- security paranoia: protect session/remember me cookies from XSS attacks (works only if php>=5.2 and with IE/FF maybe others)

git-svn-id: http://piwigo.org/svn/branches/2.0@2756 68402e56-0260-453c-a942-63ccdbb3a9ee

include/functions_session.inc.php

@@ -66,6 +66,7 @@ if (isset($conf['session_save_handler'])
     ini_set('session.use_cookies', $conf['session_use_cookies']);
     ini_set('session.use_only_cookies', $conf['session_use_only_cookies']);
     ini_set('session.use_trans_sid', intval($conf['session_use_trans_sid']));
+    ini_set('session.cookie_httponly', 1);
   }
   session_name($conf['session_name']);
   session_set_cookie_params(0, cookie_path());
@@ -227,4 +228,4 @@ function pwg_unset_session_var($var)
   return true;
 }
 
-?>
+?>