#511 - Reduce chance of brute force attacks against session generation

Identifier #511
Issue type Minor issue (breaks specific functionality)
Title Reduce chance of brute force attacks against session generation
Status Completed
Handling member Chris Graham
Version 8.1
Addon General / Uncategorised
Description Sessions are generated using mt_rand, seeded via a combination of uniqid and microtime. Some juggling is done, but the only dominant factor is microtime. That means in theory the number of guesses to guess a session are reduced. It is still a huge number, and IP address restriction is in place, but it is better we lay on additional defences here.

So, use openssl_random_pseudo_bytes if it is available.
Steps to reproduce

Funded? No
Hotfixes

hotfix-511, 2012-05-27 1pm.tar

hotfix-511, 2012-05-27 3pm.tar

Only apply these hotfixes if you absolutely need them and cannot wait until the next release of Composr (releases are more reliable and strictly tested). We provide no guarantee that hotfixes will work; they may even break your site especially if a hotfix depends on another hotfix. Always make a site backup if you attempt to apply a hotfix.

As of Composr version 11, the recommended way to apply a hotfix is by following the same steps as an upgrade:

  1. Download the hotfix into the data_custom folder of your Composr installation directory
  2. Back up your site
  3. Go to yourbaseurl/upgrader.php
  4. When you get to the 'Transfer across new/updated files' step, use the hotfix that you downloaded.
  5. The upgrader will automatically apply hotfix files, skipping any files belonging to addons that you do not have installed, and also skipping hotfix files that are older than the files on disk
  6. Run a database upgrade if prompted
  7. You may wish to run a file integrity scan and resolve issues.

For Composr version 10, manually extract the files (e.g., using 7-Zip) and overwrite files in your Composr installation that are older than the ones in the hotfix (check the file modification date/time). Skip hotfix files that do not exist in your installation.
Commits

4064eae

9dd7eb3
The system will post a comment when this issue is modified (e.g., status changes). To be notified of this, click "Enable comment notifications".

Rating

Unrated