Set Samesite=Strict for PHP session cookie. The cookie is set manually to be backwards compatible with versions below PHP7.3

Signed-off-by: DL6ER <dl6er@dl6er.de>

scripts/pi-hole/php/auth.php

@@ -100,19 +100,8 @@ function check_cors()
 
 function check_csrf($token)
 {
-    // Check CSRF token
-    $session_started = function_exists('session_status') ?
-        session_status() == PHP_SESSION_ACTIVE :
-        session_id() == '';
-
-    if (!$session_started) {
-        // Start a new PHP session (or continue an existing one)
-        // Prevents javascript XSS attacks aimed to steal the session ID
-        ini_set('session.cookie_httponly', 1);
-        // Prevent Session ID from being passed through URLs
-        ini_set('session.use_only_cookies', 1);
-        session_start();
-    }
+    // Start a new PHP session (or continue an existing one)
+    start_php_session();
 
     if (!isset($_SESSION['token'])) {
         log_and_die('Session expired! Please re-login on the Pi-hole dashboard.');

scripts/pi-hole/php/func.php

@@ -653,3 +653,19 @@ function convertseconds($argument)
 
     return sprintf('%dd %dh %dm %ds', $seconds / 86400, $seconds / 3600 % 24, $seconds / 60 % 60, $seconds % 60);
 }
+
+function start_php_session()
+{
+    // Prevent Session ID from being passed through URLs
+    ini_set('session.use_only_cookies', 1);
+    session_start();
+    // HttpOnly: Prevents javascript XSS attacks aimed to steal the session ID
+    //
+    // SameSite=Strict: Allows servers to assert that a cookie ought not to be
+    // sent along with cross-site requests. This assertion allows user agents to
+    // mitigate the risk of cross-origin information leakage, and provides some
+    // protection against cross-site request forgery attacks.
+    // Direct support of Samesite has been added to PHP only in version 7.3
+    // We manually set the cookie option ourselves to ensure backwards compatibility
+    header('Set-Cookie: PHPSESSID= '.session_id().'; path=/; HttpOnly; SameSite=Strict');
+}

scripts/pi-hole/php/password.php

@@ -9,13 +9,8 @@
 
 require_once 'func.php';
 
-// Prevents javascript XSS attacks aimed to steal the session ID
-ini_set('session.cookie_httponly', 1);
-// Prevent Session ID from being passed through URLs
-ini_set('session.use_only_cookies', 1);
-
 // Start a new PHP session (or continue an existing one)
-session_start();
+start_php_session();
 
 // Read setupVars.conf file
 $setupVars = parse_ini_file('/etc/pihole/setupVars.conf');