no uniqid as a substitute of randomness

[pavetheway91]

Hey

I just learned about those long overdue CVEs and this project got a new user a perhaps a new contributor too.

After a quick inspection, I found at least one additional issue, which you've addressed in PHP7+ (uniqid as a source of "randomness"). If you really, really, really still want to keep PHP5 supported, I'd like to suggest another solution for that, which is trying several things such as libsodium, /dev/urandom, CAPICOM etc. If it really turns out that there actually are systems without any of these, only then think about having a user-enableable option for some kind of a substitute. Shall I send a PR?

[peterpp]

Hallo and welcome ☺️ I noticed that discussion in Adminer. All those CVEs are addressed in AdminNeo, but you are right that uniqid() is still used on PHP 5. I didn't wanted to support PHP 5 at first, but people were asking for that, so yes, we support it in compiled version for now.

First of all, we should unify generating of random strings and usages of uniqid() – we have a get_random_string() function for that. Then we can improve it if possible. If you can prepare a PR, I'll be really glad.

[pavetheway91]

That what I had in mind, one function for random bytes. I'll follow with a PR, once I've had some time to learn how this thing works. I might also ask some questions in this thread if I can't figure something by myself.

[pavetheway91]

Do you happen to have some kind of a Windows system with PHP5? One of these implementations should need to be tested on one of those.

[peterpp]

Never 😊 But I can try to prepare one.

[pavetheway91]

I don't have a favourite between the two. Practically, this only applies to those still on PHP5 and who run in on Windows, because /dev/urandom can otherwise be assumed to be there.

Option A
If secure entropy cannot be gathered, there's something wrong in the system and the app should just refuse to function.

Option B
If secure entropy cannot be gathered, have a PHP -based last resort which would however, be an upgrade from what's done elsewhere.