Simple Machines Community Forum

Link to Mod (http://custom.simplemachines.org/mods/index.php?mod=2205)

Help prevent XSS.

• Allows httponly flag to be used for login cookies.
  
• Works with all versions of PHP, not just PHP 5.2.
  
  PHP.net setcookie() info (http://www.php.net/setcookie)
  OWasp info (http://www.owasp.org/index.php/HTTPOnly)

Txs for this useful modification, appreciated!  :)

Is this worth downloading?

yes, it worth downloading and installing.

but there are couple of bugs in it.

first:
it replaces forum cookies time to wrong:

<search position="replace"><![CDATA[setcookie($cookiename, $data, time() + $cookie_length, $cookie_url[1], $cookie_url[0], !empty($modSettings['secureCookies']));]]></search>
<add><![CDATA[setcookie($cookiename, serialize(array(0, '', 0)), time() - 3600, $cookie_url[1], $cookie_url[0], !empty($modSettings['secureCookies']), true);]]></add>


I polite, replacement should be to
set_cookie($cookiename, $data, time() + $cookie_length, $cookie_url[1], $cookie_url[0], !empty($modSettings['secureCookies']),true);

second small bug:

<operation>
<search position="replace"><![CDATA[setcookie($cookiename, serialize(array(0, '', 0)), time() - 3600, $cookie_url[1], $cookie_url[0], !empty($modSettings['secureCookies']));]]></search>
<add><![CDATA[setcookie($cookiename, serialize(array(0, '', 0)), time() - 3600, $cookie_url[1], $cookie_url[0], !empty($modSettings['secureCookies']), true);]]></add>
</operation>


Replacement should be to
set_cookie($cookiename, serialize(array(0, '', 0)), time() - 3600, $cookie_url[1], $cookie_url[0], !empty($modSettings['secureCookies']), true);

groundup,

What is the advantage to installing this mod? Have the bugs fixes been added to the download package?

thanks,

Lou   :)

The advantages are shown in the links in the first post. Not sure about the bugs.

Because of the implications of the Firesheep plugin for Firefox, I'm changing one of my forums over to SSL.  Is this something I need to look at, or is it not needed when a forum is pure SSL?

This would be in addition to a secure site.

will this be updated for RC5

I haven't tested it on RC5 but I'm thinking it should work.

Hi,

if someone stumbling over this:

Had a short discussion why this is not enabled by default here:

http://www.simplemachines.org/community/index.php?topic=503970.0

I had no time to test if this mod works with the final versions of SMF 2.0 but if someone is running PHP 5.2 or higher you don't need to use this mod and just can make the edits like described here:

http://www.simplemachines.org/community/index.php?topic=503970.msg3546502#msg3546502