gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improve Blowfish secret generation in setup script

Browse Source 
Now generates secret containing all printable ASCII chars, making it way
more random than with hex encoded random string.

Signed-off-by: Michal Čihař <michal@cihar.com>
This commit is contained in:
Michal Čihař 2016-07-22 10:19:31 +02:00
parent f07fd90ee9
commit 2b7be93829
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libraries/config/ServerConfigChecks.php
View File

@ -214,10 +214,18 @@ class ServerConfigChecks
$blowfishSecret, $cookieAuthServer, $blowfishSecretSet
) {
if ($cookieAuthServer && $blowfishSecret === null) {
$blowfishSecret = '';
if (! function_exists('openssl_random_pseudo_bytes')) {
$blowfishSecret = bin2hex(phpseclib\Crypt\Random::string(32));
$random_func = 'phpseclib\\Crypt\\Random::string';
} else {
$blowfishSecret = bin2hex(openssl_random_pseudo_bytes(32));
$random_func = 'openssl_random_pseudo_bytes';
}
while (strlen($blowfishSecret) < 32) {
$byte = $random_func(1);
// We want only ASCII chars
if (ord($byte) > 32 && ord($byte) < 127) {
$blowfishSecret .= $byte;
}
}
$blowfishSecretSet = true;