#4148 - Build-in API support: cookie settings

inc/utils.inc.php

@@ -2279,15 +2279,19 @@ function bx_setcookie($sName, $sValue = "", $oExpiresOrOptions = 0, $sPath = 'au
         $sDomain = $aUrl['host'];
     }
 
-    if ('auto' === $sPath)
-        $sPath = isset($aUrl['path']) && !empty($aUrl['path']) && !bx_is_api() ? $aUrl['path'] : '/';
-
-    if ('auto' === $bSecure)
+    if (bx_is_api())
+        $sPath = trim(getParam('sys_api_cookie_path'));
+    elseif ('auto' === $sPath)
+        $sPath = isset($aUrl['path']) && !empty($aUrl['path']) ? $aUrl['path'] : '/';
+
+    if (bx_is_api())
+        $bSecure = !!getParam('sys_api_cookie_secure');
+    elseif ('auto' === $bSecure)
         $bSecure = 0 === strcasecmp('https', $aUrl['scheme']);
 
     if (PHP_VERSION_ID < 70300) {
-        if (!defined('BX_MULTISITE_URL_COOKIE') && ('memberPassword' == $sName || 'memberSession' == $sName || bx_is_api()))
-            $sPath .= '; SameSite=' . getParam('sys_samesite_cookies');
+        if (!defined('BX_MULTISITE_URL_COOKIE') && ('memberPassword' == $sName || 'memberSession' == $sName))
+            $sPath .= '; SameSite=' . (bx_is_api() ? getParam('sys_api_cookie_samesite') : getParam('sys_samesite_cookies'));
         return setcookie($sName, $sValue, $oExpiresOrOptions, $sPath, $sDomain, $bSecure, $bHttpOnly);
     } 
     else {
@@ -2298,8 +2302,8 @@ function bx_setcookie($sName, $sValue = "", $oExpiresOrOptions = 0, $sPath = 'au
             'secure' => $bSecure, 
             'httponly' => $bHttpOnly,
         ];
-        if (!defined('BX_MULTISITE_URL_COOKIE') && !isset($aOptions['samesite']) && ('memberPassword' == $sName || 'memberSession' == $sName || bx_is_api()))
-            $aOptions['samesite'] = getParam('sys_samesite_cookies');
+        if (!defined('BX_MULTISITE_URL_COOKIE') && !isset($aOptions['samesite']) && ('memberPassword' == $sName || 'memberSession' == $sName))
+            $aOptions['samesite'] = bx_is_api() ? getParam('sys_api_cookie_samesite') : getParam('sys_samesite_cookies');
 
         return setcookie($sName, $sValue, $aOptions);
     }

install/sql/system.sql

@@ -709,7 +709,12 @@ INSERT INTO `sys_options`(`category_id`, `name`, `caption`, `value`, `type`, `ex
 (@iCategoryId, 'sys_api_access_by_origin', '_adm_stg_cpt_option_sys_api_access_by_origin', '', 'checkbox', '', '', '', 10),
 (@iCategoryId, 'sys_api_access_by_key', '_adm_stg_cpt_option_sys_api_access_by_key', '', 'checkbox', '', '', '', 20),
 (@iCategoryId, 'sys_api_access_unsafe_services', '_adm_stg_cpt_option_sys_api_access_unsafe_services', '', 'checkbox', '', '', '', 30),
-(@iCategoryId, 'sys_api_comments_flat', '_adm_stg_cpt_option_sys_api_comments_flat', '', 'checkbox', '', '', '', 40);
+(@iCategoryId, 'sys_api_cookie_path', '_adm_stg_cpt_option_sys_api_cookie_path', '/', 'digit', '', '', '', 40),
+(@iCategoryId, 'sys_api_cookie_secure', '_adm_stg_cpt_option_sys_api_cookie_secure', '', 'checkbox', '', '', '', 42),
+(@iCategoryId, 'sys_api_cookie_samesite', '_adm_stg_cpt_option_sys_api_cookie_samesite', 'Lax', 'select', 'None,Lax,Strict', '', '', 44),
+
+
+(@iCategoryId, 'sys_api_comments_flat', '_adm_stg_cpt_option_sys_api_comments_flat', '', 'checkbox', '', '', '', 100);
 --
 -- Table structure for table `sys_options_mixes`
 --

modules/boonex/english/data/langs/system/en.xml

@@ -1713,6 +1713,9 @@
     <string name="_adm_stg_cpt_option_sys_api_access_by_origin"><![CDATA[Allow access by origin]]></string>
     <string name="_adm_stg_cpt_option_sys_api_access_by_key"><![CDATA[Allow access with API key]]></string>
     <string name="_adm_stg_cpt_option_sys_api_access_unsafe_services"><![CDATA[Access to unsafe services]]></string>
+    <string name="_adm_stg_cpt_option_sys_api_cookie_path"><![CDATA[Cookies path]]></string>
+    <string name="_adm_stg_cpt_option_sys_api_cookie_secure"><![CDATA[Secure cookies]]></string>
+    <string name="_adm_stg_cpt_option_sys_api_cookie_samesite"><![CDATA[Cookies SameSite attribute]]></string>
     <string name="_adm_stg_cpt_option_sys_api_comments_flat"><![CDATA[Flat comments]]></string>
 
 	<string name="_adm_stg_cpt_type_system"><![CDATA[System]]></string>

modules/boonex/russian/data/langs/system/ru.xml

@@ -1691,6 +1691,9 @@
     <string name="_adm_stg_cpt_option_sys_api_access_by_origin"><![CDATA[Доступ по "origin" заголовку]]></string>
     <string name="_adm_stg_cpt_option_sys_api_access_by_key"><![CDATA[Доступ по API ключу]]></string>
     <string name="_adm_stg_cpt_option_sys_api_access_unsafe_services"><![CDATA[Доступ к небезопасным сервисам]]></string>
+    <string name="_adm_stg_cpt_option_sys_api_cookie_path"><![CDATA[Путь к файлам cookie]]></string>
+    <string name="_adm_stg_cpt_option_sys_api_cookie_secure"><![CDATA[Безопасные cookie]]></string>
+    <string name="_adm_stg_cpt_option_sys_api_cookie_samesite"><![CDATA[Значение для SameSite атрибута]]></string>
     <string name="_adm_stg_cpt_option_sys_api_comments_flat"><![CDATA[Линейные комментарии]]></string>
 
     <string name="_adm_stg_cpt_type_system"><![CDATA[Система]]></string>