Skip to content

Commit dec1e2f

Browse files
authored
replaced mt_rand method with more secure random_int
as mentioned in #66 and suggestion here http://php.net/mt_rand, changed random generator method to a more cryptographically secure random generator.
1 parent e5022ca commit dec1e2f

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

libs/csrf/csrfprotector.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -352,11 +352,11 @@ public static function generateAuthToken()
352352
//#todo - if $length > 128 throw exception
353353

354354
if (function_exists("hash_algos") && in_array("sha512", hash_algos())) {
355-
$token = hash("sha512", mt_rand(0, mt_getrandmax()));
355+
$token = hash("sha512", random_int(0, mt_getrandmax()));
356356
} else {
357357
$token = '';
358358
for ($i = 0; $i < 128; ++$i) {
359-
$r = mt_rand(0, 35);
359+
$r = random_int(0, 35);
360360
if ($r < 26) {
361361
$c = chr(ord('a') + $r);
362362
} else {

0 commit comments

Comments
 (0)