original_string: protected static function prepare_cookies() {
          global $CFG;
  
          $cookiesecure = is_moodle_cookie_secure();
  
          if (!isset($CFG->cookiehttponly)) {
              $CFG->cookiehttponly = 0;
          }
  
          // Set sessioncookie variable if it isn't already.
          if (!isset($CFG->sessioncookie)) {
              $CFG->sessioncookie = '';
          }
          $sessionname = 'MoodleSession'.$CFG->sessioncookie;
  
          // Make sure cookie domain makes sense for this wwwroot.
          if (!isset($CFG->sessioncookiedomain)) {
              $CFG->sessioncookiedomain = '';
          } else if ($CFG->sessioncookiedomain !== '') {
              $host = parse_url($CFG->wwwroot, PHP_URL_HOST);
              if ($CFG->sessioncookiedomain !== $host) {
                  if (substr($CFG->sessioncookiedomain, 0, 1) === '.') {
                      if (!preg_match('|^.*'.preg_quote($CFG->sessioncookiedomain, '|').'$|', $host)) {
                          // Invalid domain - it must be end part of host.
                          $CFG->sessioncookiedomain = '';
                      }
                  } else {
                      if (!preg_match('|^.*\.'.preg_quote($CFG->sessioncookiedomain, '|').'$|', $host)) {
                          // Invalid domain - it must be end part of host.
                          $CFG->sessioncookiedomain = '';
                      }
                  }
              }
          }
  
          // Make sure the cookiepath is valid for this wwwroot or autodetect if not specified.
          if (!isset($CFG->sessioncookiepath)) {
              $CFG->sessioncookiepath = '';
          }
          if ($CFG->sessioncookiepath !== '/') {
              $path = parse_url($CFG->wwwroot, PHP_URL_PATH).'/';
              if ($CFG->sessioncookiepath === '') {
                  $CFG->sessioncookiepath = $path;
              } else {
                  if (strpos($path, $CFG->sessioncookiepath) !== 0 or substr($CFG->sessioncookiepath, -1) !== '/') {
                      $CFG->sessioncookiepath = $path;
                  }
              }
          }
  
          // Discard session ID from POST, GET and globals to tighten security,
          // this is session fixation prevention.
          unset($GLOBALS[$sessionname]);
          unset($_GET[$sessionname]);
          unset($_POST[$sessionname]);
          unset($_REQUEST[$sessionname]);
  
          // Compatibility hack for non-browser access to our web interface.
          if (!empty($_COOKIE[$sessionname]) && $_COOKIE[$sessionname] == "deleted") {
              unset($_COOKIE[$sessionname]);
          }
  
          // Set configuration.
          session_name($sessionname);
          session_set_cookie_params(0, $CFG->sessioncookiepath, $CFG->sessioncookiedomain, $cookiesecure, $CFG->cookiehttponly);
          ini_set('session.use_trans_sid', '0');
          ini_set('session.use_only_cookies', '1');
          ini_set('session.hash_function', '0');        // For now MD5 - we do not have room for sha-1 in sessions table.
          ini_set('session.use_strict_mode', '0');      // We have custom protection in session init.
          ini_set('session.serialize_handler', 'php');  // We can move to 'php_serialize' after we require PHP 5.5.4 form Moodle.
  
          // Moodle does normal session timeouts, this is for leftovers only.
          ini_set('session.gc_probability', 1);
          ini_set('session.gc_divisor', 1000);
          ini_set('session.gc_maxlifetime', 60*60*24*4);
      }
code: protected static function prepare_cookies() {
          global $CFG;
  
          $cookiesecure = is_moodle_cookie_secure();
  
          if (!isset($CFG->cookiehttponly)) {
              $CFG->cookiehttponly = 0;
          }
  
          // Set sessioncookie variable if it isn't already.
          if (!isset($CFG->sessioncookie)) {
              $CFG->sessioncookie = '';
          }
          $sessionname = 'MoodleSession'.$CFG->sessioncookie;
  
          // Make sure cookie domain makes sense for this wwwroot.
          if (!isset($CFG->sessioncookiedomain)) {
              $CFG->sessioncookiedomain = '';
          } else if ($CFG->sessioncookiedomain !== '') {
              $host = parse_url($CFG->wwwroot, PHP_URL_HOST);
              if ($CFG->sessioncookiedomain !== $host) {
                  if (substr($CFG->sessioncookiedomain, 0, 1) === '.') {
                      if (!preg_match('|^.*'.preg_quote($CFG->sessioncookiedomain, '|').'$|', $host)) {
                          // Invalid domain - it must be end part of host.
                          $CFG->sessioncookiedomain = '';
                      }
                  } else {
                      if (!preg_match('|^.*\.'.preg_quote($CFG->sessioncookiedomain, '|').'$|', $host)) {
                          // Invalid domain - it must be end part of host.
                          $CFG->sessioncookiedomain = '';
                      }
                  }
              }
          }
  
          // Make sure the cookiepath is valid for this wwwroot or autodetect if not specified.
          if (!isset($CFG->sessioncookiepath)) {
              $CFG->sessioncookiepath = '';
          }
          if ($CFG->sessioncookiepath !== '/') {
              $path = parse_url($CFG->wwwroot, PHP_URL_PATH).'/';
              if ($CFG->sessioncookiepath === '') {
                  $CFG->sessioncookiepath = $path;
              } else {
                  if (strpos($path, $CFG->sessioncookiepath) !== 0 or substr($CFG->sessioncookiepath, -1) !== '/') {
                      $CFG->sessioncookiepath = $path;
                  }
              }
          }
  
