limit cookie path to baseurl by default

diff --git a/app/Session.php b/app/Session.php
index f2a5dbd58ac52de334d1f1eb3f95b921cc93244c..af1b8e74e4c06afd9e56b72f315670579014a516 100644 (file)
--- a/app/Session.php
+++ b/app/Session.php
@@ -8,7 +8,8 @@ use http\Params;
 
 class Session implements ArrayAccess
 {
-       function __construct(Config $config, Response $response) {
+       function __construct(Config $config, BaseUrl $baseUrl, Response $response) {
+               ini_set("session.cookie_path", $baseUrl->path);
                foreach ($config->session as $key => $val) {
                        ini_set("session.$key", $val);
                }