[gentoo-commits] gentoo-projects commit in forums/htdocs/includes: functions.php

[Robin H. Johnson (robbat2)]

robbat2     09/08/19 17:41:37

  Modified:             functions.php
  Log:
  Stop touching the database for rand_seed, and now NEVER repeat random ids.

Revision  Changes    Path
1.27                 forums/htdocs/includes/functions.php

file : http://sources.gentoo.org/viewcvs.py/gentoo-projects/forums/htdocs/includes/functions.php?rev=1.27&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-projects/forums/htdocs/includes/functions.php?rev=1.27&content-type=text/plain
diff : http://sources.gentoo.org/viewcvs.py/gentoo-projects/forums/htdocs/includes/functions.php?r1=1.26&r2=1.27

Index: functions.php
===================================================================
RCS file: /var/cvsroot/gentoo-projects/forums/htdocs/includes/functions.php,v
retrieving revision 1.26
retrieving revision 1.27
diff -p -w -b -B -u -u -r1.26 -r1.27
--- functions.php	30 Jul 2009 06:38:50 -0000	1.26
+++ functions.php	19 Aug 2009 17:41:37 -0000	1.27
@@ -7,7 +7,7 @@
  *   copyright            : (C) 2001 The phpBB Group
  *   email                : support@×××××.com
  *
- *   $Id: functions.php,v 1.26 2009/07/30 06:38:50 desultory Exp $
+ *   $Id: functions.php,v 1.27 2009/08/19 17:41:37 robbat2 Exp $
  *
  *
  ***************************************************************************/
@@ -146,30 +146,30 @@ function phpbb_rtrim($str, $charlist = f
 * The board wide setting is updated once per page if this code is called
 * With thanks to Anthrax101 for the inspiration on this one
 * Added in phpBB 2.0.20
+* 
+* 2009-08-19 robbat2: PRNG improvements
+* - completely modify it to NOT touch the database and return a much better grade of random
+* - carry out local PRNG state in $dss_seeded.
+* - reseed sometimes
 */
 function dss_rand()
 {
-	global $db, $board_config, $dss_seeded;
-
-	$val = $board_config['rand_seed'] . microtime();
-	$val = md5($val);
-	$board_config['rand_seed'] = md5($board_config['rand_seed'] . $val . 'a');
-
-	if($dss_seeded !== true)
-	{
-		$sql = "UPDATE " . CONFIG_TABLE . " SET
-			config_value = '" . $board_config['rand_seed'] . "'
-			WHERE config_name = 'rand_seed'";
+	global $dss_seeded;
 		
-		if( !$db->sql_query($sql) )
-		{
-			message_die(GENERAL_ERROR, "Unable to reseed PRNG", "", __LINE__, __FILE__, $sql);
+	$need_reseed = false;
+	// Trigger reseeding approximately every 1K calls
+	if(rand() % 1024 == 1) {
+		$need_reseed = true;
 		}
 
-		$dss_seeded = true;
+	// When we are not seeded, grab some kernel entropy.
+	if($dss_seeded === false || $need_reseed === true) {
+		$dss_seeded .= file_get_contents('/dev/urandom', FILE_BINARY, NULL, 0, 8);
 	}
 
-	return substr($val, 4, 16);
+	$dss_seeded = md5(microtime() . posix_getpid() . $_SERVER['REQUEST_TIME'] . $_SERVER['UNIQUE_ID'] . $dss_seeded);
+
+	return substr($dss_seeded, 4, 16);
 }
 //
 // Get Userdata, $user can be username or user_id. If force_str is true, the username will be forced.