#5898 - Make get_secure_random_string more secure

  • By
  • Added
  • 3 views
Identifier #5898
Issue type Trivial issue (does not break functionality)
Title Make get_secure_random_string more secure
Status Completed
Tags

Roadmap: v11 (custom)

Type: Security (custom)

Handling member PDStig
Version 11 beta1
Addon core
Description get_secure_random_string was not, in fact, cryptographically secure because we were converting the random bytes to MD5.

This patch modifies the function in three ways:
* We generate a string character-by-character without using hashing.
* We use base32 instead of base16 (numbers and lowercase letters, except for 0, 1, l, and o).
* A param can be specified to change the length from the original forced 13 bytes.
Steps to reproduce

Funded? No
Commits

Fixed MANTIS-5898 (Make get_secure_random_string more secure) (430f2b81) · Commits · Composr ecosystem / Composr · GitLab

The system will post a comment when this issue is modified (e.g., status changes). To be notified of this, click "Enable comment notifications".

Rating

Unrated