Security: Set ch_sid cookie to 'secure' when using HTTPS - refs BT#21289

main/inc/lib/chamilo_session.class.php

@@ -86,6 +86,9 @@ class ChamiloSession extends System\Session
         //ini_set('session.cookie_secure', 1);
         //session ID in the cookie is only readable by the server
         ini_set('session.cookie_httponly', 1);
+        if (api_is_https()) {
+            ini_set('session.cookie_secure', 1);
+        }
 
         if (api_get_configuration_value('security_session_cookie_samesite_none')) {
             if (PHP_VERSION_ID < 70300) {
@@ -93,7 +96,6 @@ class ChamiloSession extends System\Session
                 session_set_cookie_params($sessionCookieParams['lifetime'], '/; samesite=None',
                 $sessionCookieParams['domain'], true, $sessionCookieParams['httponly']);
             } else {
-                ini_set('session.cookie_secure', 1);
                 ini_set('session.cookie_samesite', 'None');
             }
         }