mt_rand() is not secure from a cryptographic point of view, let's use openssl_random_pseudo_bytes() here

14 years ago · 992c2c9d4b
parent 36f1c9b083
commit 992c2c9d4b
1 changed files with 2 additions and 1 deletions
--- a/lib/setup.php
+++ b/lib/setup.php
@ -79,7 +79,8 @@ class OC_Setup {
 			}

 			//generate a random salt that is used to salt the local user passwords
-			$salt=mt_rand(1000,9000).mt_rand(1000,9000).mt_rand(1000,9000).mt_rand(1000,9000).mt_rand(1000,9000).mt_rand(1000,9000).mt_rand(1000,9000).mt_rand(1000,9000);
+			$random_bytes = openssl_random_pseudo_bytes(30, $cstrong);
+			$salt = bin2hex($random_bytes);
 			OC_Config::setValue('passwordsalt', $salt);

 			//write the config file