diff --git a/CHANGELOG.md b/CHANGELOG.md index 647aeab..b6d5ff0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +# 1.3.3 # + +The following happened to getUniqid(): + +Default $entropy value set to 10000, a warning is triggered if openssl_random_pseudo_bytes is unable to locate a +cryptographically strong algorithm. + # 1.3.2 # ENT_SUBSTITUTE added to Alo::unXss() diff --git a/docs/class-AloFramework.Common.Alo.html b/docs/class-AloFramework.Common.Alo.html index cdfae79..a5d5b98 100644 --- a/docs/class-AloFramework.Common.Alo.html +++ b/docs/class-AloFramework.Common.Alo.html @@ -235,7 +235,7 @@

Since

# - getUniqid( string $hash = 'sha256', string $prefix = '', integer $entropy = 250, boolean $rawOutput = false ) + getUniqid( string $hash = 'sha256', string $prefix = '', integer $entropy = 10000, boolean $rawOutput = false )

Generates a unique identifier

@@ -269,11 +269,14 @@

Author

Since

- 1.3
+

1.3.3 Default $entropy value set to 10000, a warning is triggered if openssl_random_pseudo_bytes is +unable to locate a cryptographically strong algorithm.
+ 1.3


See

https://secure.php.net/manual/en/function.hash.php
+ https://secure.php.net/manual/en/function.openssl-random-pseudo-bytes.php

Codecoverageignore

diff --git a/src/Alo.php b/src/Alo.php index 901f027..5e5f8a1 100644 --- a/src/Alo.php +++ b/src/Alo.php @@ -203,10 +203,13 @@ static function asciiRand($length, $subset = self::ASCII_ALL) { * * @return string * @see https://secure.php.net/manual/en/function.hash.php - * @since 1.3 + * @see https://secure.php.net/manual/en/function.openssl-random-pseudo-bytes.php + * @since 1.3.3 Default $entropy value set to 10000, a warning is triggered if openssl_random_pseudo_bytes is + * unable to locate a cryptographically strong algorithm.
+ * 1.3 * @codeCoverageIgnore */ - static function getUniqid($hash = 'sha256', $prefix = '', $entropy = 250, $rawOutput = false) { + static function getUniqid($hash = 'sha256', $prefix = '', $entropy = 10000, $rawOutput = false) { $str = mt_rand(~PHP_INT_MAX, PHP_INT_MAX) . json_encode([$_COOKIE, $_REQUEST, $_FILES, @@ -217,7 +220,14 @@ static function getUniqid($hash = 'sha256', $prefix = '', $entropy = 250, $rawOu self::asciiRand($entropy, self::ASCII_ALL); if (function_exists('\openssl_random_pseudo_bytes')) { - $str .= \openssl_random_pseudo_bytes($entropy); + $algoStrong = null; + $str .= \openssl_random_pseudo_bytes($entropy, $algoStrong); + + if ($algoStrong !== true) { + trigger_error('Please update your openssl & PHP libraries. openssl_random_pseudo_bytes was unable' . + ' to locate a cryptographically strong algorithm.', + E_USER_WARNING); + } } else { trigger_error('The openssl extension is not enabled, therefore the unique ID is not ' . 'cryptographically secure.',