T238075.patch
sbassett (Scott Bassett)
Actions

Authored By

	sbassett
	Jul 27 2020, 6:41 PM

Size

878 B

Referenced Files

None

Subscribers

None

T238075.patch
View Options

	From 8791177c39364c079ab7d8b282810aa1ad5e46e6 Mon Sep 17 00:00:00 2001
	From: sbassett <sbassett@wikimedia.org>
	Date: Fri, 24 Jul 2020 11:31:37 -0500
	Subject: [PATCH] [SECURITY] mf_useformat cookie should be HttpOnly

	The mf_useformat cookie within MobileFrontend should set
	the HttpOnly attribute to true.

	Bug: T238075
	Change-Id: I8e84f1cbc8878974532b511cebd9de40c5de55c6
	---
	includes/MobileContext.php \| 2 +-
	1 file changed, 1 insertion(+), 1 deletion(-)

	diff --git a/includes/MobileContext.php b/includes/MobileContext.php
	index 31fddaa7b..425aee21c 100644
	--- a/includes/MobileContext.php
	+++ b/includes/MobileContext.php
	@@ -604,7 +604,7 @@ class MobileContext extends ContextSource {
	$expiry,
	[
	'prefix' => '',
	- 'httpOnly' => false,
	+ 'httpOnly' => true,
	]
	);
	$stats = MediaWikiServices::getInstance()->getStatsdDataFactory();
	--
	2.22.0