From 6ac7d7c80b366033d36de6e0d84ee2b872b8b9a7 Mon Sep 17 00:00:00 2001
From: Benjamin Peterson <benjamin@python.org>
Date: Sat, 6 Sep 2008 19:28:11 +0000
Subject: [PATCH] #1638033: add support for httponly on Cookie.Morsel

Reviewer: Benjamin
---
 Doc/library/cookie.rst | 10 +++++++++-
 Lib/Cookie.py          |  6 ++++++
 Misc/ACKS              |  1 +
 Misc/NEWS              |  2 ++
 4 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/Doc/library/cookie.rst b/Doc/library/cookie.rst
index 346da5a1fd9..b6a85f5dffd 100644
--- a/Doc/library/cookie.rst
+++ b/Doc/library/cookie.rst
@@ -148,7 +148,7 @@ Morsel Objects
 --------------
 
 
-.. class:: Morsel()
+.. class:: Morsel
 
    Abstract a key/value pair, which has some :rfc:`2109` attributes.
 
@@ -162,9 +162,17 @@ Morsel Objects
    * ``max-age``
    * ``secure``
    * ``version``
+   * ``httponly``
+
+   The attribute :attr:`httponly` specifies that the cookie is only transfered
+   in HTTP requests, and is not accessible through JavaScript. This is intended
+   to mitigate some forms of cross-site scripting.
 
    The keys are case-insensitive.
 
+   .. versionadded:: 2.6
+      The :attr:`httponly` attribute was added.
+
 
 .. attribute:: Morsel.value
 
diff --git a/Lib/Cookie.py b/Lib/Cookie.py
index e1eb7348bc6..b2f7427aa94 100644
--- a/Lib/Cookie.py
+++ b/Lib/Cookie.py
@@ -408,6 +408,9 @@ class Morsel(dict):
     # For historical reasons, these attributes are also reserved:
     #   expires
     #
+    # This is an extension from Microsoft:
+    #   httponly
+    #
     # This dictionary provides a mapping from the lowercase
     # variant on the left to the appropriate traditional
     # formatting on the right.
@@ -417,6 +420,7 @@ class Morsel(dict):
                    "domain"      : "Domain",
                    "max-age" : "Max-Age",
                    "secure"      : "secure",
+                   "httponly"  : "httponly",
                    "version" : "Version",
                    }
 
@@ -499,6 +503,8 @@ class Morsel(dict):
                 RA("%s=%d" % (self._reserved[K], V))
             elif K == "secure":
                 RA(str(self._reserved[K]))
+            elif K == "httponly":
+                RA(str(self._reserved[K]))
             else:
                 RA("%s=%s" % (self._reserved[K], V))
 
diff --git a/Misc/ACKS b/Misc/ACKS
index d231ece6a41..ac8f6edd434 100644
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -122,6 +122,7 @@ Nicolas Chauvat
 Michael Chermside
 Albert Chin-A-Young
 Adal Chiriliuc
+Matt Chisholm
 Tom Christiansen
 Vadim Chugunov
 David Cinege
diff --git a/Misc/NEWS b/Misc/NEWS
index d06bfebd1db..85adaeb06e3 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -56,6 +56,8 @@ C-API
 Library
 -------
 
+- Issue #1638033: Cookie.Morsel gained the httponly attribute.
+
 - Issue #3535: zipfile couldn't read some zip files larger than 2GB.
 
 - Issue #3776: Deprecate the bsddb package for removal in 3.0.