[serendipity-cvs] [s9y/Serendipity] 99c17d: Fix attack vector by not using HTTP_HOST for the c...

  Branch: refs/heads/fix/cookieDomain
  Home:   https://github.com/s9y/Serendipity
  Commit: 99c17dea9de4ee2d8efa5bfe03e7d670a2f5bd83
      https://github.com/s9y/Serendipity/commit/99c17dea9de4ee2d8efa5bfe03e7d670a2f5bd83
  Author: onli <[email protected]>
  Date:   2026-03-23 (Mon, 23 Mar 2026)

  Changed paths:
    M include/functions_config.inc.php

  Log Message:
  -----------
  Fix attack vector by not using HTTP_HOST for the cookie domain
Instead use the configurable baseURL.


  Commit: f4f3942515e1d5e12d13ec317811eea93ccfccb3
      https://github.com/s9y/Serendipity/commit/f4f3942515e1d5e12d13ec317811eea93ccfccb3
  Author: onli <[email protected]>
  Date:   2026-03-26 (Thu, 26 Mar 2026)

  Changed paths:
    M include/functions_config.inc.php

  Log Message:
  -----------
  Do not set a domain manually for the cookie
Then the browser will autoamtically bind the cookie to the origin, which is the safest approach. See https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#domain-and-path-attributes


  Commit: b6372855cc167203bd1bdb6d9498e093c0d39d61
      https://github.com/s9y/Serendipity/commit/b6372855cc167203bd1bdb6d9498e093c0d39d61
  Author: onli <[email protected]>
  Date:   2026-03-26 (Thu, 26 Mar 2026)

  Changed paths:
    M include/functions_config.inc.php

  Log Message:
  -----------
  Also avoid host in delete cookie function + remove leftover code


Compare: https://github.com/s9y/Serendipity/compare/99c17dea9de4%5E...b6372855cc16

To unsubscribe from these emails, change your notification settings at https://github.com/s9y/Serendipity/settings/notifications