diff options
| -rw-r--r-- | conf/dokuwiki.php | 3 | ||||
| -rw-r--r-- | inc/auth.php | 13 | ||||
| -rw-r--r-- | inc/init.php | 26 | ||||
| -rw-r--r-- | lib/plugins/config/lang/en/lang.php | 1 | ||||
| -rw-r--r-- | lib/plugins/config/settings/config.metadata.php | 1 |
5 files changed, 37 insertions, 7 deletions
diff --git a/conf/dokuwiki.php b/conf/dokuwiki.php index 03bf5e823..f1290ddd7 100644 --- a/conf/dokuwiki.php +++ b/conf/dokuwiki.php @@ -65,10 +65,11 @@ $conf['passcrypt'] = 'smd5'; //Used crypt method (smd5,md5,sha1,ssha $conf['defaultgroup']= 'user'; //Default groups new Users are added to $conf['superuser'] = '!!not set!!'; //The admin can be user or @group or comma separated list user1,@group1,user2 $conf['manager'] = '!!not set!!'; //The manager can be user or @group or comma separated list user1,@group1,user2 -$conf['profileconfirm'] = '1'; //Require current password to confirm changes to user profile +$conf['profileconfirm'] = 1; //Require current password to confirm changes to user profile $conf['disableactions'] = ''; //comma separated list of actions to disable $conf['sneaky_index'] = 0; //check for namespace read permission in index view (0|1) (1 might cause unexpected behavior) $conf['auth_security_timeout'] = 900; //time (seconds) auth data is considered valid, set to 0 to recheck on every page view +$conf['securecookie'] = 1; //never send HTTPS cookies via HTTP /* Advanced Options */ diff --git a/inc/auth.php b/inc/auth.php index 8d6f48738..f9d48d0d6 100644 --- a/inc/auth.php +++ b/inc/auth.php @@ -135,7 +135,11 @@ function auth_login($user,$pass,$sticky=false,$silent=false){ $pass = PMA_blowfish_encrypt($pass,auth_cookiesalt()); $cookie = base64_encode("$user|$sticky|$pass"); if($sticky) $time = time()+60*60*24*365; //one year - setcookie(DOKU_COOKIE,$cookie,$time,DOKU_REL); + if (version_compare(PHP_VERSION, '5.2.0', '>')) { + setcookie(DOKU_COOKIE,$cookie,$time,DOKU_REL,'',($conf['securecookie'] && is_ssl()),true); + }else{ + setcookie(DOKU_COOKIE,$cookie,$time,DOKU_REL,'',($conf['securecookie'] && is_ssl())); + } // set session $_SESSION[DOKU_COOKIE]['auth']['user'] = $user; @@ -286,7 +290,12 @@ function auth_logoff(){ if(isset($_SERVER['REMOTE_USER'])) unset($_SERVER['REMOTE_USER']); $USERINFO=null; //FIXME - setcookie(DOKU_COOKIE,'',time()-600000,DOKU_REL); + + if (version_compare(PHP_VERSION, '5.2.0', '>')) { + setcookie(DOKU_COOKIE,'',time()-600000,DOKU_REL,($conf['securecookie'] && is_ssl()),true); + }else{ + setcookie(DOKU_COOKIE,'',time()-600000,DOKU_REL,($conf['securecookie'] && is_ssl())); + } if($auth && $auth->canDo('logoff')){ $auth->logOff(); diff --git a/inc/init.php b/inc/init.php index b01711e4b..5277206f6 100644 --- a/inc/init.php +++ b/inc/init.php @@ -114,7 +114,11 @@ // init session if (!headers_sent() && !defined('NOSESSION')){ session_name("DokuWiki"); - session_set_cookie_params(0, DOKU_REL); + if (version_compare(PHP_VERSION, '5.2.0', '>')) { + session_set_cookie_params(0,DOKU_REL,'',($conf['securecookie'] && is_ssl()),true); + }else{ + session_set_cookie_params(0,DOKU_REL,'',($conf['securecookie'] && is_ssl())); + } session_start(); } @@ -341,9 +345,7 @@ function getBaseURL($abs=null){ if(!$port) $port = $_SERVER['SERVER_PORT']; if(!$port) $port = 80; - // see if HTTPS is enabled - apache leaves this empty when not available, - // IIS sets it to 'off', 'false' and 'disabled' are just guessing - if (preg_match('/^(|off|false|disabled)$/i',$_SERVER['HTTPS'])){ + if(!is_ssl()){ $proto = 'http://'; if ($port == '80') { $port=''; @@ -361,6 +363,22 @@ function getBaseURL($abs=null){ } /** + * Check if accessed via HTTPS + * + * Apache leaves ,$_SERVER['HTTPS'] empty when not available, IIS sets it to 'off'. + * 'false' and 'disabled' are just guessing + * + * @returns bool true when SSL is active + */ +function is_ssl(){ + if (preg_match('/^(|off|false|disabled)$/i',$_SERVER['HTTPS'])){ + return false; + }else{ + return true; + } +} + +/** * Append a PHP extension to a given file and adds an exit call * * This is used to migrate some old configfiles. An added PHP extension diff --git a/lib/plugins/config/lang/en/lang.php b/lib/plugins/config/lang/en/lang.php index c3c629450..864e79ee1 100644 --- a/lib/plugins/config/lang/en/lang.php +++ b/lib/plugins/config/lang/en/lang.php @@ -99,6 +99,7 @@ $lang['disableactions_wikicode'] = 'View source/Export Raw'; $lang['disableactions_other'] = 'Other actions (comma separated)'; $lang['sneaky_index'] = 'By default, DokuWiki will show all namespaces in the index view. Enabling this option will hide those where the user doesn\'t have read permissions. This might result in hiding of accessable subnamespaces. This may make the index unusable with certain ACL setups.'; $lang['auth_security_timeout'] = 'Authentication Security Timeout (seconds)'; +$lang['securecookie'] = 'Should cookies set via HTTPS only be sent via HTTPS by the browser? Disable this option when only the login of your wiki is secured with SSL but browsing the wiki is done unsecured.'; /* Advanced Options */ $lang['updatecheck'] = 'Check for updates and security warnings? DokuWiki needs to contact splitbrain.org for this feature.'; diff --git a/lib/plugins/config/settings/config.metadata.php b/lib/plugins/config/settings/config.metadata.php index bf987fe2d..4c86c2370 100644 --- a/lib/plugins/config/settings/config.metadata.php +++ b/lib/plugins/config/settings/config.metadata.php @@ -123,6 +123,7 @@ $meta['disableactions'] = array('disableactions', '_combine' => array('subscription' => array('subscribe','unsubscribe'), 'wikicode' => array('source','export_raw'), 'nssubscription' => array('subscribens','unsubscribens'))); $meta['sneaky_index'] = array('onoff'); $meta['auth_security_timeout'] = array('numeric'); +$meta['securecookie'] = array('onoff'); $meta['_anti_spam'] = array('fieldset'); $meta['usewordblock']= array('onoff'); |