Set SameSite=Lax on the session cookie

Applied at all seven session_start sites. keepalive.php and guest_post.php
had no cookie flags at all and now set httponly and secure too.

client/includes/check_login.php

@@ -8,6 +8,7 @@
 if (!isset($_SESSION)) {
     // HTTP Only cookies
     ini_set("session.cookie_httponly", true);
+    ini_set("session.cookie_samesite", "Lax");
     if ($config_https_only) {
         // Tell client to only send cookie(s) over HTTPS
         ini_set("session.cookie_secure", true);

client/login_microsoft.php

@@ -10,6 +10,7 @@ require_once '../functions.php';
 if (!isset($_SESSION)) {
     // HTTP Only cookies
     ini_set("session.cookie_httponly", true);
+    ini_set("session.cookie_samesite", "Lax");
     if ($config_https_only) {
         // Tell client to only send cookie(s) over HTTPS
         ini_set("session.cookie_secure", true);

client/login_reset.php

@@ -25,6 +25,7 @@ if($config_client_portal_enable == 0) {
 if (!isset($_SESSION)) {
     // HTTP Only cookies
     ini_set("session.cookie_httponly", true);
+    ini_set("session.cookie_samesite", "Lax");
     if ($config_https_only) {
         // Tell client to only send cookie(s) over HTTPS
         ini_set("session.cookie_secure", true);

guest/guest_post.php

@@ -4,6 +4,11 @@ require_once "../config.php";
 require_once "../functions.php";
 require_once "../includes/load_global_settings.php";
 
+ini_set("session.cookie_httponly", true);
+ini_set("session.cookie_samesite", "Lax");
+if ($config_https_only) {
+    ini_set("session.cookie_secure", true);
+}
 session_start();
 
 require_once "../includes/inc_set_timezone.php"; // Must be included after session_start to work

includes/session_init.php

@@ -3,6 +3,7 @@
 if (!isset($_SESSION)) {
     // HTTP Only cookies
     ini_set("session.cookie_httponly", true);
+    ini_set("session.cookie_samesite", "Lax");
     
     if ($config_https_only) {
         // Tell client to only send cookie(s) over HTTPS

keepalive.php

@@ -4,5 +4,12 @@
 // Receives requests via AJAX in the background every 8 mins to prevent PHP garbage collection ending sessions
 //  See footer.php & js/keepalive.js
 
+require_once __DIR__ . "/config.php";
+
+ini_set("session.cookie_httponly", true);
+ini_set("session.cookie_samesite", "Lax");
+if ($config_https_only) {
+    ini_set("session.cookie_secure", true);
+}
 session_start();
 session_write_close();

login.php

@@ -15,6 +15,7 @@ require_once "libs/totp/totp.php";
 
 if (session_status() === PHP_SESSION_NONE) {
     ini_set("session.cookie_httponly", true);
+    ini_set("session.cookie_samesite", "Lax");
 
     if ($config_https_only || !isset($config_https_only)) {
         ini_set("session.cookie_secure", true);