nminaker
This should be it:
diff --git a/include/class.ostsession.php b/include/class.ostsession.php
index 66f786585..9b8fa1fcc 100644
--- a/include/class.ostsession.php
+++ b/include/class.ostsession.php
@@ -256,13 +256,19 @@ class osTicketSession {
}
static function renewCookie($baseTime=false, $window=false) {
+ global $ost;
+
$ttl = $window ?: SESSION_TTL;
$expire = ($baseTime ?: time()) + $ttl;
- setcookie(session_name(), session_id(), $expire,
- ini_get('session.cookie_path'),
- ini_get('session.cookie_domain'),
- ini_get('session.cookie_secure'),
- ini_get('session.cookie_httponly'));
+ $opts = [
+ 'expires' => $expire,
+ 'path' => ini_get('session.cookie_path'),
+ 'domain' => ini_get('session.cookie_domain'),
+ 'secure' => ini_get('session.cookie_secure'),
+ 'httponly' => ini_get('session.cookie_httponly'),
+ 'samesite' => !empty($ost->getConfig()->getAllowIframes()) ? 'None' : 'Strict'
+ ];
+ setcookie(session_name(), session_id(), $opts);
// Trigger expire update - neeed for secondary handlers that only
// log new sessions
self::expire(session_id(), $ttl);
Disclaimer:
There is no official pull request for this yet. The above changes have not been reviewed nor approved. If you decide to deploy these changes you will do so at your own risk. It's always best practice to take full backups before making any changes to the codebase and/or database. Good luck.
Cheers.
