From bd804b74c46ed6779bf82a506711b48644a197f4 Mon Sep 17 00:00:00 2001 From: Lukas Reschke Date: Sat, 29 Sep 2012 15:03:09 +0200 Subject: [PATCH] mt_rand() is not secure from a security point of view and predictable. Let's use openssl_random_pseudo_bytes() instead. Before: 26 bits entropy After: 72 bits entropy --- lib/util.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/util.php b/lib/util.php index d1227f8379..15e6f2824e 100755 --- a/lib/util.php +++ b/lib/util.php @@ -440,7 +440,9 @@ class OC_Util { */ public static function callRegister() { // generate a random token. - $token=mt_rand(1000,9000).mt_rand(1000,9000).mt_rand(1000,9000); + $bytes = openssl_random_pseudo_bytes(10, $cstrong); + $hex = bin2hex($bytes); + $token = $hex; // store the token together with a timestamp in the session. $_SESSION['requesttoken-'.$token]=time();