lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix increase entrophy of default password generation.

Browse Source
This commit is contained in:
Laurent Destailleur 2021-07-05 17:55:17 +02:00
parent f648185839
commit 65adb16191
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
htdocs/core/modules/security/generate/modGeneratePassStandard.class.php
View File

@ -99,7 +99,7 @@ class modGeneratePassStandard extends ModeleGenPassword
$password = ""; $password = "";
// define possible characters // define possible characters
$possible = "0123456789bcdfghjkmnpqrstvwxyz"; $possible = "0123456789qwertyuiopasdfghjklzxcvbnmASDFGHJKLZXCVBNMQWERTYUIOP";
// set up a counter // set up a counter
$i = 0; $i = 0;
@ -107,10 +107,13 @@ class modGeneratePassStandard extends ModeleGenPassword
// add random characters to $password until $length is reached // add random characters to $password until $length is reached
while ($i < $this->length) { while ($i < $this->length) {
// pick a random character from the possible ones // pick a random character from the possible ones
$char = substr($possible, mt_rand(0, dol_strlen($possible) - 1), 1); if (function_exists('random_int')) { // Cryptographic random
$char = substr($possible, random_int(0, dol_strlen($possible) - 1), 1);
} else {
$char = substr($possible, mt_rand(0, dol_strlen($possible) - 1), 1);
}
// we don't want this character if it's already in the password if (substr_count($password, $char) <= 6) { // we don't want this character if it's already 5 times in the password
if (!strstr($password, $char)) {
$password .= $char; $password .= $char;
$i++; $i++;
} }