From fa73c7cd8bccadca9970d03f534d4546b06d3adf Mon Sep 17 00:00:00 2001
From: Renato Botelho <garga@FreeBSD.org>
Date: Wed, 18 Jun 2014 07:38:12 -0300
Subject: [PATCH] Always set httponly attribute on cookies

---
 etc/inc/auth.inc | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index b0051dd85c..a63ce45ea0 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -1342,16 +1342,14 @@ function session_auth() {
 	global $HTTP_SERVER_VARS, $config, $_SESSION, $page;
 
 	// Handle HTTPS httponly and secure flags
-	if($config['system']['webgui']['protocol'] == "https") {
-		$currentCookieParams = session_get_cookie_params();
-		session_set_cookie_params(
-			$currentCookieParams["lifetime"],
-			$currentCookieParams["path"],
-			NULL,
-			true,
-			true
-		);
-	}
+	$currentCookieParams = session_get_cookie_params();
+	session_set_cookie_params(
+		$currentCookieParams["lifetime"],
+		$currentCookieParams["path"],
+		NULL,
+		($config['system']['webgui']['protocol'] == "https"),
+		true
+	);
 
 	if (!session_id())
 		session_start();