Mercurial > defr > drupal > core

comparison includes/bootstrap.inc @ 11:589fb7c02327 6.5

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Drupal 6.5
author Franck Deroche <webmaster@defr.org>
date Tue, 23 Dec 2008 14:32:19 +0100
parents fff6d4c8c043
children 8b6c45761e01
comparison
equal deleted inserted replaced
10:6f15c9d74937 11:589fb7c02327
1 <?php 1 <?php
2 // $Id: bootstrap.inc,v 1.206.2.3 2008/07/09 19:15:59 goba Exp $ 2 // $Id: bootstrap.inc,v 1.206.2.4 2008/08/18 18:56:30 dries Exp $
3 3
4 /** 4 /**
5 * @file 5 * @file
6 * Functions that need to be loaded on every Drupal request. 6 * Functions that need to be loaded on every Drupal request.
7 */ 7 */
326 list( , $session_name) = explode('://', $base_url, 2); 326 list( , $session_name) = explode('://', $base_url, 2);
327 // We escape the hostname because it can be modified by a visitor. 327 // We escape the hostname because it can be modified by a visitor.
328 if (!empty($_SERVER['HTTP_HOST'])) { 328 if (!empty($_SERVER['HTTP_HOST'])) {
329 $cookie_domain = check_plain($_SERVER['HTTP_HOST']); 329 $cookie_domain = check_plain($_SERVER['HTTP_HOST']);
330 } 330 }
331 }
332 // To prevent session cookies from being hijacked, a user can configure the
333 // SSL version of their website to only transfer session cookies via SSL by
334 // using PHP's session.cookie_secure setting. The browser will then use two
335 // separate session cookies for the HTTPS and HTTP versions of the site. So we
336 // must use different session identifiers for HTTPS and HTTP to prevent a
337 // cookie collision.
338 if (ini_get('session.cookie_secure')) {
339 $session_name .= 'SSL';
331 } 340 }
332 // Strip leading periods, www., and port numbers from cookie domain. 341 // Strip leading periods, www., and port numbers from cookie domain.
333 $cookie_domain = ltrim($cookie_domain, '.'); 342 $cookie_domain = ltrim($cookie_domain, '.');
334 if (strpos($cookie_domain, 'www.') === 0) { 343 if (strpos($cookie_domain, 'www.') === 0) {
335 $cookie_domain = substr($cookie_domain, 4); 344 $cookie_domain = substr($cookie_domain, 4);