Respect 'session.cookie_secure' if it is On

diff --git a/adminer/include/bootstrap.inc.php b/adminer/include/bootstrap.inc.php
index b07e68cfcdd4028bc872aff72a5eec2209b0e503..1db4e2edd08213e5e314bc0063413900c11567ff 100644 (file)
--- a/adminer/include/bootstrap.inc.php
+++ b/adminer/include/bootstrap.inc.php
@@ -44,7 +44,7 @@ if (!strpos($_SERVER["REQUEST_URI"], '?') && $_SERVER["QUERY_STRING"] != "") { /
 if ($_SERVER["HTTP_X_FORWARDED_PREFIX"]) {
        $_SERVER["REQUEST_URI"] = $_SERVER["HTTP_X_FORWARDED_PREFIX"] . $_SERVER["REQUEST_URI"];
 }
-$HTTPS = $_SERVER["HTTPS"] && strcasecmp($_SERVER["HTTPS"], "off");
+$HTTPS = ($_SERVER["HTTPS"] && strcasecmp($_SERVER["HTTPS"], "off")) || ini_bool("session.cookie_secure"); // session.cookie_secure could be set on HTTP if we are behind a reverse proxy
 
 @ini_set("session.use_trans_sid", false); // protect links in export, @ - may be disabled
 if (!defined("SID")) {

diff --git a/changes.txt b/changes.txt
index 96acd7bca70e3cca81587488e67cc628ac5277d8..77f862d884a15ec202810214a30986da0894cdc4 100644 (file)
--- a/changes.txt
+++ b/changes.txt
@@ -5,6 +5,7 @@ Stop session before connecting
 Simplify running slow queries
 Decrease timeout for running slow queries from 5 seconds to 2 seconds
 Fix displaying info about non-alphabetical objects (bug #599)
+Use secure cookies on HTTP if session.cookie_secure is set
 PDO: Support binary fields download
 MySQL: Use CONVERT() only when searching for non-ASCII (bug #603)
 PostgreSQL: Add SQL operator to search