diff --git a/lib/classes/CSRFProtection.php b/lib/classes/CSRFProtection.php index 6bda658a43ea1e50b3d5d740e12bc314d9c51d10..4a995927ef6bf9af3ff7dd3c3c23067e9608bba7 100644 --- a/lib/classes/CSRFProtection.php +++ b/lib/classes/CSRFProtection.php @@ -125,7 +125,7 @@ class CSRFProtection // create a token, if there is none if (!isset($_SESSION[self::TOKEN])) { - $_SESSION[self::TOKEN] = base64_encode(self::randomBytes(32)); + $_SESSION[self::TOKEN] = base64_encode(random_bytes(32)); } return $_SESSION[self::TOKEN]; @@ -149,59 +149,4 @@ class CSRFProtection self::token() ); } - - - /** - * Returns a string of highly randomized bytes (over the full 8-bit range). - * - * This function is better than simply calling mt_rand() or any other - * built-in PHP function because it can return a long string of bytes - * (compared to < 4 bytes normally from mt_rand()) and uses the best - * available pseudo-random source. - * - * This function was copied from Drupal's includes/bootstrap.inc. - * - * @param integer $count The number of characters (bytes) to return in the string. - */ - private static function randomBytes($count) - { - static $random_state, $bytes; - - // Initialize on the first call. The contents of $_SERVER includes a mix of - // user-specific and system information that varies a little with each page. - if (!isset($random_state)) { - $random_state = print_r($_SERVER, TRUE); - if (function_exists('getmypid')) { - // Further initialize with the somewhat random PHP process ID. - $random_state .= getmypid(); - } - $bytes = ''; - } - if (mb_strlen($bytes) < $count) { - // /dev/urandom is available on many *nix systems and is considered the - // best commonly available pseudo-random source. - if ($fh = @fopen('/dev/urandom', 'rb')) { - // PHP only performs buffered reads, so in reality it will always read - // at least 4096 bytes. Thus, it costs nothing extra to read and store - // that much so as to speed any additional invocations. - $bytes .= fread($fh, max(4096, $count)); - fclose($fh); - } - // If /dev/urandom is not available or returns no bytes, this loop will - // generate a good set of pseudo-random bytes on any system. - // Note that it may be important that our $random_state is passed - // through hash() prior to being rolled into $output, that the two hash() - // invocations are different, and that the extra input into the first one - - // the microtime() - is prepended rather than appended. This is to avoid - // directly leaking $random_state via the $output stream, which could - // allow for trivial prediction of further "random" numbers. - while (mb_strlen($bytes) < $count) { - $random_state = hash('sha256', microtime() . mt_rand() . $random_state); - $bytes .= hash('sha256', mt_rand() . $random_state, TRUE); - } - } - $output = mb_substr($bytes, 0, $count); - $bytes = mb_substr($bytes, $count); - return $output; - } }