From 8791177c39364c079ab7d8b282810aa1ad5e46e6 Mon Sep 17 00:00:00 2001 From: sbassett Date: Fri, 24 Jul 2020 11:31:37 -0500 Subject: [PATCH] [SECURITY] mf_useformat cookie should be HttpOnly The mf_useformat cookie within MobileFrontend should set the HttpOnly attribute to true. Bug: T238075 Change-Id: I8e84f1cbc8878974532b511cebd9de40c5de55c6 --- includes/MobileContext.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/includes/MobileContext.php b/includes/MobileContext.php index 31fddaa7b..425aee21c 100644 --- a/includes/MobileContext.php +++ b/includes/MobileContext.php @@ -604,7 +604,7 @@ class MobileContext extends ContextSource { $expiry, [ 'prefix' => '', - 'httpOnly' => false, + 'httpOnly' => true, ] ); $stats = MediaWikiServices::getInstance()->getStatsdDataFactory(); -- 2.22.0