gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use phpseclib's Crypt::Random to generate CSRF token

Browse Source 
Signed-off-by: Michal Čihař <michal@cihar.com>
This commit is contained in:
Michal Čihař 2016-01-18 09:42:59 +01:00
parent dbb267308d
commit f20970d32c
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libraries/session.inc.php
View File

@ -13,6 +13,8 @@ if (! defined('PHPMYADMIN')) {
exit;
}
require PHPSECLIB_INC_DIR . '/Crypt/Random.php';
// verify if PHP supports session, die if it does not
if (!@function_exists('session_name')) {
@ -111,7 +113,7 @@ if (! isset($_COOKIE[$session_name])) {
* (we use "space PMA_token space" to prevent overwriting)
*/
if (! isset($_SESSION[' PMA_token '])) {
$_SESSION[' PMA_token '] = md5(uniqid(rand(), true));
$_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16));
}
/**
@ -130,5 +132,5 @@ function PMA_secureSession()
) {
session_regenerate_id(true);
}
$_SESSION[' PMA_token '] = md5(uniqid(rand(), true));
$_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16));
}