Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Insecure random number generators used throughout CDash #160

Closed
ghost opened this issue Nov 11, 2015 · 1 comment
Closed

Insecure random number generators used throughout CDash #160

ghost opened this issue Nov 11, 2015 · 1 comment

Comments

@ghost
Copy link

ghost commented Nov 11, 2015

Random number generators from PHP that are insecurely seeded (often with the current timestamp) are used throughout the CDash codebase. Using random numbers in this way often has security implications.

The use of random number generators can be improved using the same solution applied in pull request #147. This uses the PHP 7 native random number generation functions, and relies upon the paragonie/random_compat library to provide support in PHP 5.

./cdash/common.php: srand(make_seed_recoverpass());
./login.php:$stamp = md5(srand(5));
./login_functions.php: srand(make_seed_recoverpass());
./login_functions.php: srand(make_seed_recoverpass());
./manageProjectRoles.php: srand(make_seed_recoverpass());
./register.php: srand(microtime_float());
./cdash/do_submit.php: $filename = $CDASH_BACKUP_DIRECTORY."/".mt_rand().".xml";

@zackgalbreath
Copy link
Contributor

Addressed by #222

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant