CRM-16900. Set secure flag to restrict cookies to SSL where appropriate.

diff --git a/CRM/Campaign/BAO/Petition.php b/CRM/Campaign/BAO/Petition.php
index d5e4c0a2ecbd37f0e9816c20ee743cc8aeebd483..2c5adc6a40266434b2fcc7bf33f832849441edfc 100644 (file)
--- a/CRM/Campaign/BAO/Petition.php
+++ b/CRM/Campaign/BAO/Petition.php
@@ -220,9 +220,10 @@ SELECT  petition.id                         as id,
         CRM_Core_BAO_CustomValueTable::store($params['custom'], 'civicrm_activity', $activity->id);
       }
 
-      // set permanent cookie to indicate this petition already signed on the computer
+      // Set browser cookie to indicate this petition was already signed.
       $config = CRM_Core_Config::singleton();
-      setcookie('signed_' . $params['sid'], $activity->id, time() + $this->cookieExpire, $config->userFrameworkBaseURL);
+      $url_parts = parse_url($config->userFrameworkBaseURL);
+      setcookie('signed_' . $params['sid'], $activity->id, time() + $this->cookieExpire, $url_parts['path'], $url_parts['host'], CRM_Utils_System::isSSL());
     }
 
     return $activity;
@@ -268,10 +269,13 @@ AND         tag_id = ( SELECT id FROM civicrm_tag WHERE name = %2 )";
       && isset($activity_id) && is_numeric($activity_id)) {
       // set permanent cookie to indicate this users email address now confirmed
       $config = CRM_Core_Config::singleton();
+      $url_parts = parse_url($config->userFrameworkBaseURL);
       setcookie("confirmed_{$petition_id}",
         $activity_id,
         time() + $this->cookieExpire,
-        $config->userFrameworkBaseURL
+        $url_parts['path'],
+        $url_parts['host'],
+        CRM_Utils_System::isSSL()
       );
       return TRUE;
     }