From 25b58c21c82093dcab4b37a1f16c1c892c5c7521 Mon Sep 17 00:00:00 2001
From: Marcus Hill <bcf8c9f2@opayq.com>
Date: Sun, 9 Jan 2022 13:56:45 +0000
Subject: [PATCH] Add Secure flag (HTTPS only) to cookies

---
 check_login.php | 10 +++++++---
 login.php       |  5 +++++
 setup.php       |  1 +
 3 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/check_login.php b/check_login.php
index 13ac7e7f..c7d2cad1 100644
--- a/check_login.php
+++ b/check_login.php
@@ -1,9 +1,13 @@
 <?php
 	
 	if(!isset($_SESSION)){
-    // HTTP Only cookies
-    ini_set("session.cookie_httponly", True);
-    session_start();
+        // HTTP Only cookies
+        ini_set("session.cookie_httponly", True);
+        if($config_https_only){
+            // Tell client to only send cookie(s) over HTTPS
+            ini_set("session.cookie_secure", True);
+        }
+        session_start();
 	}
 
 	//Check to see if setup is enabled
diff --git a/login.php b/login.php
index 7cd5638b..4eeadd03 100644
--- a/login.php
+++ b/login.php
@@ -19,6 +19,11 @@ $user_agent = "$os - $browser";
 // HTTP Only cookies
 ini_set("session.cookie_httponly", True);
 
+// Tell client to only send cookie(s) over HTTPS
+if($config_https_only){
+    ini_set("session.cookie_secure", True);
+}
+
 session_start();
 
 if(isset($_POST['login'])){
diff --git a/setup.php b/setup.php
index 929109b6..0e1ecabf 100644
--- a/setup.php
+++ b/setup.php
@@ -351,6 +351,7 @@ if(isset($_POST['add_database'])){
   $new_config[] = "\$mysqli = mysqli_connect(\$dbhost, \$dbusername, \$dbpassword, \$database) or die('Database Connection Failed');\n";
   $new_config[] = "\$config_app_name = 'ITFlow';\n";
   $new_config[] = sprintf("\$config_base_url = '%s';\n", addslashes($config_base_url));
+  $new_config[] = "\$config_https_only = TRUE;\n";
 
   file_put_contents("config.php", $new_config);