Safer create_uuid implementation

Fixes issue #336.

Author: wrygiel

okapi/core.php

@@ -933,6 +933,28 @@ class Okapi
 
     private static $okapi_vars = null;
 
+    /** Return a new, random UUID. */
+    public static function create_uuid()
+    {
+        /* If we're on Linux, then we'll use a system function for that. */
+
+        if (file_exists("/proc/sys/kernel/random/uuid")) {
+            return trim(file_get_contents("/proc/sys/kernel/random/uuid"));
+        }
+
+        /* On other systems (as well as on some other Linux distributions)
+         * fall back to the original implementation (which is NOT safe - we had
+         * one duplicate during 3 years of its running). */
+
+        return sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
+            mt_rand(0, 0xffff), mt_rand(0, 0xffff),
+            mt_rand(0, 0xffff),
+            mt_rand(0, 0x0fff) | 0x4000,
+            mt_rand(0, 0x3fff) | 0x8000,
+            mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0xffff)
+        );
+    }
+
     /** Get a variable stored in okapi_vars. If variable not found, return $default. */
     public static function get_var($varname, $default = null)
     {

okapi/services/logs/submit.php

@@ -619,23 +619,12 @@ private static function increment_user_stats($user_internal_id, $logtype)
         }
     }
 
-    private static function create_uuid()
-    {
-        return sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
-            mt_rand(0, 0xffff), mt_rand(0, 0xffff),
-            mt_rand(0, 0xffff),
-            mt_rand(0, 0x0fff) | 0x4000,
-            mt_rand(0, 0x3fff) | 0x8000,
-            mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0xffff)
-        );
-    }
-
     private static function insert_log_row(
         $consumer_key, $cache_internal_id, $user_internal_id, $logtype, $when,
         $formatted_comment, $text_html
     )
     {
-        $log_uuid = self::create_uuid();
+        $log_uuid = Okapi::create_uuid();
         Db::execute("
             insert into cache_logs (uuid, cache_id, user_id, type, date, text, text_html, last_modified, date_created, node)
             values (