mt_rand() is not secure from a security point of view and predictable. Let's use openssl_random_pseudo_bytes() instead.

Before: 26 bits entropy After: 72 bits entropy
2012-09-29 15:03:09 +02:00 · 2012-09-29 15:03:09 +02:00 · bd804b74c4
parent dc66e94ee3
commit bd804b74c4
1 changed files with 3 additions and 1 deletions
--- a/lib/util.php
+++ b/lib/util.php
@ -440,7 +440,9 @@ class OC_Util {
 	 */
 	public static function callRegister() {
 		// generate a random token.
-		$token=mt_rand(1000,9000).mt_rand(1000,9000).mt_rand(1000,9000);
+		$bytes = openssl_random_pseudo_bytes(10, $cstrong);
+		$hex = bin2hex($bytes);
+		$token = $hex;

 		// store the token together with a timestamp in the session.
 		$_SESSION['requesttoken-'.$token]=time();