In the web installer, use secure session cookies

[lhc/web/wiklou.git] / includes / installer / WebInstaller.php

diff --git a/includes/installer/WebInstaller.php b/includes/installer/WebInstaller.php
index 9d7e051..545cc06 100644 (file)
--- a/includes/installer/WebInstaller.php
+++ b/includes/installer/WebInstaller.php
@@ -341,11 +341,17 @@ class WebInstaller extends Installer {
                        return true;
                }
 
+               // Use secure cookies if we are on HTTPS
+               $options = [];
+               if ( $this->request->getProtocol() === 'https' ) {
+                       $options['cookie_secure'] = '1';
+               }
+
                $this->phpErrors = [];
                set_error_handler( [ $this, 'errorHandler' ] );
                try {
                        session_name( 'mw_installer_session' );
-                       session_start();
+                       session_start( $options );
                } catch ( Exception $e ) {
                        restore_error_handler();
                        throw $e;
@@ -915,6 +921,7 @@ class WebInstaller extends Installer {
         *    Parameters are:
         *      var:         The variable to be configured (required)
         *      label:       The message name for the label (required)
+        *      labelAttribs:Additional attributes for the label element (optional)
         *      attribs:     Additional attributes for the input element (optional)
         *      controlName: The name for the input element (optional)
         *      value:       The current value of the variable (optional)
@@ -937,6 +944,9 @@ class WebInstaller extends Installer {
                if ( !isset( $params['help'] ) ) {
                        $params['help'] = "";
                }
+               if ( !isset( $params['labelAttribs'] ) ) {
+                       $params['labelAttribs'] = [];
+               }
                if ( isset( $params['rawtext'] ) ) {
                        $labelText = $params['rawtext'];
                } else {
@@ -945,17 +955,19 @@ class WebInstaller extends Installer {
 
                return "<div class=\"config-input-check\">\n" .
                        $params['help'] .
-                       "<label>\n" .
-                       Xml::check(
-                               $params['controlName'],
-                               $params['value'],
-                               $params['attribs'] + [
-                                       'id' => $params['controlName'],
-                                       'tabindex' => $this->nextTabIndex(),
-                               ]
-                       ) .
-                       $labelText . "\n" .
-                       "</label>\n" .
+                       Html::rawElement(
+                               'label',
+                               $params['labelAttribs'],
+                               Xml::check(
+                                       $params['controlName'],
+                                       $params['value'],
+                                       $params['attribs'] + [
+                                               'id' => $params['controlName'],
+                                               'tabindex' => $this->nextTabIndex(),
+                                       ]
+                               ) .
+                               $labelText . "\n"
+                               ) .
                        "</div>\n";
        }