From 073a26b0da4cfcf7f7fa9b80ac10e1970bcfe3d6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 1 Jun 2017 14:38:56 +0200 Subject: [PATCH] Use Util::generateRandom for generating CSRF token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - We reuse existing code for that. - The token string is now shorter as it can contain any ASCII char, compared to hex digits previously. Signed-off-by: Michal Čihař --- libraries/session.lib.php | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/libraries/session.lib.php b/libraries/session.lib.php index 5b0404b99a..7bb27f81af 100644 --- a/libraries/session.lib.php +++ b/libraries/session.lib.php @@ -5,6 +5,7 @@ * * @package PhpMyAdmin */ +use PMA\libraries\Util; /** * tries to secure session from hijacking and fixation @@ -30,14 +31,10 @@ function PMA_secureSession() */ function PMA_generateToken() { - if (class_exists('phpseclib\Crypt\Random')) { - $_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16)); - } else { - $_SESSION[' PMA_token '] = bin2hex(openssl_random_pseudo_bytes(16)); - } + $_SESSION[' PMA_token '] = Util::generateRandom(16); /** - * Check if token is properly generated (the genration can fail, for example + * Check if token is properly generated (the generation can fail, for example * due to missing /dev/random for openssl). */ if (empty($_SESSION[' PMA_token '])) {