From 7cdb0165659b462927a2ace00bb7b9f6604922a8 Mon Sep 17 00:00:00 2001
From: Janos SUTO <sj@acts.hu>
Date: Sat, 12 Aug 2017 15:54:52 +0200
Subject: [PATCH] gui: improved session handling

Signed-off-by: Janos SUTO <sj@acts.hu>
---
 webui/config.php         | 10 ++++++++++
 webui/system/startup.php |  4 ----
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/webui/config.php b/webui/config.php
index a95c8ee4..5d71f7c7 100644
--- a/webui/config.php
+++ b/webui/config.php
@@ -1,5 +1,11 @@
 <?php
 
+ini_set('session.cookie_httponly', true);
+ini_set('session.use_strict_mode', 1);
+ini_set('session.use_only_cookies', 1);
+if(isset($_SERVER['HTTP_HOST'])) { ini_set('session.cookie_domain', $_SERVER['HTTP_HOST']); }
+
+
 define('NORMAL', 1);
 define('DEBUG', 5);
 
@@ -32,6 +38,8 @@ $config['THEME'] = 'default';
 $config['SITE_NAME'] = 'piler.yourdomain.com';
 $config['SITE_URL'] = 'http://piler.yourdomain.com/';
 
+$config['SESSION_EXPIRY'] = 3600;
+
 $config['ENABLE_SAAS'] = 0;
 $config['CAPTCHA_FAILED_LOGIN_COUNT'] = 0;
 
@@ -313,6 +321,8 @@ define('NOW', time());
 
 require_once 'config-site.php';
 
+ini_set('session.cookie_lifetime', $config['SESSION_EXPIRY']);
+
 require($config['DIR_BASE'] . "/system/registry.php");
 require($config['DIR_BASE'] . "/system/request.php");
 
diff --git a/webui/system/startup.php b/webui/system/startup.php
index 1bda8668..dada3cdc 100644
--- a/webui/system/startup.php
+++ b/webui/system/startup.php
@@ -6,8 +6,6 @@ require(DIR_SYSTEM . "/front.php");
 require(DIR_SYSTEM . "/language.php");
 require(DIR_SYSTEM . "/loader.php");
 require(DIR_SYSTEM . "/model.php");
-//require(DIR_SYSTEM . "/registry.php");
-//require(DIR_SYSTEM . "/request.php");
 require(DIR_SYSTEM . "/router.php");
 
 require(DIR_SYSTEM . "/misc.php");
@@ -26,5 +24,3 @@ if(TSA_URL) {
 
 
 date_default_timezone_set(TIMEZONE);
-
-?>