From: Jim Jagielski <jim@apache.org>
Date: Mon, 18 Aug 2008 15:39:36 +0000 (+0000)
Subject: Merge r647395, r660461, r660566, r664330 from trunk:
X-Git-Tag: 2.2.10~68
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0652a9c5e45cad1f82a6292b6e8d95cf19ee03d1;p=thirdparty%2Fapache%2Fhttpd.git

Merge r647395, r660461, r660566, r664330 from trunk:

* Allow Cookie option to set secure and HttpOnly flags

PR: 44799
Submitted by: Christian Wenz <christian wenz.org>
Reviewed by: rpluem



* Handle the case that secure is NULL


* Make setting of HttpOnly flag more explicit.


* Allow HttpOnly, 1 and true to enable HttpOnly, allow secure, 1 and true
  to enable secure.

Submitted by: rpluem
Reviewed by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@686789 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index ae473ce7b69..b501405b352 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5,6 +5,9 @@ Changes with Apache 2.2.10
      mod_proxy_ftp: Prevent XSS attacks when using wildcards in the path of
      the FTP URL. Discovered by Marc Bevand of Rapid7. [Ruediger Pluem]
 
+  *) mod_rewrite: Allow Cookie option to set secure and HttpOnly flags.
+     PR 44799 [Christian Wenz <christian wenz.org>]
+
   *) mod_ssl: Rewrite shmcb to avoid memory alignment issues.  PR 42101.
      [Geoff Thorpe]
 
diff --git a/STATUS b/STATUS
index f9b3ca26ec9..e638c872ccf 100644
--- a/STATUS
+++ b/STATUS
@@ -90,17 +90,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
    http://svn.apache.org/viewvc?rev=639010&view=rev (mmn)
    +1: niq, rpluem, mturk
 
- * mod_rewrite: Allow Cookie option to set secure and HttpOnly flags.
-   PR 44799
-   Trunk version of patch:
-         http://svn.apache.org/viewvc?rev=647395&view=rev
-         http://svn.apache.org/viewvc?rev=660461&view=rev
-         http://svn.apache.org/viewvc?rev=660566&view=rev
-         http://svn.apache.org/viewvc?rev=664330&view=rev
-   Backport version for 2.2.x of patch:
-         Trunk version of patch works
-   +1: rpluem, niq, jim
-
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ New proposals should be added at the end of the list ]
 
diff --git a/docs/manual/mod/mod_rewrite.xml b/docs/manual/mod/mod_rewrite.xml
index 2fef7c340c6..2224d45600e 100644
--- a/docs/manual/mod/mod_rewrite.xml
+++ b/docs/manual/mod/mod_rewrite.xml
@@ -1230,14 +1230,18 @@ cannot use <code>$N</code> in the substitution string!
         when you let an external redirect happen (where the
         ``<code>.www</code>'' part should not occur!).</dd>
 
-        <dt>'<code>cookie|CO=</code><em>NAME</em>:<em>VAL</em>:<em>domain</em>[:<em>lifetime</em>[:<em>path</em>]]'
+        <dt>'<code>cookie|CO=</code><em>NAME</em>:<em>VAL</em>:<em>domain</em>[:<em>lifetime</em>[:<em>path</em>[:<em>secure</em>[:<em>httponly</em>]]]]'
         (set cookie)</dt><dd>
         This sets a cookie in the client's browser.  The cookie's name
         is specified by <em>NAME</em> and the value is
         <em>VAL</em>. The <em>domain</em> field is the domain of the
         cookie, such as '.apache.org', the optional <em>lifetime</em>
-	is the lifetime of the cookie in minutes, and the optional 
-	<em>path</em> is the path of the cookie</dd>
+        is the lifetime of the cookie in minutes, and the optional 
+        <em>path</em> is the path of the cookie. If <em>secure</em>
+        is set to 'secure', 'true' or '1', the cookie is only transmitted via secured
+        connections. If <em>httponly</em> is set to 'HttpOnly', 'true' or '1', the
+        <code>HttpOnly</code> flag is used, making the cookie not accessible
+        to JavaScript code on browsers that support this feature.</dd>
 
         <dt>
         '<code>env|E=</code><em>VAR</em>:<em>VAL</em>'
diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
index 6a0ffb7f5e4..863d69e1011 100644
--- a/modules/mappers/mod_rewrite.c
+++ b/modules/mappers/mod_rewrite.c
@@ -2339,6 +2339,8 @@ static void add_cookie(request_rec *r, char *s)
     char *domain;
     char *expires;
     char *path;
+    char *secure;
+    char *httponly;
 
     char *tok_cntx;
     char *cookie;
@@ -2363,6 +2365,8 @@ static void add_cookie(request_rec *r, char *s)
 
             expires = apr_strtok(NULL, ":", &tok_cntx);
             path = expires ? apr_strtok(NULL, ":", &tok_cntx) : NULL;
+            secure = path ? apr_strtok(NULL, ":", &tok_cntx) : NULL;
+            httponly = secure ? apr_strtok(NULL, ":", &tok_cntx) : NULL;
 
             if (expires) {
                 apr_time_exp_t tms;
@@ -2383,6 +2387,16 @@ static void add_cookie(request_rec *r, char *s)
                                  "; domain=", domain,
                                  expires ? "; expires=" : NULL,
                                  expires ? exp_time : NULL,
+                                 (secure && (!strcasecmp(secure, "true")
+                                             || !strcmp(secure, "1")
+                                             || !strcasecmp(secure,
+                                                            "secure"))) ?
+                                  "; secure" : NULL,
+                                 (httponly && (!strcasecmp(httponly, "true")
+                                               || !strcmp(httponly, "1")
+                                               || !strcasecmp(httponly,
+                                                              "HttpOnly"))) ?
+                                  "; HttpOnly" : NULL,
                                  NULL);
 
             apr_table_addn(rmain->err_headers_out, "Set-Cookie", cookie);