tonyair
/
silverstripe-framework
mirror of https://github.com/silverstripe/silverstripe-framework
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge branch '4.12' into 4.13

This commit is contained in:
Steve Boyd 2023-04-11 10:55:17 +12:00
parent a42bb856c3 92061a3ba6
commit 3d03a93b8f
3 changed files with 15 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/Control/Cookie.php
View File

@ -14,6 +14,12 @@ class Cookie
{ {
use Configurable; use Configurable;
public const SAMESITE_LAX = 'Lax';
public const SAMESITE_STRICT = 'Strict';
public const SAMESITE_NONE = 'None';
/** /**
* @config * @config
* *
@ -25,7 +31,7 @@ class Cookie
* Must be "Strict", "Lax", or "None" * Must be "Strict", "Lax", or "None"
* @config * @config
*/ */
private static string $default_samesite = 'Lax'; private static string $default_samesite = self::SAMESITE_LAX;
/** /**
* Fetch the current instance of the cookie backend. * Fetch the current instance of the cookie backend.
@ -110,14 +116,14 @@ class Cookie
public static function validateSameSite(string $sameSite): void public static function validateSameSite(string $sameSite): void
{ {
$validValues = [ $validValues = [
'Strict', self::SAMESITE_STRICT,
'Lax', self::SAMESITE_LAX,
'None', self::SAMESITE_NONE,
]; ];
if (!in_array($sameSite, $validValues)) { if (!in_array($sameSite, $validValues)) {
throw new LogicException('Cookie samesite must be "Strict", "Lax", or "None"'); throw new LogicException('Cookie samesite must be "Strict", "Lax", or "None"');
} }
if ($sameSite === 'None' && !Director::is_https(self::getRequest())) { if ($sameSite === self::SAMESITE_NONE && !Director::is_https(self::getRequest())) {
Injector::inst()->get(LoggerInterface::class)->warning('Cookie samesite cannot be "None" for non-https requests.'); Injector::inst()->get(LoggerInterface::class)->warning('Cookie samesite cannot be "None" for non-https requests.');
} }
} }

4
src/Control/CookieJar.php
View File

@ -204,8 +204,8 @@ class CookieJar implements Cookie_Backend
private function getSameSite(string $name): string private function getSameSite(string $name): string
{ {
if ($name === session_name()) { if ($name === session_name()) {
return Session::config()->get('cookie_samesite'); return Session::config()->get('cookie_samesite') ?? Cookie::SAMESITE_LAX;
} }
return Cookie::config()->get('default_samesite'); return Cookie::config()->get('default_samesite') ?? Cookie::SAMESITE_LAX;
} }
} }

4
src/Control/Session.php
View File

@ -139,7 +139,7 @@ class Session
* Must be "Strict", "Lax", or "None". * Must be "Strict", "Lax", or "None".
* @config * @config
*/ */
private static string $cookie_samesite = 'Lax'; private static string $cookie_samesite = Cookie::SAMESITE_LAX;
/** /**
* Name of session cache limiter to use. * Name of session cache limiter to use.
@ -374,7 +374,7 @@ class Session
} }
} }
$sameSite = static::config()->get('cookie_samesite'); $sameSite = static::config()->get('cookie_samesite') ?? Cookie::SAMESITE_LAX;
Cookie::validateSameSite($sameSite); Cookie::validateSameSite($sameSite);
$secure = $this->isCookieSecure($sameSite, Director::is_https($request)); $secure = $this->isCookieSecure($sameSite, Director::is_https($request));