Merge branch '6217-security-set-cookie-settings-to-true-for-option-httponly' into '1.3-fixes'

include/class_session.inc

@@ -151,6 +151,13 @@ class session {
        !! The garbage collector is a cron job on debian systems, the cronjob will fetch the timeout from
        the php.ini, so if you use debian, you must hardcode session.gc_maxlifetime in your php.ini */
     ini_set("session.gc_maxlifetime", 24 * 60 * 60);
+
+    /*
+     *  Set HttpOnly in order to enhance security by disabling execution of javascript on cookies,
+     *  allowing possible XSS attacks
+     */
+    ini_set("session.cookie_httponly", "1");
+
     if ($id !== NULL) {
       session_id($id);
     }