SECURITY: RawAction: Vary on the usual headers

[lhc/web/wiklou.git] / includes / OutputPage.php

diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index 67e9a4f..d8600c1 100644 (file)
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -2026,6 +2026,11 @@ class OutputPage extends ContextSource {
         * @return string
         */
        public function getVaryHeader() {
+               // If we vary on cookies, let's make sure it's always included here too.
+               if ( $this->getCacheVaryCookies() ) {
+                       $this->addVaryHeader( 'Cookie' );
+               }
+
                foreach ( SessionManager::singleton()->getVaryHeaders() as $header => $options ) {
                        $this->addVaryHeader( $header, $options );
                }