From 6b18dfa588d0fce3598970ea4b0a339afe9db2f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Thu, 1 Jun 2017 14:12:14 +0200
Subject: [PATCH] Improve secret generation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Strip highest bit so that we can use more generated bytes in the ASCII
password.

See #13308

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 libraries/config/ServerConfigChecks.php | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/libraries/config/ServerConfigChecks.php b/libraries/config/ServerConfigChecks.php
index d97d702a18..5557a0f489 100644
--- a/libraries/config/ServerConfigChecks.php
+++ b/libraries/config/ServerConfigChecks.php
@@ -223,10 +223,12 @@ class ServerConfigChecks
                 $random_func = 'openssl_random_pseudo_bytes';
             }
             while (strlen($blowfishSecret) < 32) {
-                $byte = $random_func(1);
+                // Get random byte and strip highest bit
+                // to get ASCII only range
+                $byte = ord($random_func(1)) & 0x7f;
                 // We want only ASCII chars
-                if (ord($byte) > 32 && ord($byte) < 127) {
-                    $blowfishSecret .= $byte;
+                if ($byte > 32) {
+                    $blowfishSecret .= chr($byte);
                 }
             }