[TikiWiki-commits] [Git][tikiwiki/tiki][27.x] [BP][FIX] Samesite http header for cookies wasn't obeyed for the PHPSESSID_CSRF cookie

Rodriguez Nyiringabo pushed to branch 27.x at Tiki Wiki CMS Groupware / Tiki


Commits:
ea1c263f by Rodriguez Nyiringabo at 2026-06-03T12:16:42+00:00
[BP][FIX] Samesite http header for cookies wasn't obeyed for the PHPSESSID_CSRF cookie
---
* [BP][FIX] Samesite http header for cookies wasn't obeyed for the PHPSESSID_CSRF cookie
---
* [BP][FIX] Samesite http header for cookies wasn't obeyed for the PHPSESSID_CSRF cookie
---
* [FIX] Samesite http header for cookies wasn't obeyed for the PHPSESSID_CSRF cookie

See merge request tikiwiki/tiki!10418

See merge request tikiwiki/tiki!10424

See merge request tikiwiki/tiki!10428

- - - - -


3 changed files:

- lib/setup/cookies.php
- lib/tiki-js.js
- lib/tikiaccesslib.php


Changes:

=====================================
lib/setup/cookies.php
=====================================
@@ -30,6 +30,26 @@ if (isset($_SESSION['tiki_cookie_jar'])) {
 
 $smarty->assign_by_ref('cookie', $_COOKIE);
 
+/** This function is meant to replace PHPs low-level https://www.php.net/manual/en/function.setcookie.php function.  It only implements the 3 parameter version.
+ *
+ * the reason it exists is that:
+ *
+ * It is completely silly that setcookie is slightly different from the array returned by session_get_cookie_params.
+ * It is also completely silly that it will not obey samesite in session_set_cookie_params if you pass lifetime explicitly.  Maybe it disregards other parameters in some forms, I did not check.
+ * benoitg -2025-05-12.
+ *
+ *
+ */
+function setcookie_obeySetCookieParams(string $name, string $value = "", array $options = []): bool
+{
+    $sessionParams = session_get_cookie_params();
+    // Yes, it is completely silly that the options parameter of setcookie is slightly different from the array returned by session_get_cookie_params().
+    $sessionParams['expires'] = $sessionParams['lifetime'];
+    unset($sessionParams['lifetime']);
+    $finalOptions = array_merge($sessionParams, $options);
+    return setcookie($name, $value, $finalOptions);
+}
+
 function getCookie($name, $section = null, $default = null)
 {
     global $feature_no_cookie, $jitCookie;
@@ -97,7 +117,13 @@ function setCookieSection($name, $value, $section = '', $expire = 0, $path = '',
         if ($feature_no_cookie) {
             $_SESSION['tiki_cookie_jar'][$name] = $value;
         } else {
-            setcookie($name, $value, $expire, $path, $domain, $secure);
+            $options = [
+                'expires' => $expire,
+                'path' => $path,
+                'domain' => $domain,
+                'secure' => $secure
+            ];
+            setcookie_obeySetCookieParams($name, $value, $options);
         }
     }
 }


=====================================
lib/tiki-js.js
=====================================
@@ -630,7 +630,7 @@ function setCookieBrowser(name, value, section, expires, path, domain, secure) {
     }
     else {
         document.cookie = name + "=" + encodeURIComponent(value) + ((expires) ? "; expires=" + expires.toGMTString() : "")
-        + ((path) ? "; path=" + path : "") + ((domain) ? "; domain=" + domain : "") + ((secure) ? "; secure" : "");
+        + ((path) ? "; path=" + path : "") + ((domain) ? "; domain=" + domain : "") + ((secure) ? "; secure" : "" + "; samesite=Lax");
     }
 }
 


=====================================
lib/tikiaccesslib.php
=====================================
@@ -408,8 +408,7 @@ class TikiAccessLib extends TikiLib
         $cipherTicket = $this->encryptCsrfTicket($this->ticket);
 
         // you can set even if is the same value
-        $session_params = session_get_cookie_params();
-        setcookie(session_name() . '_CSRF', $cipherTicket, 0, $session_params['path'], $session_params['domain'], $session_params['secure'], true);
+        setcookie_obeySetCookieParams(session_name() . '_CSRF', $cipherTicket);
     }
 
 



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/ea1c263f9477f993745f23f5bcd969de54b3a6f4

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/ea1c263f9477f993745f23f5bcd969de54b3a6f4
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs