From f20970d32c3dfdf82aef7b6c244da1f769043813 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 18 Jan 2016 09:42:59 +0100 Subject: [PATCH] Use phpseclib's Crypt::Random to generate CSRF token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- libraries/session.inc.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libraries/session.inc.php b/libraries/session.inc.php index fcd4507094..4413c968f4 100644 --- a/libraries/session.inc.php +++ b/libraries/session.inc.php @@ -13,6 +13,8 @@ if (! defined('PHPMYADMIN')) { exit; } +require PHPSECLIB_INC_DIR . '/Crypt/Random.php'; + // verify if PHP supports session, die if it does not if (!@function_exists('session_name')) { @@ -111,7 +113,7 @@ if (! isset($_COOKIE[$session_name])) { * (we use "space PMA_token space" to prevent overwriting) */ if (! isset($_SESSION[' PMA_token '])) { - $_SESSION[' PMA_token '] = md5(uniqid(rand(), true)); + $_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16)); } /** @@ -130,5 +132,5 @@ function PMA_secureSession() ) { session_regenerate_id(true); } - $_SESSION[' PMA_token '] = md5(uniqid(rand(), true)); + $_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16)); }