[TikiWiki-commits] [Git][tikiwiki/tiki][30.x] [BP][FIX] Samesite http header for cookies wasn't obeyed for the PHPSESSID_CSRF cookie

Rodriguez Nyiringabo pushed to branch 30.x at Tiki Wiki CMS Groupware / Tiki


Commits:
fdc7f2d7 by Rodriguez Nyiringabo at 2026-06-02T10:17:28+00:00
[BP][FIX] Samesite http header for cookies wasn't obeyed for the PHPSESSID_CSRF cookie
---
* [FIX] Samesite http header for cookies wasn't obeyed for the PHPSESSID_CSRF cookie

See merge request tikiwiki/tiki!10418

- - - - -


4 changed files:

- lib/CookieConsent/CookieConsentLib.php
- lib/setup/cookies.php
- lib/tiki-js.js
- lib/tikiaccesslib.php


Changes:

=====================================
lib/CookieConsent/CookieConsentLib.php
=====================================
@@ -246,7 +246,13 @@ class CookieConsentLib
             if ($feature_no_cookie) {
                 $_SESSION['tiki_cookie_jar'][$name] = $value;
             } else {
-                setcookie($name, $value, $expire, $path, $domain, $secure);
+                $options = [
+                    'expires' => $expire,
+                    'path' => $path,
+                    'domain' => $domain,
+                    'secure' => $secure
+                ];
+                setcookie_obeySetCookieParams($name, $value, $options);
             }
         }
     }


=====================================
lib/setup/cookies.php
=====================================
@@ -30,6 +30,29 @@ if (isset($_SESSION['tiki_cookie_jar'])) {
 
 $smarty->assign_by_ref('cookie', $_COOKIE);
 
+/** This function is meant to replace PHPs low-level https://www.php.net/manual/en/function.setcookie.php function.  It only implements the 3 parameter version.
+ *
+ * the reason it exists is that:
+ *
+ * It is completely silly that setcookie is slightly different from the array returned by session_get_cookie_params.
+ * It is also completely silly that it will not obey smaesite in session_set_cookie_params if you pass lifetime explicitly.  Maybe it disregards other parameters in some forms, I did not check.
+ * benoitg -2025-05-12.
+ *
+ *
+ */
+function setcookie_obeySetCookieParams(string $name, string $value = "", array $options = []): bool
+{
+    $sessionParams = session_get_cookie_params();
+    // Yes, it is completely silly that the options parameter of setcookie is slightly different from the array returned by session_get_cookie_params().
+    $sessionParams['expires'] = $sessionParams['lifetime'];
+    unset($sessionParams['lifetime']);
+    $finalOptions = array_merge($sessionParams, $options);
+    return setcookie($name, $value, $finalOptions);
+}
+/**
+ * This seems to be the mirror function of CookieConsentLib::setCookieSection(), but
+ * I am not 100% sure since CookieConsentLib has it's own setCookie() method - benoitg - 2026-03-26
+ */
 function getCookie($name, $section = null, $default = null)
 {
     global $feature_no_cookie, $jitCookie;


=====================================
lib/tiki-js.js
=====================================
@@ -622,7 +622,7 @@ function setCookieBrowser(name, value, section, expires, path, domain, secure) {
     }
     else {
         document.cookie = name + "=" + encodeURIComponent(value) + ((expires) ? "; expires=" + expires.toGMTString() : "")
-        + ((path) ? "; path=" + path : "") + ((domain) ? "; domain=" + domain : "") + ((secure) ? "; secure" : "");
+        + ((path) ? "; path=" + path : "") + ((domain) ? "; domain=" + domain : "") + ((secure) ? "; secure" : "" + "; samesite=Lax");
     }
 }
 


=====================================
lib/tikiaccesslib.php
=====================================
@@ -411,8 +411,7 @@ class TikiAccessLib extends TikiLib
         $cipherTicket = $this->encryptCsrfTicket($this->ticket);
 
         // you can set even if is the same value
-        $session_params = session_get_cookie_params();
-        setcookie(session_name() . '_CSRF', $cipherTicket, 0, $session_params['path'], $session_params['domain'], $session_params['secure'], true);
+        setcookie_obeySetCookieParams(session_name() . '_CSRF', $cipherTicket);
     }
 
 



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/fdc7f2d7b32a58a39d2cce24c482769b159d1a3c

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/fdc7f2d7b32a58a39d2cce24c482769b159d1a3c
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs