This is an automated email from the git hooks/post-receive script. s k u n n y k p u s h e d a c o m m i t t o b r a n c h o l d f o r u m in repository www/forum.xfce.org.
commit a6bb254ca6e0fbb627cf1b79f05245a54f6a38c6 Author: Nick Schermer <n...@xfce.org> Date: Fri Feb 22 15:43:27 2013 +0100 Update to fluxbb 1.5.3. --- db_update.php | 2 +- include/common.php | 2 +- include/functions.php | 18 ++----- include/srand.php | 145 ++++++++++++++++++++++++++++++++++++++++++++++++++ install.php | 2 +- profile.php | 2 +- 6 files changed, 154 insertions(+), 17 deletions(-) diff --git a/db_update.php b/db_update.php index c2c261b..9c3d3b3 100644 --- a/db_update.php +++ b/db_update.php @@ -7,7 +7,7 @@ */ // The FluxBB version this script updates to -define('UPDATE_TO', '1.5.2'); +define('UPDATE_TO', '1.5.3'); define('UPDATE_TO_DB_REVISION', 18); define('UPDATE_TO_SI_REVISION', 2); diff --git a/include/common.php b/include/common.php index 1a5b2ef..3196313 100644 --- a/include/common.php +++ b/include/common.php @@ -10,7 +10,7 @@ if (!defined('PUN_ROOT')) exit('The constant PUN_ROOT must be defined and point to a valid FluxBB installation root directory.'); // Define the version and database revision that this code was written for -define('FORUM_VERSION', '1.5.2'); +define('FORUM_VERSION', '1.5.3'); define('FORUM_DB_REVISION', 18); define('FORUM_SI_REVISION', 2); diff --git a/include/functions.php b/include/functions.php index e24336d..8ec3cdb 100644 --- a/include/functions.php +++ b/include/functions.php @@ -6,6 +6,8 @@ * License: http://www.gnu.org/licenses/gpl.html GPL version 2 or higher */ +include PUN_ROOT.'include/srand.php'; + // // Return current timestamp (with microseconds) as a float @@ -1007,22 +1009,12 @@ function forum_number_format($number, $decimals = 0) // function random_key($len, $readable = false, $hash = false) { - $key = ''; + $key = secure_random_bytes($len); if ($hash) - $key = substr(pun_hash(uniqid(rand(), true)), 0, $len); + $key = substr(bin2hex($key), 0, $len); else if ($readable) - { - $chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; - - for ($i = 0; $i < $len; ++$i) - $key .= substr($chars, (mt_rand() % strlen($chars)), 1); - } - else - { - for ($i = 0; $i < $len; ++$i) - $key .= chr(mt_rand(33, 126)); - } + $key = substr(base64_encode($key), 0, $len); return $key; } diff --git a/include/srand.php b/include/srand.php new file mode 100644 index 0000000..8243e2e --- /dev/null +++ b/include/srand.php @@ -0,0 +1,145 @@ +<?php + +/* + * Author: + * George Argyros <argyros.geo...@gmail.com> + * + * Copyright (c) 2012, George Argyros + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * * Neither the name of the <organization> nor the + * names of its contributors may be used to endorse or promote products + * derived from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL GEORGE ARGYROS BE LIABLE FOR ANY + * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + * + * + * The function is providing, at least at the systems tested :), + * $len bytes of entropy under any PHP installation or operating system. + * The execution time should be at most 10-20 ms in any system. + */ +function secure_random_bytes($len = 10) +{ + + /* + * Our primary choice for a cryptographic strong randomness function is + * openssl_random_pseudo_bytes. + */ + $SSLstr = '4'; // http://xkcd.com/221/ + if (function_exists('openssl_random_pseudo_bytes') && + (version_compare(PHP_VERSION, '5.3.4') >= 0 || + substr(PHP_OS, 0, 3) !