<NME> bootstrap.php
<BEF> <?php

namespace Bolt;

use Bolt\Configuration\Composer;
use Bolt\Configuration\Standard;
use Bolt\Exception\BootException;

/**
 * Second stage loader. Do bootstrapping within a new local scope to avoid
 * polluting the global space.
 *
 * Here we bootstrap the app:
 * - Initialize mb functions for UTF-8
 * - Figure out root path
 * - Bring in the autoloader
 * - Call Bolt\Bootstrap to create the application
 *
 * @throws BootException
 *
 * @return \Silex\Application
 */
return call_user_func(function () {
    // Resolve Bolt-root
    $boltRootPath = realpath(__DIR__ . '/..');

    // Look for the autoloader in known positions relative to the Bolt-root,
    // and autodetect an appropriate configuration class based on this
    // information. (autoload.php path maps to a configuration class)
    $autodetectionMappings = [
        $boltRootPath . '/vendor/autoload.php' => [Standard::class, $boltRootPath],
        $boltRootPath . '/../../autoload.php'  => [Composer::class, $boltRootPath . '/../../..'],
    ];

    foreach ($autodetectionMappings as $autoloadPath => list($resourcesClass, $rootPath)) {
        if (!file_exists($autoloadPath)) {
            continue;
        }

        require_once $autoloadPath;

        /** @deprecated Can be removed when support for PHP 5.5 is dropped. */
        // Use UTF-8 for all multi-byte functions

$app->register(new Silex\Provider\SessionServiceProvider(), array(
    'session.storage.options' => array(
        'name' => 'bolt_session'
    )
));
$app->register(new Bolt\ConfigServiceProvider());
});

<MSG> Set all session cookies HTTPONLY

<DFF> @@ -44,7 +44,8 @@ $app = new Bolt\Application();
 
 $app->register(new Silex\Provider\SessionServiceProvider(), array(
     'session.storage.options' => array(
-        'name' => 'bolt_session'
+        'name' => 'bolt_session',
+		'cookie_httponly' => true
     )
 ));
 $app->register(new Bolt\ConfigServiceProvider());

{'commit': "diff --git a/app/bootstrap.php b/app/bootstrap.php\nindex e104e2a7d..f3981dbfe 100644\n--- a/app/bootstrap.php\n+++ b/app/bootstrap.php\n@@ -44,7 +44,8 @@ $app = new Bolt\\Application();\n \n $app->register(new Silex\\Provider\\SessionServiceProvider(), array(\n     'session.storage.options' => array(\n-        'name' => 'bolt_session'\n+        'name' => 'bolt_session',\n+\t\t'cookie_httponly' => true\n     )\n ));\n $app->register(new Bolt\\ConfigServiceProvider());\ndiff --git a/app/src/Bolt/Users.php b/app/src/Bolt/Users.php\nindex 24508224f..5bfdfa51b 100644\n--- a/app/src/Bolt/Users.php\n+++ b/app/src/Bolt/Users.php\n@@ -269,8 +269,10 @@ class Users\n             $token['token'],\n             time() + $this->app['config']->get('general/cookies_lifetime'),\n             '/',\n-            $this->app['config']->get('general/cookies_domain')\n-        );\n+            $this->app['config']->get('general/cookies_domain'),\n+            false,\n+            true\n+\t\t);\n \n         try {\n             // Check if there's already a token stored for this name / IP combo.\n@@ -486,7 +488,15 @@ class Users\n \n         } else {\n             // Delete the authtoken cookie..\n-            setcookie('bolt_authtoken', '', time() -1 , '/', $this->app['config']->get('general/cookies_domain'));\n+            setcookie(\n+                'bolt_authtoken',\n+                '',\n+                time() -1 ,\n+                '/',\n+                $this->app['config']->get('general/cookies_domain'),\n+                false,\n+                true\n+\t\t\t);\n \n             return false;\n \n@@ -642,7 +652,15 @@ class Users\n         $this->db->delete($this->authtokentable, array('username' => $this->currentuser['username']));\n \n         // Remove the cookie..\n-        setcookie('bolt_authtoken', '', time() -1 , '/', $this->app['config']->get('general/cookies_domain'));\n+        setcookie(\n+            'bolt_authtoken',\n+            '',\n+            time() -1 ,\n+            '/',\n+            $this->app['config']->get('general/cookies_domain'),\n+            false,\n+            true\n+\t\t);\n \n         // This is commented out for now: shouldn't be necessary, and it also removes the flash notice.\n         // $this->session->invalidate();\n", 'commit_subject': 'Set all session cookies HTTPONLY', 'repo_name': 'bolt/bolt', 'committer': {'name': 'Tobias Dammers', 'email': '6d29b24ae9e81c78352bc731cf38b3fa8f505e9a@gmail.com', 'time_sec': '1379946584', 'tz_offset': '120', 'date': {'seconds': '1379946584'}}, 'commit_tree': 'bd8675d5b08015fdc656275635fb729e9a5d1ebe', 'commit_message': 'Set all session cookies HTTPONLY\n', 'language_name': 'PHP', 'license': 'mit', 'hunks': "@@ -44,7 +44,8 @@ $app = new Bolt\\Application();\n \n $app->register(new Silex\\Provider\\SessionServiceProvider(), array(\n     'session.storage.options' => array(\n-        'name' => 'bolt_session'\n+        'name' => 'bolt_session',\n+\t\t'cookie_httponly' => true\n     )\n ));\n $app->register(new Bolt\\ConfigServiceProvider());\n", 'addition_count': 2, 'deletion_count': 1, 'src_file': 'a/app/bootstrap.php', 'tgt_file': 'b/app/bootstrap.php', 'file_extension': '.php', 'before_file': "<?php\n\nnamespace Bolt;\n\nuse Bolt\\Configuration\\Composer;\nuse Bolt\\Configuration\\Standard;\nuse Bolt\\Exception\\BootException;\n\n/**\n * Second stage loader. Do bootstrapping within a new local scope to avoid\n * polluting the global space.\n *\n * Here we bootstrap the app:\n * - Initialize mb functions for UTF-8\n * - Figure out root path\n * - Bring in the autoloader\n * - Call Bolt\\Bootstrap to create the application\n *\n * @throws BootException\n *\n * @return \\Silex\\Application\n */\nreturn call_user_func(function () {\n    // Resolve Bolt-root\n    $boltRootPath = realpath(__DIR__ . '/..');\n\n    // Look for the autoloader in known positions relative to the Bolt-root,\n    // and autodetect an appropriate configuration class based on this\n    // information. (autoload.php path maps to a configuration class)\n    $autodetectionMappings = [\n        $boltRootPath . '/vendor/autoload.php' => [Standard::class, $boltRootPath],\n        $boltRootPath . '/../../autoload.php'  => [Composer::class, $boltRootPath . '/../../..'],\n    ];\n\n    foreach ($autodetectionMappings as $autoloadPath => list($resourcesClass, $rootPath)) {\n        if (!file_exists($autoloadPath)) {\n            continue;\n        }\n\n        require_once $autoloadPath;\n\n        /** @deprecated Can be removed when support for PHP 5.5 is dropped. */\n        // Use UTF-8 for all multi-byte functions\n\n$app->register(new Silex\\Provider\\SessionServiceProvider(), array(\n    'session.storage.options' => array(\n        'name' => 'bolt_session'\n    )\n));\n$app->register(new Bolt\\ConfigServiceProvider());\n});\n", 'message': 'Set all session cookies HTTPONLY\n', 'author_name': 'Tobias Dammers', 'lang': 'php'}