[Security Update] Upgrading Cookie Security (UpDate 1 of 2)
by coRpSE
What was done:
I updated the way your website creates cookies (small bits of data stored in a visitor's browser). Originally, your website was using an older method to create these cookies, which didn’t include certain security and privacy settings.
We switched to a newer method that gives us more control over how cookies behave. This allowed us to add extra security features like making the cookies harder to steal or misuse.
What was changed:
What This Means for Your Site:
Your visitors' data is now better protected against some of the most common types of attacks.
Modern browsers will handle cookies on your site in a way that aligns with the latest web standards.
These changes make your site more secure and trustworthy, especially for users who care about privacy.
HOW TO INSTALL:
There are 2 available attachments, choose the one that you want:
Decided which one you want to use and download them, and read the .txt file that is included for what to do next. Any questions, feel free to ask.
I updated the way your website creates cookies (small bits of data stored in a visitor's browser). Originally, your website was using an older method to create these cookies, which didn’t include certain security and privacy settings.
We switched to a newer method that gives us more control over how cookies behave. This allowed us to add extra security features like making the cookies harder to steal or misuse.
What was changed:
- Increased Security:
We added the HttpOnly setting, which prevents the cookies from being accessed by malicious scripts. This helps protect against a type of attack called Cross-Site Scripting (XSS).
- Safer Cookie Sharing:
We added the SameSite setting and set it to "Lax." This tells browsers to only send cookies with requests that come from the same website, helping prevent a type of attack called Cross-Site Request Forgery (CSRF).
- Better Privacy:
By enabling Secure, the cookies are now only sent over encrypted HTTPS connections. This keeps them safe from being intercepted by hackers when someone is browsing your site.
- Future-Proofing:
The new method we used is recommended for modern websites because it’s more secure and works better with newer browsers.
What This Means for Your Site:
Your visitors' data is now better protected against some of the most common types of attacks.
Modern browsers will handle cookies on your site in a way that aligns with the latest web standards.
These changes make your site more secure and trustworthy, especially for users who care about privacy.
HOW TO INSTALL:
There are 2 available attachments, choose the one that you want:
- Cookle_Update-Evo_Xtreme_v2.0.10--Files - If you see the last work in that title is Files, that file has the pre-edited files for you just to upload to your site overwriting what you already have. (Of course, make backups first). Only use this one if you havn't modified any of these files on your site:
- mainfile.php
- admin.php
- includes/sessions.php
- modules/Your_Account/includes/cookiecheck.php
- modules/Your_Account/includes/functions.php
- modules/Your_Account/includes/mainfileend.php
- mainfile.php
- Cookle_Update-Evo_Xtreme_v2.0.10--Manual - This one here is for you to do the manual edits yourself. These edits aren't hard and should only take about 10 - 15 min to do, But as always, make backups before you do this.
Decided which one you want to use and download them, and read the .txt file that is included for what to do next. Any questions, feel free to ask.
UPDATE:
Thanks to msnide7, an error was spotted and fixed. So the files have been updated. If you already installed this update, the fix is to do the following.
Open:
public_html/modules/Your_Account/includes/cookiecheck.php
Find: on line 194(ish):
Replace with:
Save & Close
That's it.
Thanks to msnide7, an error was spotted and fixed. So the files have been updated. If you already installed this update, the fix is to do the following.
Open:
public_html/modules/Your_Account/includes/cookiecheck.php
Find: on line 194(ish):
Code: [ Select all ]
setcookie("CNB_test1", "1", time() - 604800,
COOKIE_PATH,
COOKIE_DOMAIN,
COOKIE_SECURE,
true, // httponly
['samesite' => 'Lax']
);
setcookie("CNB_test2", "2", time() - 604800,
COOKIE_PATH,
COOKIE_DOMAIN,
COOKIE_SECURE,
true, // httponly
['samesite' => 'Lax']
);
setcookie("CNB_test3", "3", time() - 604800,
COOKIE_PATH,
COOKIE_DOMAIN,
COOKIE_SECURE,
true, // httponly
['samesite' => 'Lax']
);
setcookie("CNB_test4", "4", time() - 604800,
COOKIE_PATH,
COOKIE_DOMAIN,
COOKIE_SECURE,
true, // httponly
['samesite' => 'Lax']
);Replace with:
Code: [ Select all ]
setcookie("CNB_test1", "1", [
'expires' => time() - 604800,
'path' => COOKIE_PATH,
'domain' => COOKIE_DOMAIN,
'secure' => COOKIE_SECURE,
'httponly' => true,
'samesite' => 'Lax'
]);
setcookie("CNB_test2", "2", [
'expires' => time() - 604800,
'path' => COOKIE_PATH,
'domain' => COOKIE_DOMAIN,
'secure' => COOKIE_SECURE,
'httponly' => true,
'samesite' => 'Lax'
]);
setcookie("CNB_test3", "3", [
'expires' => time() - 604800,
'path' => COOKIE_PATH,
'domain' => COOKIE_DOMAIN,
'secure' => COOKIE_SECURE,
'httponly' => true,
'samesite' => 'Lax'
]);
setcookie("CNB_test4", "4", [
'expires' => time() - 604800,
'path' => COOKIE_PATH,
'domain' => COOKIE_DOMAIN,
'secure' => COOKIE_SECURE,
'httponly' => true,
'samesite' => 'Lax'
]);Save & Close
That's it.