From 16170645eb2ed2c2085749b7ab1f159ec17b6faa Mon Sep 17 00:00:00 2001 From: kotnik Date: Tue, 13 Dec 2011 11:02:02 +0100 Subject: [PATCH] Improve random number generation See http://drupal.org/node/838800 --- core/includes/bootstrap.inc | 11 ++++++++++- 1 files changed, 10 insertions(+), 1 deletions(-) diff --git a/core/includes/bootstrap.inc b/core/includes/bootstrap.inc index f01a3de..b87f2a0 100644 --- a/core/includes/bootstrap.inc +++ b/core/includes/bootstrap.inc @@ -1956,7 +1956,11 @@ function drupal_block_denied($ip) { */ function drupal_random_bytes($count) { // $random_state does not use drupal_static as it stores random bytes. - static $random_state, $bytes; + static $random_state, $bytes, $php_compatible; + // Check PHP compatibility on the first call. + if (!isset($php_compatible)) { + $php_compatible = version_compare(PHP_VERSION, DRUPAL_MINIMUM_PHP, '>='); + } // Initialize on the first call. The contents of $_SERVER includes a mix of // user-specific and system information that varies a little with each page. if (!isset($random_state)) { @@ -1977,6 +1981,11 @@ function drupal_random_bytes($count) { $bytes .= fread($fh, max(4096, $count)); fclose($fh); } + // openssl_random_pseudo_bytes() is available since PHP 5.3.0, and will + // find entropy in a system-dependent way. + elseif ($php_compatible && function_exists('openssl_random_pseudo_bytes')) { + $bytes .= openssl_random_pseudo_bytes($count - strlen($bytes)); + } // If /dev/urandom is not available or returns no bytes, this loop will // generate a good set of pseudo-random bytes on any system. // Note that it may be important that our $random_state is passed -- 1.7.8