From c8297b4718d46f1d78ec7405cdbeb3b3f937001f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 12 Jul 2016 14:02:26 +0200 Subject: [PATCH] Use phpseclib's Crypt module to generate encryption keys MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- libraries/plugins/auth/AuthenticationCookie.class.php | 4 ++-- setup/lib/index.lib.php | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/libraries/plugins/auth/AuthenticationCookie.class.php b/libraries/plugins/auth/AuthenticationCookie.class.php index 756793f08a..4e6a6e93cd 100644 --- a/libraries/plugins/auth/AuthenticationCookie.class.php +++ b/libraries/plugins/auth/AuthenticationCookie.class.php @@ -600,8 +600,8 @@ class AuthenticationCookie extends AuthenticationPlugin { if (empty($GLOBALS['cfg']['blowfish_secret'])) { if (empty($_SESSION['auto_blowfish_secret'])) { - // this returns 23 characters - $_SESSION['auto_blowfish_secret'] = uniqid('', true); + // this returns 32 characters + $_SESSION['auto_blowfish_secret'] = crypt_random_string(32); } return $_SESSION['auto_blowfish_secret']; } else { diff --git a/setup/lib/index.lib.php b/setup/lib/index.lib.php index e25fdb0834..ed2665f5a2 100644 --- a/setup/lib/index.lib.php +++ b/setup/lib/index.lib.php @@ -330,7 +330,7 @@ function perform_config_checks() $server_name = htmlspecialchars($server_name); if ($cookie_auth_server && $blowfish_secret === null) { - $blowfish_secret = uniqid('', true); + $blowfish_secret = bin2hex(crypt_random_string(16)); $blowfish_secret_set = true; $cf->set('blowfish_secret', $blowfish_secret); }