From a806525af1afcb19808ad45337c76f8e9a8c9712 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Roland=20H=C3=A4der?= Date: Sun, 9 Nov 2008 16:03:20 +0000 Subject: [PATCH] Better RNG choosen (mt_rand()), writing initial secret file fixed, thanks to profi-concept --- inc/databases.php | 2 +- inc/functions.php | 2 +- inc/gen_sql_patches.php | 51 ++++++++++++++++++++++++----------------- inc/rdf.class.php | 2 +- 4 files changed, 33 insertions(+), 24 deletions(-) diff --git a/inc/databases.php b/inc/databases.php index bcb6658e5e..dd23915a94 100644 --- a/inc/databases.php +++ b/inc/databases.php @@ -114,7 +114,7 @@ define('USAGE_BASE', "usage"); define('SERVER_URL', "http://www.mxchange.org"); // This current patch level -define('CURR_SVN_REVISION', "527"); +define('CURR_SVN_REVISION', "528"); // Take a prime number which is long (if you know a longer one please try it out!) define('_PRIME', 591623); diff --git a/inc/functions.php b/inc/functions.php index 6472c60448..df47862705 100644 --- a/inc/functions.php +++ b/inc/functions.php @@ -2002,7 +2002,7 @@ function generateHash ($plainText, $salt = "") { $keys = SITE_KEY.":".DATE_KEY.":".$_CONFIG['secret_key'].":".$_CONFIG['file_hash'].":".date("d-m-Y (l-F-T)", bigintval($_CONFIG['patch_ctime'])).":".$_CONFIG['master_salt']; // Additional data - $data = $plainText.":".uniqid(rand(), true).":".time(); + $data = $plainText.":".uniqid(mt_rand(), true).":".time(); // Calculate number for generating the code $a = time() + _ADD - 1; diff --git a/inc/gen_sql_patches.php b/inc/gen_sql_patches.php index 8c54d294aa..f4251010df 100644 --- a/inc/gen_sql_patches.php +++ b/inc/gen_sql_patches.php @@ -32,13 +32,13 @@ ************************************************************************/ // Some security stuff... -if (!defined('__SECURITY')) { +if (ereg(basename(__FILE__), $_SERVER['PHP_SELF'])) { $INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4) . "/security.php"; require($INC); } // Check for version of sql_patches -if (EXT_VERSION_IS_OLDER("sql_patches", "0.3.6")) return false; +if (GET_EXT_VERSION("sql_patches") < "0.3.6") return false; // Check if there is no scrambling string if (empty($_CONFIG['pass_scramble'])) { @@ -46,31 +46,33 @@ if (empty($_CONFIG['pass_scramble'])) { $scrambleString = genScrambleString(40); // ... and store it there for future usage - UPDATE_CONFIG("pass_scramble", $scrambleString); + $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_config SET pass_scramble='%s' WHERE config=0 LIMIT 1", + array($scrambleString), __FILE__, __LINE__); // Also remember it in config $_CONFIG['pass_scramble'] = $scrambleString; unset($scrambleString); -} +} // END - if // Check if there is no master salt string if (empty($_CONFIG['master_salt'])) { // Generate the master salt which is the first chars minus 40 chars of this random hash // We do an extra scrambling here... - $masterSalt = scrambleString(substr(generateHash(GEN_PASS(rand(128, 256))), 0, -40)); + $masterSalt = scrambleString(substr(generateHash(GEN_PASS(mt_rand(128, 256))), 0, -40)); // ... and store it there for future usage - UPDATE_CONFIG("master_salt", $masterSalt); + $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_config SET master_salt='%s' WHERE config=0 LIMIT 1", + array($masterSalt), __FILE__, __LINE__); // Also remember it in config $_CONFIG['master_salt'] = $masterSalt; unset($masterSalt); -} +} // END - if if (empty($_CONFIG['file_hash'])) { // Create filename from hashed random string - $file_hash = generateHash(GEN_PASS(rand(128, 256))); - $file = sprintf("%sinc/.secret/.%s", PATH, $file_hash); + $file_hash = generateHash(sha1(GEN_PASS(mt_rand(128, 256)))); + $file = PATH."inc/.secret/.".$file_hash; // File hash was never created $fp = @fopen($file, 'w') or mxchange_die("Cannot write secret key file!"); @@ -79,7 +81,7 @@ if (empty($_CONFIG['file_hash'])) { // 1. Count of chars to be taken from back of the string $nums = mt_rand(40, 45); // 2. Generate secret key from a randomized string - $secretKey = substr(generateHash(GEN_PASS(rand(128, 256))), -$nums); + $secretKey = substr(generateHash(GEN_PASS(mt_rand(128, 256))), -$nums); // 3. Write the key to the file fwrite($fp, $secretKey); // 4. Close file @@ -91,20 +93,27 @@ if (empty($_CONFIG['file_hash'])) { //* DEBUG: */ unlink($file); //* DEBUG: */ $test = hexdec(get_session('u_hash')) / hexdec($secretKey); //* DEBUG: */ $test = generateHash(str_replace('.', "", $test)); - //* DEBUG: */ die("Secret-Key: ".$secretKey."
Cookie: ".get_session('u_hash')."
Test: ".$test); + //* DEBUG: */ die("Secret-Key: ".$secretKey."
Cookie: ".get_session('u_hash')."
Test: ".$test); // Write $file_hash to database - UPDATE_CONFIG("file_hash", $file_hash); + $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_config SET file_hash='%s' WHERE config=0 LIMIT 1", + array($file_hash), __FILE__, __LINE__); - // Also update configuration - $_CONFIG['secret_key'] = $secretKey; - $_CONFIG['file_hash'] = $file_hash; + // Also create .htaccess file + $fp = @fopen(PATH."inc/.secret/.htaccess", 'w') or mxchange_die("Cannot write to .htaccess file!"); + if ($fp != false) { + // Add deny line to file + fwrite($fp, "Deny from all"); - // And remove some variables - unset($secretKey); - unset($file_hash); - } -} + // Close the file + fclose($fp); + } // END - if + + // Also update configuration + $_CONFIG['secret_key'] = $secretKey; unset($secretKey); + $_CONFIG['file_hash'] = $file_hash; unset($file_hash); + } // END - if +} // END - if // -?> +?> \ No newline at end of file diff --git a/inc/rdf.class.php b/inc/rdf.class.php index d42bdbff8d..477925a21e 100644 --- a/inc/rdf.class.php +++ b/inc/rdf.class.php @@ -1200,7 +1200,7 @@ class fase4_rdf { function _garbage_collection() { srand((double) microtime() * 1000000); - if (rand(1, 100) <= $this->gc_probability) { + if (mt_rand(1, 100) <= $this->gc_probability) { $dir = dir($this->_cache_dir); while($file=$dir->read()) { if (is_file($dir->path.$file) && substr($file, -6, 6) != ".cache" && substr($file, -4, 4) != ".log" && filemtime($dir->path.$file) <= time() - $this->_refresh ) { -- 2.39.2