Update random_string with random_bytes

- Updated update.php

diff --git a/include/text.php b/include/text.php
index 616c4adb86b7c35b0363f0592f80e4661a2a9f6a..f49ccc8abcbb8116fc63b10c55d0ef551e68c895 100644 (file)
--- a/include/text.php
+++ b/include/text.php
@@ -41,18 +41,28 @@ function replace_macros($s, $r) {
        return $output;
 }
 
+// PHP < 7 polyfill
+if (!is_callable('intdiv')) {
+       function intdiv($a, $b) {
+               return ($a - $a % $b) / $b;
+       }
+}
 
-// random string, there are 86 characters max in text mode, 128 for hex
-// output is urlsafe
+/**
+ * @brief Generates a pseudo-random string of hexadecimal characters
+ *
+ * Only supports pair numbers of output characters.
+ *
+ * @param int $size
+ * @return string
+ */
+function random_string($size = 64)
+{
+       $bytes = random_bytes(intdiv((int) $size, 2));
 
-define('RANDOM_STRING_HEX',  0x00);
-define('RANDOM_STRING_TEXT', 0x01);
+       $return = bin2hex($bytes);
 
-function random_string($size = 64, $type = RANDOM_STRING_HEX) {
-       // generate a bit of entropy and run it through the whirlpool
-       $s = hash('whirlpool', (string) rand() . uniqid(rand(),true) . (string) rand(), (($type == RANDOM_STRING_TEXT) ? true : false));
-       $s = (($type == RANDOM_STRING_TEXT) ? str_replace("\n", "", base64url_encode($s,true)) : $s);
-       return substr($s,0,$size);
+       return $return;
 }
 
 /**
@@ -1147,7 +1157,7 @@ function get_mood_verbs() {
 
 /**
  * @brief Translate days and months names.
- * 
+ *
  * @param string $s String with day or month name.
  * @return string Translated string.
  */
@@ -1165,7 +1175,7 @@ function day_translate($s) {
 
 /**
  * @brief Translate short days and months names.
- * 
+ *
  * @param string $s String with short day or month name.
  * @return string Translated string.
  */

diff --git a/update.php b/update.php
index 5cf9bbc2d4e437719680e454092ab31f1bca6f26..21074c1d8778c73b343b5bf30f229a48388b59fe 100644 (file)
--- a/update.php
+++ b/update.php
@@ -616,7 +616,7 @@ function update_1075() {
                foreach ($r as $rr) {
                        $found = true;
                        do {
-                               $guid = substr(random_string(),0,16);
+                               $guid = random_string(16);
                                $x = q("SELECT `uid` FROM `user` WHERE `guid` = '%s' LIMIT 1",
                                        dbesc($guid)
                                );