main_tasks)) {
                $attrib['href']    = $this->app->url(array('task' => $attrib['command']));
                $attrib['onclick'] = sprintf("%s.command('switch-task','%s');return false", JS_OBJECT_NAME, $attrib['command']);
                $attrib['onclick'] = sprintf("%s.command('switch-task','%s',null,event); return false", rcmail::JS_OBJECT_NAME, $attrib['command']);
            }
            else if ($attrib['task'] && in_array($attrib['task'], rcmail::$main_tasks)) {
                $attrib['href'] = $this->app->url(array('action' => $attrib['command'], 'task' => $attrib['task']));
@@ -952,8 +958,8 @@
        }
        else if ($command && !$attrib['onclick']) {
            $attrib['onclick'] = sprintf(
                "return %s.command('%s','%s',this)",
                JS_OBJECT_NAME,
                "return %s.command('%s','%s',this,event)",
                rcmail::JS_OBJECT_NAME,
                $command,
                $attrib['prop']
            );
@@ -1206,7 +1212,7 @@
            array($this, 'file_callback'), $output);

        // trigger hook with final HTML content to be sent
        $hook = rcmail::get_instance()->plugins->exec_hook("send_page", array('content' => $output));
        $hook = $this->app->plugins->exec_hook("send_page", array('content' => $output));
        if (!$hook['abort']) {
            if ($this->charset != RCMAIL_CHARSET) {
                echo rcube_charset::convert($hook['content'], RCMAIL_CHARSET, $this->charset);
@@ -1225,21 +1231,21 @@
     */
    protected function file_callback($matches)
    {
       $file = $matches[3];
        $file = $matches[3];

        // correct absolute paths
       if ($file[0] == '/') {
           $file = $this->base_path . $file;
        if ($file[0] == '/') {
            $file = $this->base_path . $file;
        }

        // add file modification timestamp
       if (preg_match('/\.(js|css)$/', $file)) {
        if (preg_match('/\.(js|css)$/', $file)) {
            if ($fs = @filemtime($file)) {
                $file .= '?s=' . $fs;
            }
        }

       return $matches[1] . '=' . $matches[2] . $file . $matches[4];
        return $matches[1] . '=' . $matches[2] . $file . $matches[4];
    }


@@ -1328,7 +1334,7 @@
            $username = $this->app->user->get_username();
        }

        return rcube_idn_to_utf8($username);
        return rcube_utils::idn_to_utf8($username);
    }


@@ -1347,7 +1353,7 @@
        $_SESSION['temp'] = true;

        // save original url
        $url = rcube_ui::get_input_value('_url', rcube_ui::INPUT_POST);
        $url = rcube_utils::get_input_value('_url', rcube_utils::INPUT_POST);
        if (empty($url) && !preg_match('/_(task|action)=logout/', $_SERVER['QUERY_STRING']))
            $url = $_SERVER['QUERY_STRING'];

@@ -1397,7 +1403,7 @@
        $table = new html_table(array('cols' => 2));

        $table->add('title', html::label('rcmloginuser', html::quote($this->app->gettext('username'))));
        $table->add('input', $input_user->show(rcube_ui::get_input_value('_user', rcube_ui::INPUT_GPC)));
        $table->add('input', $input_user->show(rcube_utils::get_input_value('_user', rcube_utils::INPUT_GPC)));

        $table->add('title', html::label('rcmloginpwd', html::quote($this->app->gettext('password'))));
        $table->add('input', $input_pass->show());
@@ -1405,7 +1411,7 @@
        // add host selection row
        if (is_object($input_host) && !$hide_host) {
            $table->add('title', html::label('rcmloginhost', html::quote($this->app->gettext('server'))));
            $table->add('input', $input_host->show(rcube_ui::get_input_value('_host', rcube_ui::INPUT_GPC)));
            $table->add('input', $input_host->show(rcube_utils::get_input_value('_host', rcube_utils::INPUT_GPC)));
        }

        $out  = $input_task->show();
@@ -1481,7 +1487,7 @@
        if (empty($attrib['form'])) {
            $out = $this->form_tag(array(
                'name' => "rcmqsearchform",
                'onsubmit' => JS_OBJECT_NAME . ".command('search');return false;",
                'onsubmit' => rcmail::JS_OBJECT_NAME . ".command('search'); return false",
                'style' => "display:inline"),
                $out);
        }
@@ -1560,16 +1566,20 @@
            'GB2312'       => 'GB2312 ('.$this->app->gettext('chinese').')',
        );

        if (!empty($_POST['_charset']))
           $set = $_POST['_charset'];
       else if (!empty($attrib['selected']))
           $set = $attrib['selected'];
       else
           $set = $this->get_charset();
        if (!empty($_POST['_charset'])) {
            $set = $_POST['_charset'];
        }
        else if (!empty($attrib['selected'])) {
            $set = $attrib['selected'];
        }
        else {
            $set = $this->get_charset();
        }

       $set = strtoupper($set);
       if (!isset($charsets[$set]))
           $charsets[$set] = $set;
        $set = strtoupper($set);
        if (!isset($charsets[$set])) {
            $charsets[$set] = $set;
        }

        $select = new html_select($field_attrib);
        $select->add(array_values($charsets), array_keys($charsets));