From 6009d96faf55645c42ac99aee87693df0196a8f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=B4me=20Chilliet?= <come@opensides.be>
Date: Mon, 2 Jul 2018 09:42:57 +0200
Subject: [PATCH] Merge branch
'5843-security-insecure-generation-of-random-tokens' into '1.3-dev'
Resolve "Security: Insecure Generation of Random Tokens"
See merge request fusiondirectory/fd!319
(cherry picked from commit 6d0aba68e15c6e7e58b418b8dfbd03c309837e5a)
a8f4d2eb :ambulance: fix(core) Fix 2 problems in random_int fallback
---
include/functions.inc | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/functions.inc b/include/functions.inc
index a130496ab..af35d642b 100644
--- a/include/functions.inc
+++ b/include/functions.inc
@@ -2648,7 +2648,7 @@ if (!function_exists('random_int')) {
{
$range = $max - $min;
if ($range <= 0) {
- return $min;
+ throw new Exception('Invalid range passed to random_int');
}
$log = log($range, 2);
@@ -2663,7 +2663,7 @@ if (!function_exists('random_int')) {
if (!$strong || ($randomBytes === FALSE)) {
throw new Exception('Failed to get random bytes');
}
- $rnd = unpack('C', $randomBytes)[1];
+ $rnd = unpack('Q', $randomBytes)[1];
// discard irrelevant bits
$rnd = $rnd & $filter;
} while ($rnd >= $range);
--
GitLab