== 'WIN')) + { + $SSLstr = openssl_random_pseudo_bytes($len, $strong); + if ($strong) + return $SSLstr; + } + + /* + * If mcrypt extension is available then we use it to gather entropy from + * the operating system's PRNG. This is better than reading /dev/urandom + * directly since it avoids reading larger blocks of data than needed. + * Older versions of mcrypt_create_iv may be broken or take too much time + * to finish so we only use this function with PHP 5.3 and above. + */ + if (function_exists('mcrypt_create_iv') && + (version_compare(PHP_VERSION, '5.3.0') >= 0 || + substr(PHP_OS, 0, 3) !== 'WIN')) + { + $str = mcrypt_create_iv($len, MCRYPT_DEV_URANDOM); + if ($str !== false) + return $str; + } + + + /* + * No build-in crypto randomness function found. We collect any entropy + * available in the PHP core PRNGs along with some filesystem info and memory + * stats. To make this data cryptographically strong we add data either from + * /dev/urandom or if its unavailable, we gather entropy by measuring the + * time needed to compute a number of SHA-1 hashes. + */ + $str = ''; + $bits_per_round = 2; // bits of entropy collected in each clock drift round + $msec_per_round = 400; // expected running time of each round in microseconds + $hash_len = 20; // SHA-1 Hash length + $total = $len; // total bytes of entropy to collect + + $handle = @fopen('/dev/urandom', 'rb'); + if ($handle && function_exists('stream_set_read_buffer')) + @stream_set_read_buffer($handle, 0); + + do + { + $bytes = ($total > $hash_len)? $hash_len : $total; + $total -= $bytes; + + //collect any entropy available from the PHP system and filesystem + $entropy = rand() . uniqid(mt_rand(), true) . $SSLstr; + $entropy .= implode('', @fstat(@fopen( __FILE__, 'r'))); + $entropy .= memory_get_usage(); + if ($handle) + { + $entropy .= @fread($handle, $bytes); + } + else + { + // Measure the time that the operations will take on average + for ($i = 0; $i < 3; $i ++) + { + $c1 = microtime(true); + $var = sha1(mt_rand()); + for ($j = 0; $j < 50; $j++) + { + $var = sha1($var); + } + $c2 = microtime(true); + $entropy .= $c1 . $c2; + } + + // Based on the above measurement determine the total rounds + // in order to bound the total running time. + $rounds = (int)($msec_per_round*50 / (int)(($c2-$c1)*1000000)); + + // Take the additional measurements. On average we can expect + // at least $bits_per_round bits of entropy from each measurement. + $iter = $bytes*(int)(ceil(8 / $bits_per_round)); + for ($i = 0; $i < $iter; $i ++) + { + $c1 = microtime(); + $var = sha1(mt_rand()); + for ($j = 0; $j < $rounds; $j++) + { + $var = sha1($var); + } + $c2 = microtime(); + $entropy .= $c1 . $c2; + } + + } + // We assume sha1 is a deterministic extractor for the $entropy variable. + $str .= sha1($entropy, true); + } while ($len > strlen($str)); + + if ($handle) + @fclose($handle); + + return substr($str, 0, $len); +} \ No newline at end of file diff --git a/install.php b/install.php index 0934a8c..0a459c3 100644 --- a/install.php +++ b/install.php @@ -7,7 +7,7 @@ */ // The FluxBB version this script installs -define('FORUM_VERSION', '1.5.2'); +define('FORUM_VERSION', '1.5.3'); define('FORUM_DB_REVISION', 18); define('FORUM_SI_REVISION', 2); diff --git a/profile.php b/profile.php index a666bed..5573126 100644 --- a/profile.php +++ b/profile.php @@ -1791,7 +1791,7 @@ else if ($cur_category != 0) echo "\n\t\t\t\t\t\t\t".'</div>'."\n"; - echo "\t\t\t\t\t\t\t".'<div class="conl">'."\n\t\t\t\t\t\t\t\t".'<p><strong>'.$cur_forum['cat_name'].'</strong></p>'."\n\t\t\t\t\t\t\t\t".'<div class="rbox">'; + echo "\t\t\t\t\t\t\t".'<div class="conl">'."\n\t\t\t\t\t\t\t\t".'<p><strong>'.pun_htmlspecialchars($cur_forum['cat_name']).'</strong></p>'."\n\t\t\t\t\t\t\t\t".'<div class="rbox">'; $cur_category = $cur_forum['cid']; } -- To stop receiving notification emails like this one, please contact the administrator of this repository. _______________________________________________ Xfce4-commits mailing list Xfce4-commits@xfce.org https://mail.xfce.org/mailman/listinfo/xfce4-commits