From e433d8189bb9cf00a17602cf183334bbf8684fc9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Thu, 12 Jun 2014 14:18:37 +0200 Subject: [PATCH] Use phpseclib for generating session encryption key MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- libraries/plugins/auth/AuthenticationCookie.class.php | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/libraries/plugins/auth/AuthenticationCookie.class.php b/libraries/plugins/auth/AuthenticationCookie.class.php index 31bee4bb1e..a0fdff7495 100644 --- a/libraries/plugins/auth/AuthenticationCookie.class.php +++ b/libraries/plugins/auth/AuthenticationCookie.class.php @@ -688,11 +688,10 @@ class AuthenticationCookie extends AuthenticationPlugin */ private function _getSessionEncryptionSecret() { - if (empty($_SESSION['auto_blowfish_secret'])) { - // this returns 23 characters - $_SESSION['auto_blowfish_secret'] = uniqid('', true); + if (empty($_SESSION['encryption_key'])) { + $_SESSION['encryption_key'] = crypt_random_string(256); } - return $_SESSION['auto_blowfish_secret']; + return $_SESSION['encryption_key']; } /**