Random: rejects openssl_random_pseudo_bytes result when is not crypto…

…graphically strong
nette · Sep 3, 2015 · 359e681 · 359e681
1 parent 6c3218e
commit 359e681
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/src/Utils/Random.php b/src/Utils/Random.php
@@ -36,7 +36,10 @@ public static function generate($length = 10, $charlist = '0-9a-z')
 			$bytes = (string) random_bytes($length);
 		}
 		if (strlen($bytes) < $length && function_exists('openssl_random_pseudo_bytes')) {
-			$bytes = (string) openssl_random_pseudo_bytes($length);
+			$bytes = (string) openssl_random_pseudo_bytes($length, $secure);
+			if (!$secure) {
+				$bytes = '';
+			}
 		}
 		if (strlen($bytes) < $length && function_exists('mcrypt_create_iv')) {
 			$bytes = (string) mcrypt_create_iv($length, MCRYPT_DEV_URANDOM);