libre-service.eu/pad.libre-service.eu-etherpad
libre-service.eu/pad.libre-service.eu-etherpad
1
0
Fork 0
mirror of https://github.com/ether/etherpad-lite.git synced 2025-01-19 22:23:33 +01:00
Code Issues Projects Releases Wiki Activity

Add secure flag to cookies on client side if pad accessed through https

Browse source
This commit is contained in:
Stefan 2016-06-08 21:14:10 +02:00
parent 93dae51cda
commit 06ff023047
2 changed files with 11 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/static/js/pad_cookie.js
View file

@ -43,7 +43,8 @@ var padcookie = (function()
{ {
var expiresDate = new Date(); var expiresDate = new Date();
expiresDate.setFullYear(3000); expiresDate.setFullYear(3000);
document.cookie = ('prefs=' + safeText + ';expires=' + expiresDate.toGMTString()); var secure = isHttpsScheme() ? ";secure" : "";
document.cookie = ('prefs=' + safeText + ';expires=' + expiresDate.toGMTString() + secure);
} }
function parseCookie(text) function parseCookie(text)
@ -80,6 +81,10 @@ var padcookie = (function()
} }
} }
function isHttpsScheme() {
return window.location.protocol == "https:";
}
var wasNoCookie = true; var wasNoCookie = true;
var cookieData = {}; var cookieData = {};
var alreadyWarnedAboutNoCookies = false; var alreadyWarnedAboutNoCookies = false;

7
src/static/js/pad_utils.js
View file

@ -54,12 +54,15 @@ function createCookie(name, value, days, path){ /* Used by IE */
path = "/"; path = "/";
} }
//Check if we accessed the pad over https
var secure = window.location.protocol == "https:" ? ";secure" : "";
//Check if the browser is IE and if so make sure the full path is set in the cookie //Check if the browser is IE and if so make sure the full path is set in the cookie
if((navigator.appName == 'Microsoft Internet Explorer') || ((navigator.appName == 'Netscape') && (new RegExp("Trident/.*rv:([0-9]{1,}[\.0-9]{0,})").exec(navigator.userAgent) != null))){ if((navigator.appName == 'Microsoft Internet Explorer') || ((navigator.appName == 'Netscape') && (new RegExp("Trident/.*rv:([0-9]{1,}[\.0-9]{0,})").exec(navigator.userAgent) != null))){
document.cookie = name + "=" + value + expires + "; path=/"; /* Note this bodge fix for IE is temporary until auth is rewritten */ document.cookie = name + "=" + value + expires + "; path=/" + secure; /* Note this bodge fix for IE is temporary until auth is rewritten */
} }
else{ else{
document.cookie = name + "=" + value + expires + "; path=" + path; document.cookie = name + "=" + value + expires + "; path=" + path + secure;
} }
} }