          // Discard session ID from POST, GET and globals to tighten security,
          // this is session fixation prevention.
          unset($GLOBALS[$sessionname]);
          unset($_GET[$sessionname]);
          unset($_POST[$sessionname]);
          unset($_REQUEST[$sessionname]);
  
          // Compatibility hack for non-browser access to our web interface.
          if (!empty($_COOKIE[$sessionname]) && $_COOKIE[$sessionname] == "deleted") {
              unset($_COOKIE[$sessionname]);
          }
  
          // Set configuration.
          session_name($sessionname);
          session_set_cookie_params(0, $CFG->sessioncookiepath, $CFG->sessioncookiedomain, $cookiesecure, $CFG->cookiehttponly);
          ini_set('session.use_trans_sid', '0');
          ini_set('session.use_only_cookies', '1');
          ini_set('session.hash_function', '0');        // For now MD5 - we do not have room for sha-1 in sessions table.
          ini_set('session.use_strict_mode', '0');      // We have custom protection in session init.
          ini_set('session.serialize_handler', 'php');  // We can move to 'php_serialize' after we require PHP 5.5.4 form Moodle.
  
          // Moodle does normal session timeouts, this is for leftovers only.
          ini_set('session.gc_probability', 1);
          ini_set('session.gc_divisor', 1000);
          ini_set('session.gc_maxlifetime', 60*60*24*4);
      }
code_tokens: protected static function prepare_cookies ( ) { global $ CFG ; $ cookiesecure = is_moodle_cookie_secure ( ) ; if ( ! isset ( $ CFG -> cookiehttponly ) ) { $ CFG -> cookiehttponly = 0 ; } // Set sessioncookie variable if it isn't already. if ( ! isset ( $ CFG -> sessioncookie ) ) { $ CFG -> sessioncookie = '' ; } $ sessionname = 'MoodleSession' . $ CFG -> sessioncookie ; // Make sure cookie domain makes sense for this wwwroot. if ( ! isset ( $ CFG -> sessioncookiedomain ) ) { $ CFG -> sessioncookiedomain = '' ; } else if ( $ CFG -> sessioncookiedomain !== '' ) { $ host = parse_url ( $ CFG -> wwwroot , PHP_URL_HOST ) ; if ( $ CFG -> sessioncookiedomain !== $ host ) { if ( substr ( $ CFG -> sessioncookiedomain , 0 , 1 ) === '.' ) { if ( ! preg_match ( '|^.*' . preg_quote ( $ CFG -> sessioncookiedomain , '|' ) . '$|' , $ host ) ) { // Invalid domain - it must be end part of host. $ CFG -> sessioncookiedomain = '' ; } } else { if ( ! preg_match ( '|^.*\.' . preg_quote ( $ CFG -> sessioncookiedomain , '|' ) . '$|' , $ host ) ) { // Invalid domain - it must be end part of host. $ CFG -> sessioncookiedomain = '' ; } } } } // Make sure the cookiepath is valid for this wwwroot or autodetect if not specified. if ( ! isset ( $ CFG -> sessioncookiepath ) ) { $ CFG -> sessioncookiepath = '' ; } if ( $ CFG -> sessioncookiepath !== '/' ) { $ path = parse_url ( $ CFG -> wwwroot , PHP_URL_PATH ) . '/' ; if ( $ CFG -> sessioncookiepath === '' ) { $ CFG -> sessioncookiepath = $ path ; } else { if ( strpos ( $ path , $ CFG -> sessioncookiepath ) !== 0 or substr ( $ CFG -> sessioncookiepath , - 1 ) !== '/' ) { $ CFG -> sessioncookiepath = $ path ; } } } // Discard session ID from POST, GET and globals to tighten security, // this is session fixation prevention. unset ( $ GLOBALS [ $ sessionname ] ) ; unset ( $ _GET [ $ sessionname ] ) ; unset ( $ _POST [ $ sessionname ] ) ; unset ( $ _REQUEST [ $ sessionname ] ) ; // Compatibility hack for non-browser access to our web interface. if ( ! empty ( $ _COOKIE [ $ sessionname ] ) && $ _COOKIE [ $ sessionname ] == "deleted" ) { unset ( $ _COOKIE [ $ sessionname ] ) ; } // Set configuration. session_name ( $ sessionname ) ; session_set_cookie_params ( 0 , $ CFG -> sessioncookiepath , $ CFG -> sessioncookiedomain , $ cookiesecure , $ CFG -> cookiehttponly ) ; ini_set ( 'session.use_trans_sid' , '0' ) ; ini_set ( 'session.use_only_cookies' , '1' ) ; ini_set ( 'session.hash_function' , '0' ) ; // For now MD5 - we do not have room for sha-1 in sessions table. ini_set ( 'session.use_strict_mode' , '0' ) ; // We have custom protection in session init. ini_set ( 'session.serialize_handler' , 'php' ) ; // We can move to 'php_serialize' after we require PHP 5.5.4 form Moodle. // Moodle does normal session timeouts, this is for leftovers only. ini_set ( 'session.gc_probability' , 1 ) ; ini_set ( 'session.gc_divisor' , 1000 ) ; ini_set ( 'session.gc_maxlifetime' , 60 * 60 * 24 * 4 ) ; }
docstring: Make sure all cookie and session related stuff is configured properly before session start.
docstring_tokens: Make sure all cookie and session related stuff is configured properly before session start .