0.0.17 (#24)

* Add compatibility note to changelog

* updated tested until to 6.8.1

Author: dominic-ks

README.md

@@ -48,6 +48,9 @@ Please report security bugs found in the source code of the bdvs-password-reset
 [Report a security vulnerability.](https://patchstack.com/database/vdp/bdvs-password-reset) 
 
 ## Change Log
+- 0.0.17
+  - switched to a cryptographically secure function to generate reset codes
+  - updated compatibility to 6.8.1
  - 0.0.16
    - updated compatibility to 6.3
    - By default users with the administrator role are no longer able to reset their password using this plugin

bdvs-password-reset.php

@@ -6,7 +6,7 @@
  * Plugin Name: REST API Password Reset with Code
  * Plugin URI: https://www.bedevious.co.uk/
  * Description: Allow users to reset their password using a random 4 digit code via the REST API
- * Version: 0.0.16
+ * Version: 0.0.17
  * Author: Be Devious Web Development
  * Author URI: https://www.bedevious.co.uk/
  * License: GNU GPLv3

inc/functions.php

@@ -18,7 +18,7 @@ function bdpwr_generate_4_digit_code() {
 	*/
 
 	$length = apply_filters( 'bdpwr_code_length', 8 );
-	$selection_string = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!£$%^&*()_+-={}[]@~\#<>?/|\\';
+       $selection_string = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!£$%^&*()_+-={}[]@~\#<>?/|\\';
 
 	/**
 	*
@@ -27,9 +27,16 @@ function bdpwr_generate_4_digit_code() {
 	* @param $string str the string to select a code from
 	*/
 
-	$selection_string = apply_filters( 'bdpwr_selection_string', $selection_string );
+       $selection_string = apply_filters( 'bdpwr_selection_string', $selection_string );
 
-	return substr( str_shuffle( $selection_string ), 0, $length );
+       $max_index = strlen( $selection_string ) - 1;
+       $code      = '';
+       for ( $i = 0; $i < $length; $i++ ) {
+               $index  = random_int( 0, $max_index );
+               $code  .= $selection_string[ $index ];
+       }
+
+       return $code;
 }
 
 

readme.txt

@@ -3,9 +3,9 @@
 Contributors: dominic_ks, wpamitkumar
 Tags: wp-api, password reset
 Requires at least: 4.6
-Tested up to: 6.3
+Tested up to: 6.8.1
 Requires PHP: 5.4
-Stable tag: 0.0.16
+Stable tag: 0.0.17
 License: GNU GPLv3
 License URI: https://www.gnu.org/licenses/gpl-3.0
 
@@ -266,6 +266,9 @@ Please report security bugs found in the source code of the bdvs-password-reset
 
 == Upgrade Notice ==
 
+  = 0.0.17 =
+  * switched to a cryptographically secure function to generate reset codes
+  * updated compatibility to 6.8.1
   = 0.0.16 =
   * updated compatibility to 6.3
   * By default users with the administrator role are no longer able to reset their password using this plugin
@@ -276,6 +279,10 @@ Please report security bugs found in the source code of the bdvs-password-reset
   Security enhancements
 
 == Changelog ==
+  = 0.0.17 =
+  * switched to a cryptographically secure function to generate reset codes
+  * updated compatibility to 6.5
+
   = 0.0.16 =
   * updated compatibility to 6.3
   * By default users with the administrator role are no longer able to reset their password using this plugin