gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use Util::generateRandom for generating CSRF token

Browse Source 
- We reuse existing code for that.
- The token string is now shorter as it can contain any ASCII char,
  compared to hex digits previously.

Signed-off-by: Michal Čihař <michal@cihar.com>
This commit is contained in:
Michal Čihař 2017-06-01 14:38:56 +02:00
parent 71c3f9f7c1
commit 073a26b0da
1 changed files with 3 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libraries/session.lib.php
View File

@ -5,6 +5,7 @@
*
* @package PhpMyAdmin
*/
use PMA\libraries\Util;
/**
* tries to secure session from hijacking and fixation
@ -30,14 +31,10 @@ function PMA_secureSession()
*/
function PMA_generateToken()
{
if (class_exists('phpseclib\Crypt\Random')) {
$_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16));
} else {
$_SESSION[' PMA_token '] = bin2hex(openssl_random_pseudo_bytes(16));
}
$_SESSION[' PMA_token '] = Util::generateRandom(16);
/**
* Check if token is properly generated (the genration can fail, for example
* Check if token is properly generated (the generation can fail, for example
* due to missing /dev/random for openssl).
*/
if (empty($_SESSION[' PMA_token '])) {