diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7276c84..00f5f21 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@
* **1.4 (not yet released)**
* ADDED: Translation for Estonian
* ADDED: new HTTP headers improving security (#765)
+ * CHANGED: Language selection cookie only transmitted over HTTPS (#472)
* **1.3.5 (2021-04-05)**
* ADDED: Translation for Hebrew, Lithuanian, Indonesian and Catalan
* ADDED: Make the project info configurable (#681)
diff --git a/cfg/conf.sample.php b/cfg/conf.sample.php
index e958c88..570503c 100644
--- a/cfg/conf.sample.php
+++ b/cfg/conf.sample.php
@@ -87,7 +87,7 @@ languageselection = false
; async functions and display an error if not and for Chrome to enable
; webassembly support (used for zlib compression). You can remove it if Chrome
; doesn't need to be supported and old browsers don't need to be warned.
-; cspheader = "default-src 'none'; manifest-src 'self'; connect-src * blob:; script-src 'self' 'unsafe-eval' resource:; style-src 'self'; font-src 'self'; img-src 'self' data: blob:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals allow-downloads"
+; cspheader = "default-src 'none'; base-uri 'self'; manifest-src 'self'; connect-src * blob:; script-src 'self' 'unsafe-eval' resource:; style-src 'self'; font-src 'self'; img-src 'self' data: blob:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals allow-downloads"
; stay compatible with PrivateBin Alpha 0.19, less secure
; if enabled will use base64.js version 1.7 instead of 2.1.9 and sha1 instead of
diff --git a/js/privatebin.js b/js/privatebin.js
index e549dd6..0519970 100644
--- a/js/privatebin.js
+++ b/js/privatebin.js
@@ -3676,7 +3676,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
*/
function setLanguage(event)
{
- document.cookie = 'lang=' + $(event.target).data('lang');
+ document.cookie = 'lang=' + $(event.target).data('lang') + ';secure';
UiHelper.reloadHome();
}
diff --git a/lib/Configuration.php b/lib/Configuration.php
index 2a326ca..426cd15 100644
--- a/lib/Configuration.php
+++ b/lib/Configuration.php
@@ -55,7 +55,7 @@ class Configuration
'urlshortener' => '',
'qrcode' => true,
'icon' => 'identicon',
- 'cspheader' => 'default-src \'none\'; manifest-src \'self\'; connect-src * blob:; script-src \'self\' \'unsafe-eval\' resource:; style-src \'self\'; font-src \'self\'; img-src \'self\' data: blob:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals allow-downloads',
+ 'cspheader' => 'default-src \'none\'; base-uri \'self\'; manifest-src \'self\'; connect-src * blob:; script-src \'self\' \'unsafe-eval\' resource:; style-src \'self\'; font-src \'self\'; img-src \'self\' data: blob:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals allow-downloads',
'zerobincompatibility' => false,
'httpwarning' => true,
'compression' => 'zlib',
diff --git a/lib/Controller.php b/lib/Controller.php
index bfa29b1..2df522a 100644
--- a/lib/Controller.php
+++ b/lib/Controller.php
@@ -170,7 +170,7 @@ class Controller
// force default language, if language selection is disabled and a default is set
if (!$this->_conf->getKey('languageselection') && strlen($lang) == 2) {
$_COOKIE['lang'] = $lang;
- setcookie('lang', $lang);
+ setcookie('lang', $lang, 0, '', '', true);
}
}
@@ -368,7 +368,7 @@ class Controller
$languageselection = '';
if ($this->_conf->getKey('languageselection')) {
$languageselection = I18n::getLanguage();
- setcookie('lang', $languageselection);
+ setcookie('lang', $languageselection, 0, '', '', true);
}
$page = new View;
diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php
index ffea872..f8f9444 100644
--- a/tpl/bootstrap.php
+++ b/tpl/bootstrap.php
@@ -72,7 +72,7 @@ endif;
?>
-
+
diff --git a/tpl/page.php b/tpl/page.php
index e58617d..a227232 100644
--- a/tpl/page.php
+++ b/tpl/page.php
@@ -50,7 +50,7 @@ endif;
?>
-
+