diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index ee955bc3ed5..31be8e4360b 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -1370,6 +1370,40 @@ function sanitizeVal($out = '', $check = 'alphanohtml', $filter = null, $options
return $out;
}
+/**
+ * Set a cookie
+ *
+ * @param string $cookiename Cookie name
+ * @param string $cookievalue Cookie value
+ * @param int $expire Expire delay. If 0, expire at end of session. -1 means 1 year.
+ * @return void
+ */
+function dolSetCookie(string $cookiename, string $cookievalue, int $expire = -1)
+{
+ global $dolibarr_main_force_https;
+
+ if ($expire == -1) {
+ $expire = (time() + (86400 * 354)); // keep cookie 1 year.
+ }
+
+ if (PHP_VERSION_ID < 70300) {
+ setcookie($cookiename, empty($cookievalue) ? '' : $cookievalue, empty($cookievalue) ? 0 : $expire, '/', '', !(empty($dolibarr_main_force_https) && isHTTPS() === false), true); // add tag httponly
+ } else {
+ // Only available for php >= 7.3
+ $cookieparams = array(
+ 'expires' => empty($cookievalue) ? 0 : $expire,
+ 'path' => '/',
+ //'domain' => '.mywebsite.com', // the dot at the beginning allows compatibility with subdomains
+ 'secure' => !(empty($dolibarr_main_force_https) && isHTTPS() === false),
+ 'httponly' => true,
+ 'samesite' => 'Lax' // None || Lax || Strict
+ );
+ setcookie($cookiename, empty($cookievalue) ? '' : $cookievalue, $cookieparams);
+ }
+ if (empty($cookievalue)) {
+ unset($_COOKIE[$cookiename]);
+ }
+}
if (!function_exists('dol_getprefix')) {
/**
diff --git a/htdocs/core/lib/security2.lib.php b/htdocs/core/lib/security2.lib.php
index 27c42b94192..3ac12c9f211 100644
--- a/htdocs/core/lib/security2.lib.php
+++ b/htdocs/core/lib/security2.lib.php
@@ -197,22 +197,7 @@ if (!function_exists('dol_loginfunction')) {
if (getDolGlobalString('MAIN_SESSION_TIMEOUT')) {
if (session_status() != PHP_SESSION_ACTIVE) {
- if (PHP_VERSION_ID < 70300) {
- session_set_cookie_params(0, '/', null, !(empty($dolibarr_main_force_https) && isHTTPS() === false), true); // Add tag secure and httponly on session cookie (same as setting session.cookie_httponly into php.ini). Must be called before the session_start.
- } else {
- // Only available for php >= 7.3
- $sessioncookieparams = array(
- 'lifetime' => 0,
- 'path' => '/',
- //'domain' => '.mywebsite.com', // the dot at the beginning allows compatibility with subdomains
- 'secure' => !(empty($dolibarr_main_force_https) && isHTTPS() === false),
- 'httponly' => true,
- 'samesite' => 'Lax' // None || Lax || Strict
- );
- session_set_cookie_params($sessioncookieparams);
- }
-
- setcookie($sessiontimeout, getDolGlobalString('MAIN_SESSION_TIMEOUT'), 0, "/", '', !empty($dolibarr_main_force_https), true);
+ dolSetCookie($sessiontimeout, getDolGlobalString('MAIN_SESSION_TIMEOUT'), 0);
}
}
diff --git a/htdocs/core/modules/openid_connect/callback.php b/htdocs/core/modules/openid_connect/callback.php
index c55a4772053..065e6801588 100644
--- a/htdocs/core/modules/openid_connect/callback.php
+++ b/htdocs/core/modules/openid_connect/callback.php
@@ -1,4 +1,4 @@
-top_htmlhead
*
* This program is free software; you can redistribute it and/or modify
@@ -30,9 +30,12 @@ if (!defined('NOTOKENRENEWAL')) {
require '../../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/functions.lib.php';
+
/**
* @var string $dolibarr_main_url_root
+ * @var string $dolibarr_main_force_https
*/
+
// Javascript code on logon page only to detect user tz, dst_observed, dst_first, dst_second
$arrayofjs = array(
'/includes/jstz/jstz.min.js'.(empty($conf->dol_use_jmobile) ? '' : '?version='.urlencode(DOL_VERSION)),
@@ -42,16 +45,19 @@ $arrayofjs = array(
top_htmlhead('', '', 0, 0, $arrayofjs);
$prefix = dol_getprefix('');
-$rollback_url = $_COOKIE["DOL_rollback_url_$prefix"];
-if (empty($rollback_url) || $rollback_url === '/') {
- $action = $dolibarr_main_url_root . '/index.php?mainmenu=home&leftmenu=';
+$callbackUrl = $_COOKIE["DOL_rollback_url_".$prefix]; // Was set by login page to $_SERVER['REQUEST_URI'] to allow come back to initial requested page
+if (empty($callbackUrl) || !preg_match('/^\//', $callbackUrl)) {
+ // We accept only value that is an internal relative URL. URL starting with http are not allowed.
+ $callbackUrl = '/';
+}
+if ($callbackUrl === '/') {
+ $callbackUrl = $dolibarr_main_url_root . '/index.php?mainmenu=home&leftmenu=';
} else {
- $action = $rollback_url;
- setcookie('DOL_rollback_url_' . dol_getprefix(''), "", time() + 1, '/');
+ dolSetCookie('DOL_rollback_url_'.dol_getprefix(''), "", time() + 1);
}
?>
-