From a2f96f4f01e8802b284bbaaa6449bcdc792b40fc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=A1bor=20Hojtsy?= <gabor@hojtsy.hu>
Date: Wed, 2 Jun 2010 13:07:45 +0000
Subject: [PATCH] #458704 by markus_petrux, tic2000, Damien Tournoud: only
remove the www. prefix from autodetected cookie domains, not custom set
cookie domains
---
includes/bootstrap.inc | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/includes/bootstrap.inc b/includes/bootstrap.inc
index 7bfa7d871457..de05c4910b13 100644
--- a/includes/bootstrap.inc
+++ b/includes/bootstrap.inc
@@ -439,6 +439,13 @@ function conf_init() {
// We escape the hostname because it can be modified by a visitor.
if (!empty($_SERVER['HTTP_HOST'])) {
$cookie_domain = check_plain($_SERVER['HTTP_HOST']);
+ // Strip leading periods, www., and port numbers from cookie domain.
+ $cookie_domain = ltrim($cookie_domain, '.');
+ if (strpos($cookie_domain, 'www.') === 0) {
+ $cookie_domain = substr($cookie_domain, 4);
+ }
+ $cookie_domain = explode(':', $cookie_domain);
+ $cookie_domain = '.'. $cookie_domain[0];
}
}
// To prevent session cookies from being hijacked, a user can configure the
@@ -450,13 +457,6 @@ function conf_init() {
if (ini_get('session.cookie_secure')) {
$session_name .= 'SSL';
}
- // Strip leading periods, www., and port numbers from cookie domain.
- $cookie_domain = ltrim($cookie_domain, '.');
- if (strpos($cookie_domain, 'www.') === 0) {
- $cookie_domain = substr($cookie_domain, 4);
- }
- $cookie_domain = explode(':', $cookie_domain);
- $cookie_domain = '.'. $cookie_domain[0];
// Per RFC 2109, cookie domains must contain at least one dot other than the
// first. For hosts such as 'localhost' or IP Addresses we don't set a cookie domain.
if (count(explode('.', $cookie_domain)) > 2 && !is_numeric(str_replace('.', '', $cookie_domain))) {
--
GitLab