[SECURITY] Make InstallTool session cookie HTTP-only

Resolves: #86955 Releases: master, 8.7, 7.6 Security-Commit: d251175e031aaa9943f93f5e5297f5490b99e513 Security-Bulletin: TYPO3-CORE-SA-2018-009 Change-Id: Ia50cac61ee2d649e98cba2102162c1360487bb20 Reviewed-on: https://review.typo3.org/59103 Reviewed-by: Oliver Hader <oliver.hader@typo3.org> Tested-by: Oliver Hader <oliver.hader@typo3.org>
TYPO3 · Dec 11, 2018 · 13328b0 · 13328b0
1 parent 1c85fe7
commit 13328b0
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/typo3/sysext/install/Classes/Service/SessionService.php b/typo3/sysext/install/Classes/Service/SessionService.php
@@ -76,6 +76,7 @@ public function __construct()
         session_set_save_handler([$this, 'open'], [$this, 'close'], [$this, 'read'], [$this, 'write'], [$this, 'destroy'], [$this, 'gc']);
         session_save_path($sessionSavePath);
         session_name($this->cookieName);
+        ini_set('session.cookie_httponly', true);
         ini_set('session.cookie_path', (string)GeneralUtility::getIndpEnv('TYPO3_SITE_PATH'));
         // Always call the garbage collector to clean up stale session files
         ini_set('session.gc_probability', (string)100);