diff --git a/CHANGELOG.md b/CHANGELOG.md
index 647aeab..b6d5ff0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+# 1.3.3 #
+
+The following happened to getUniqid():
+
+Default $entropy value set to 10000, a warning is triggered if openssl_random_pseudo_bytes is unable to locate a
+cryptographically strong algorithm.
+
# 1.3.2 #
ENT_SUBSTITUTE added to Alo::unXss()
diff --git a/docs/class-AloFramework.Common.Alo.html b/docs/class-AloFramework.Common.Alo.html
index cdfae79..a5d5b98 100644
--- a/docs/class-AloFramework.Common.Alo.html
+++ b/docs/class-AloFramework.Common.Alo.html
@@ -235,7 +235,7 @@
Since
#
- getUniqid( string $hash = 'sha256', string $prefix = '', integer $entropy = 250, boolean $rawOutput = false )
+ getUniqid( string $hash = 'sha256', string $prefix = '', integer $entropy = 10000, boolean $rawOutput = false )
Generates a unique identifier
@@ -269,11 +269,14 @@ Author
Since
- 1.3
+ 1.3.3 Default $entropy value set to 10000, a warning is triggered if openssl_random_pseudo_bytes is
+unable to locate a cryptographically strong algorithm.
+ 1.3
See
https://secure.php.net/manual/en/function.hash.php
+ https://secure.php.net/manual/en/function.openssl-random-pseudo-bytes.php
Codecoverageignore
diff --git a/src/Alo.php b/src/Alo.php
index 901f027..5e5f8a1 100644
--- a/src/Alo.php
+++ b/src/Alo.php
@@ -203,10 +203,13 @@ static function asciiRand($length, $subset = self::ASCII_ALL) {
*
* @return string
* @see https://secure.php.net/manual/en/function.hash.php
- * @since 1.3
+ * @see https://secure.php.net/manual/en/function.openssl-random-pseudo-bytes.php
+ * @since 1.3.3 Default $entropy value set to 10000, a warning is triggered if openssl_random_pseudo_bytes is
+ * unable to locate a cryptographically strong algorithm.
+ * 1.3
* @codeCoverageIgnore
*/
- static function getUniqid($hash = 'sha256', $prefix = '', $entropy = 250, $rawOutput = false) {
+ static function getUniqid($hash = 'sha256', $prefix = '', $entropy = 10000, $rawOutput = false) {
$str = mt_rand(~PHP_INT_MAX, PHP_INT_MAX) . json_encode([$_COOKIE,
$_REQUEST,
$_FILES,
@@ -217,7 +220,14 @@ static function getUniqid($hash = 'sha256', $prefix = '', $entropy = 250, $rawOu
self::asciiRand($entropy, self::ASCII_ALL);
if (function_exists('\openssl_random_pseudo_bytes')) {
- $str .= \openssl_random_pseudo_bytes($entropy);
+ $algoStrong = null;
+ $str .= \openssl_random_pseudo_bytes($entropy, $algoStrong);
+
+ if ($algoStrong !== true) {
+ trigger_error('Please update your openssl & PHP libraries. openssl_random_pseudo_bytes was unable' .
+ ' to locate a cryptographically strong algorithm.',
+ E_USER_WARNING);
+ }
} else {
trigger_error('The openssl extension is not enabled, therefore the unique ID is not ' .
'cryptographically secure.',
|