Language: PHP
Label: vulnerable
CWE: CWE-614 \u2014 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.

Code:
    public function saveStatisticDecision() {
        if (!$this->isApiRequest()) {
            throw new MethodNotAllowedException();
        }

        /** @var SystemsettingsTable $SystemsettingsTable */
        $SystemsettingsTable = TableRegistry::getTableLocator()->get('Systemsettings');

        try {
            $record = $SystemsettingsTable->getSystemsettingByKey('SYSTEM.ANONYMOUS_STATISTICS');
        } catch (RecordNotFoundException $e) {
            if (empty($record)) {
                throw new \RuntimeException('Systemsetting is missing - did you executed openitcockpit-update?');
            }
        }


        if ($this->request->getData('statistics.decision', null) === null) {
            throw new \RuntimeException('Wrong POST request');
        }


        $record->set('value', (int)$this->request->getData('statistics.decision', 0));

        if ($this->request->getData('statistics.cookie', null) !== null && $record->get('value') === 2) {
            $this->response = $this->response->withCookie(new Cookie(
                'askAgainForHelp',
                'Remind me later',
                new \DateTime('+16 hours'),
                '/'
            ));
        }

        $SystemsettingsTable->save($record);
        if ($record->hasErrors()) {
            $this->set('success', false);
            $this->set('message', __('Error while saving data'));
            $this->viewBuilder()->setOption('serialize', ['success', 'message']);
            return;
        }
        $this->set('success', true);
        $this->set('message', __('Record successfully saved'));
        $this->viewBuilder()->setOption('serialize', ['success', 'message']);
    }