|
6 | 6 | * |
7 | 7 | * This content is released under the MIT License (MIT) |
8 | 8 | * |
9 | | - * Copyright (c) 2014 - 2019, British Columbia Institute of Technology |
| 9 | + * Copyright (c) 2019 - 2022, CodeIgniter Foundation |
10 | 10 | * |
11 | 11 | * Permission is hereby granted, free of charge, to any person obtaining a copy |
12 | 12 | * of this software and associated documentation files (the "Software"), to deal |
|
30 | 30 | * @author EllisLab Dev Team |
31 | 31 | * @copyright Copyright (c) 2008 - 2014, EllisLab, Inc. (https://ellislab.com/) |
32 | 32 | * @copyright Copyright (c) 2014 - 2019, British Columbia Institute of Technology (https://bcit.ca/) |
| 33 | + * @copyright Copyright (c) 2019 - 2022, CodeIgniter Foundation (https://codeigniter.com/) |
33 | 34 | * @license https://opensource.org/licenses/MIT MIT License |
34 | 35 | * @link https://codeigniter.com |
35 | 36 | * @since Version 1.0.0 |
|
46 | 47 | * @subpackage Libraries |
47 | 48 | * @category Input |
48 | 49 | * @author EllisLab Dev Team |
49 | | - * @link https://codeigniter.com/user_guide/libraries/input.html |
| 50 | + * @link https://codeigniter.com/userguide3/libraries/input.html |
50 | 51 | */ |
51 | 52 | class CI_Input { |
52 | 53 |
|
@@ -357,14 +358,15 @@ public function input_stream($index = NULL, $xss_clean = NULL) |
357 | 358 | * @param string $prefix Cookie name prefix |
358 | 359 | * @param bool $secure Whether to only transfer cookies via SSL |
359 | 360 | * @param bool $httponly Whether to only makes the cookie accessible via HTTP (no javascript) |
| 361 | + * @param string $samesite SameSite attribute |
360 | 362 | * @return void |
361 | 363 | */ |
362 | | - public function set_cookie($name, $value = '', $expire = '', $domain = '', $path = '/', $prefix = '', $secure = NULL, $httponly = NULL) |
| 364 | + public function set_cookie($name, $value = '', $expire = '', $domain = '', $path = '/', $prefix = '', $secure = NULL, $httponly = NULL, $samesite = NULL) |
363 | 365 | { |
364 | 366 | if (is_array($name)) |
365 | 367 | { |
366 | 368 | // always leave 'name' in last place, as the loop will break otherwise, due to $$item |
367 | | - foreach (array('value', 'expire', 'domain', 'path', 'prefix', 'secure', 'httponly', 'name') as $item) |
| 369 | + foreach (array('value', 'expire', 'domain', 'path', 'prefix', 'secure', 'httponly', 'name', 'samesite') as $item) |
368 | 370 | { |
369 | 371 | if (isset($name[$item])) |
370 | 372 | { |
@@ -405,7 +407,47 @@ public function set_cookie($name, $value = '', $expire = '', $domain = '', $path |
405 | 407 | $expire = ($expire > 0) ? time() + $expire : 0; |
406 | 408 | } |
407 | 409 |
|
408 | | - setcookie($prefix.$name, $value, $expire, $path, $domain, $secure, $httponly); |
| 410 | + isset($samesite) OR $samesite = config_item('cookie_samesite'); |
| 411 | + if (isset($samesite)) |
| 412 | + { |
| 413 | + $samesite = ucfirst(strtolower($samesite)); |
| 414 | + in_array($samesite, array('Lax', 'Strict', 'None'), TRUE) OR $samesite = 'Lax'; |
| 415 | + } |
| 416 | + else |
| 417 | + { |
| 418 | + $samesite = 'Lax'; |
| 419 | + } |
| 420 | + |
| 421 | + if ($samesite === 'None' && ! $secure) |
| 422 | + { |
| 423 | + log_message('error', $name.' cookie sent with SameSite=None, but without Secure attribute.'); |
| 424 | + } |
| 425 | + |
| 426 | + if ( ! is_php('7.3')) |
| 427 | + { |
| 428 | + $maxage = $expire - time(); |
| 429 | + if ($maxage < 1) |
| 430 | + { |
| 431 | + $maxage = 0; |
| 432 | + } |
| 433 | + |
| 434 | + $cookie_header = 'Set-Cookie: '.$prefix.$name.'='.rawurlencode($value); |
| 435 | + $cookie_header .= ($expire === 0 ? '' : '; Expires='.gmdate('D, d-M-Y H:i:s T', $expire)).'; Max-Age='.$maxage; |
| 436 | + $cookie_header .= '; Path='.$path.($domain !== '' ? '; Domain='.$domain : ''); |
| 437 | + $cookie_header .= ($secure ? '; Secure' : '').($httponly ? '; HttpOnly' : '').'; SameSite='.$samesite; |
| 438 | + header($cookie_header); |
| 439 | + return; |
| 440 | + } |
| 441 | + |
| 442 | + $setcookie_options = array( |
| 443 | + 'expires' => $expire, |
| 444 | + 'path' => $path, |
| 445 | + 'domain' => $domain, |
| 446 | + 'secure' => $secure, |
| 447 | + 'httponly' => $httponly, |
| 448 | + 'samesite' => $samesite, |
| 449 | + ); |
| 450 | + setcookie($prefix.$name, $value, $setcookie_options); |
409 | 451 | } |
410 | 452 |
|
411 | 453 | // -------------------------------------------------------------------- |
@@ -565,7 +607,7 @@ public function valid_ip($ip, $which = '') |
565 | 607 | $which = FILTER_FLAG_IPV6; |
566 | 608 | break; |
567 | 609 | default: |
568 | | - $which = NULL; |
| 610 | + $which = 0; |
569 | 611 | break; |
570 | 612 | } |
571 | 613 |
|
|
0 commit comments