jenkins-bot has submitted this change and it was merged.
Change subject: Do not use weak random for password hashing
......................................................................
Do not use weak random for password hashing
Throw an exception during password hash generation if only weak sources
of random data can be found.
Bug: 71624
Change-Id: Id950da464d61fc0b3a4aea3fb7dbc1cd7649ea73
---
M src/Password.php
1 file changed, 12 insertions(+), 2 deletions(-)
Approvals:
BryanDavis: Looks good to me, approved
CSteipp: Looks good to me, but someone else must approve
jenkins-bot: Verified
diff --git a/src/Password.php b/src/Password.php
index fda2599..abcb068 100644
--- a/src/Password.php
+++ b/src/Password.php
@@ -123,9 +123,12 @@
* Get N high entropy random bytes.
*
* @param int $count Number of bytes to generate
+ * @param bool $allowWeak Allow weak entropy sources
* @return string String of random bytes
+ * @throws InvalidArgumentException if $allowWeak is false and no high
+ * entropy sources of random data can be found
*/
- public static function getBytes( $count ) {
+ public static function getBytes( $count, $allowWeak = false ) {
if ( function_exists( 'mcrypt_create_iv' ) ) {
$bytes = mcrypt_create_iv( $count, MCRYPT_DEV_URANDOM );
@@ -159,6 +162,13 @@
}
}
} // end if /dev/urandom
+
+ if ( $allowWeak !== true ) {
+ throw new InvalidArgumentException(
+ 'No high entropy source of random data found
and ' .
+ 'weak sources disallowed in function call'
+ );
+ }
// create a high entropy seed value
$seed = microtime() . uniqid( '', true );
@@ -217,7 +227,7 @@
}
$csLen = strlen( $cs );
- $random = self::getBytes( $len );
+ $random = self::getBytes( $len, true );
$password = '';
foreach( range( 0, $len - 1 ) as $i ) {
--
To view, visit https://gerrit.wikimedia.org/r/165693
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: Id950da464d61fc0b3a4aea3fb7dbc1cd7649ea73
Gerrit-PatchSet: 1
Gerrit-Project: wikimedia/iegreview
Gerrit-Branch: master
Gerrit-Owner: BryanDavis <[email protected]>
Gerrit-Reviewer: BryanDavis <[email protected]>
Gerrit-Reviewer: CSteipp <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
