diff options
| author | DaleBCooper <github@r13t.de> | 2025-03-01 19:03:13 +0100 |
|---|---|---|
| committer | backportbot[bot] <backportbot[bot]@users.noreply.github.com> | 2025-03-02 11:33:13 +0000 |
| commit | e1e0b68feb2c641c583816f52766ce73aa72cd89 (patch) | |
| tree | 36b742bcd1413fde6ff5bfc8f4f4c624cca6aec1 /lib | |
| parent | bf387e571c3085007e1f697bf1180cda6d09b090 (diff) | |
| download | nextcloud-server-e1e0b68feb2c641c583816f52766ce73aa72cd89.tar.gz nextcloud-server-e1e0b68feb2c641c583816f52766ce73aa72cd89.zip | |
Fix A+ rating when checking with Nextcloud Security Scan.backport/51173/master
Due to commit 33d7019 session.cookie_secure=true is not set when accessing /status.php.
This results in a degration from A+ to A rating due to missing __Host prefix for nc_sameSiteCookielax and nc_sameSiteCookiestrict cookies.
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/base.php | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/lib/base.php b/lib/base.php index 811055c982b..a1ff2f0b4dd 100644 --- a/lib/base.php +++ b/lib/base.php @@ -363,13 +363,6 @@ class OC { public static function initSession(): void { $request = Server::get(IRequest::class); - // Do not initialize sessions for 'status.php' requests - // Monitoring endpoints can quickly flood session handlers - // and 'status.php' doesn't require sessions anyway - if (str_ends_with($request->getScriptName(), '/status.php')) { - return; - } - // TODO: Temporary disabled again to solve issues with CalDAV/CardDAV clients like DAVx5 that use cookies // TODO: See https://github.com/nextcloud/server/issues/37277#issuecomment-1476366147 and the other comments // TODO: for further information. @@ -388,6 +381,13 @@ class OC { // prevents javascript from accessing php session cookies ini_set('session.cookie_httponly', 'true'); + // Do not initialize sessions for 'status.php' requests + // Monitoring endpoints can quickly flood session handlers + // and 'status.php' doesn't require sessions anyway + if (str_ends_with($request->getScriptName(), '/status.php')) { + return; + } + // set the cookie path to the Nextcloud directory $cookie_path = OC::$WEBROOT ? : '/'; ini_set('session.cookie_path', $cookie_path); |