From 2b7be93829c38ccee7e05e769e4878280dc30ed6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Fri, 22 Jul 2016 10:19:31 +0200
Subject: [PATCH] Improve Blowfish secret generation in setup script
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now generates secret containing all printable ASCII chars, making it way
more random than with hex encoded random string.

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 libraries/config/ServerConfigChecks.php | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/libraries/config/ServerConfigChecks.php b/libraries/config/ServerConfigChecks.php
index ca42a5e37d..495f7bff15 100644
--- a/libraries/config/ServerConfigChecks.php
+++ b/libraries/config/ServerConfigChecks.php
@@ -214,10 +214,18 @@ class ServerConfigChecks
         $blowfishSecret, $cookieAuthServer, $blowfishSecretSet
     ) {
         if ($cookieAuthServer && $blowfishSecret === null) {
+            $blowfishSecret = '';
             if (! function_exists('openssl_random_pseudo_bytes')) {
-                $blowfishSecret = bin2hex(phpseclib\Crypt\Random::string(32));
+                $random_func = 'phpseclib\\Crypt\\Random::string';
             } else {
-                $blowfishSecret = bin2hex(openssl_random_pseudo_bytes(32));
+                $random_func = 'openssl_random_pseudo_bytes';
+            }
+            while (strlen($blowfishSecret) < 32) {
+                $byte = $random_func(1);
+                // We want only ASCII chars
+                if (ord($byte) > 32 && ord($byte) < 127) {
+                    $blowfishSecret .= $byte;
+                }
             }
 
             $blowfishSecretSet = true;