gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improve secret generation

Browse Source 
Strip highest bit so that we can use more generated bytes in the ASCII
password.

See #13308

Signed-off-by: Michal Čihař <michal@cihar.com>
This commit is contained in:
Michal Čihař 2017-06-01 14:12:14 +02:00
parent a07ee72499
commit 6b18dfa588
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libraries/config/ServerConfigChecks.php
View File

@ -223,10 +223,12 @@ class ServerConfigChecks
$random_func = 'openssl_random_pseudo_bytes';
}
while (strlen($blowfishSecret) < 32) {
$byte = $random_func(1);
// Get random byte and strip highest bit
// to get ASCII only range
$byte = ord($random_func(1)) & 0x7f;
// We want only ASCII chars
if (ord($byte) > 32 && ord($byte) < 127) {
$blowfishSecret .= $byte;
if ($byte > 32) {
$blowfishSecret .= chr($byte);
}
}