Merge "Disallow top level domains in Cookie::validateCookieDomain()."

diff --cc includes/Cookie.php
index b8d34e2,d4c342b..8b5906a
--- 1/includes/Cookie.php
--- 2/includes/Cookie.php
+++ b/includes/Cookie.php
@@@ -85,13 -85,17 +85,17 @@@ class Cookie 
         * @todo fixme fails to detect 2-letter top-level domains for single-domain use (probably
         * not a big problem in practice, but there are test cases)
         *
 -       * @param string $domain the domain to validate
 +       * @param string $domain The domain to validate
         * @param string $originDomain (optional) the domain the cookie originates from
 -       * @return Boolean
 +       * @return bool
         */
        public static function validateCookieDomain( $domain, $originDomain = null ) {
-               // Don't allow a trailing dot
-               if ( substr( $domain, -1 ) == '.' ) {
+               $dc = explode( ".", $domain );
+ 
+               // Don't allow a trailing dot or addresses without a or just a leading dot
+               if ( substr( $domain, -1 ) == '.' ||
+                        count( $dc ) <= 1 ||
+                        count( $dc ) == 2 && $dc[0] === '' ) {
                        return false;
                }