mirror of
https://github.com/bdnugget/php-wasm.git
synced 2026-11-07 09:07:28 +00:00
69 lines
3.0 KiB
Diff
69 lines
3.0 KiB
Diff
diff --git a/third_party/drupal-7.95/includes/bootstrap.inc b/third_party/drupal-7.95-original/includes/bootstrap.inc
|
|
index 4f7a8f6..980ad35 100644
|
|
--- a/third_party/drupal-7.95/includes/bootstrap.inc
|
|
+++ b/third_party/drupal-7.95/includes/bootstrap.inc
|
|
@@ -696,14 +696,14 @@ function drupal_environment_initialize() {
|
|
ini_set('magic_quotes_runtime', '0');
|
|
// Use session cookies, not transparent sessions that puts the session id in
|
|
// the query string.
|
|
- ini_set('session.use_cookies', '1');
|
|
- ini_set('session.use_only_cookies', '1');
|
|
- ini_set('session.use_trans_sid', '0');
|
|
+ // ini_set('session.use_cookies', '1');
|
|
+ // ini_set('session.use_only_cookies', '1');
|
|
+ // ini_set('session.use_trans_sid', '0');
|
|
// Don't send HTTP headers using PHP's session handler.
|
|
// An empty string is used here to disable the cache limiter.
|
|
- ini_set('session.cache_limiter', '');
|
|
+ // ini_set('session.cache_limiter', '');
|
|
// Use httponly session cookies.
|
|
- ini_set('session.cookie_httponly', '1');
|
|
+ // ini_set('session.cookie_httponly', '1');
|
|
|
|
// Set sane locale settings, to ensure consistent string, dates, times and
|
|
// numbers handling.
|
|
@@ -801,14 +801,14 @@ function drupal_settings_initialize() {
|
|
$session_name = $cookie_domain;
|
|
}
|
|
else {
|
|
- // Otherwise use $base_url as session name, without the protocol
|
|
- // to use the same session identifiers across HTTP and HTTPS.
|
|
- list( , $session_name) = explode('://', $base_url, 2);
|
|
- // HTTP_HOST can be modified by a visitor, but we already sanitized it
|
|
- // in drupal_settings_initialize().
|
|
- if (!empty($_SERVER['HTTP_HOST'])) {
|
|
- $cookie_domain = _drupal_get_cookie_domain($_SERVER['HTTP_HOST']);
|
|
- }
|
|
+ // // Otherwise use $base_url as session name, without the protocol
|
|
+ // // to use the same session identifiers across HTTP and HTTPS.
|
|
+ // list( , $session_name) = explode('://', $base_url, 2);
|
|
+ // // HTTP_HOST can be modified by a visitor, but we already sanitized it
|
|
+ // // in drupal_settings_initialize().
|
|
+ // if (!empty($_SERVER['HTTP_HOST'])) {
|
|
+ // $cookie_domain = _drupal_get_cookie_domain($_SERVER['HTTP_HOST']);
|
|
+ // }
|
|
|
|
// Drupal 7.83 included a security improvement whereby www. is no longer
|
|
// stripped from the cookie domain. However, this can cause problems with
|
|
diff --git a/third_party/drupal-7.95/sites/default/files/.htaccess b/third_party/drupal-7.95/sites/default/files/.htaccess
|
|
new file mode 100644
|
|
--- /dev/null
|
|
+++ b/third_party/drupal-7.95/sites/default/files/.htaccess
|
|
@@ -0,0 +1,16 @@
|
|
+# Turn off all options we don't need.
|
|
+Options None
|
|
+Options +FollowSymLinks
|
|
+
|
|
+# Set the catch-all handler to prevent scripts from being executed.
|
|
+SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
|
|
+<Files *>
|
|
+ # Override the handler again if we're run later in the evaluation list.
|
|
+ SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
|
|
+</Files>
|
|
+
|
|
+# If we know how to do it safely, disable the PHP engine entirely.
|
|
+<IfModule mod_php5.c>
|
|
+ php_flag engine off
|
|
+</IfModule>
|
|
+
|