Ticket #28633: 28633.2.patch

src/wp-admin/includes/ms.php

@@ -245 +245 @@
         if ( $value == get_option( 'admin_email' ) || !is_email( $value ) )
                 return;
 
-        $hash = md5( $value. time() .mt_rand() );
+        $hash = md5( wp_random_bytes(16) . $value. time() .mt_rand() );
         $new_admin_email = array(
                 'hash' => $hash,
                 'newemail' => $value
@@ -323 +323 @@
                         return;
                 }
 
-                $hash = md5( $_POST['email'] . time() . mt_rand() );
+                $hash = bin2hex(wp_random_bytes(16));
                 $new_user_email = array(
                                 'hash' => $hash,
                                 'newemail' => $_POST['email']

src/wp-admin/includes/schema.php

@@ -1016 +1016 @@
 
                 $vhost_ok = false;
                 $errstr = '';
-                $hostname = substr( md5( time() ), 0, 6 ) . '.' . $domain; // Very random hostname!
+                $hostname = bin2hex( wp_random_bytes(3) ) . '.' . $domain; // Very random hostname!
                 $page = wp_remote_get( 'http://' . $hostname, array( 'timeout' => 5, 'httpversion' => '1.1' ) );
                 if ( is_wp_error( $page ) )
                         $errstr = $page->get_error_message();

src/wp-includes/functions.php

@@ -1668 +1668 @@
 function win_is_writable( $path ) {
 
         if ( $path[strlen( $path ) - 1] == '/' ) // if it looks like a directory, check a random file within the directory
-                return win_is_writable( $path . uniqid( mt_rand() ) . '.tmp');
+                return win_is_writable( $path . uniqid( bin2hex(wp_random_bytes(16)) ) . '.tmp');
         else if ( is_dir( $path ) ) // If it's a directory (and not a file) check a random file within the directory
-                return win_is_writable( $path . '/' . uniqid( mt_rand() ) . '.tmp' );
+                return win_is_writable( $path . '/' . uniqid( bin2hex(wp_random_bytes(16)) ) . '.tmp' );
 
         // check tmp file for read/write capabilities
         $should_delete_tmp_file = !file_exists( $path );

src/wp-includes/ms-functions.php

@@ -713 +713 @@
 function wpmu_signup_blog( $domain, $path, $title, $user, $user_email, $meta = array() )  {
         global $wpdb;
 
-        $key = substr( md5( time() . rand() . $domain ), 0, 16 );
+        $key = substr( md5( time() . wp_random_bytes(8) . $domain ), 0, 16 );
         $meta = serialize($meta);
 
         $wpdb->insert( $wpdb->signups, array(
@@ -748 +748 @@
         // Format data
         $user = preg_replace( '/\s+/', '', sanitize_user( $user, true ) );
         $user_email = sanitize_email( $user_email );
-        $key = substr( md5( time() . rand() . $user_email ), 0, 16 );
+        $key = bin2hex(wp_random_bytes(8));
         $meta = serialize($meta);
 
         $wpdb->insert( $wpdb->signups, array(

src/wp-includes/pluggable.php

@@ -1991 +1991 @@
 
         $password = '';
         for ( $i = 0; $i < $length; $i++ ) {
-                $password .= substr($chars, wp_rand(0, strlen($chars) - 1), 1);
+                $password .= substr($chars, wp_secure_rand(0, strlen($chars) - 1), 1);
         }
 
         /**
@@ -2005 +2005 @@
 }
 endif;
 
+if ( !function_exists('wp_random_bytes') ) :
+
+/**
+ * Generate a cryptographically secure random string
+ * @ref http://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/
+ * 
+ * @param int $bytes - how many bytes do we want?
+ */
+function wp_random_bytes($bytes = 32) {
+        $buf = '';
+        // Use /dev/urandom over all other methods
+        if (is_readable('/dev/urandom')) {
+                $fp = fopen('/dev/urandom', 'rb');
+                if ($fp !== false) {
+                        $buf = fread($fp, $bytes);
+                        fclose($fp);
+                        if ($buf !== FALSE) {
+                                return $buf;
+                        }
+                }
+        }
+        if (function_exists('mcrypt_create_iv')) {
+                $buf = mcrypt_create_iv($bytes, MCRYPT_DEV_URANDOM);
+                if($buf !== FALSE) {
+                        return $buf;
+                }
+        }
+        if (function_exists('openssl_random_pseudo_bytes')) {
+                $strong = false;
+                $buf = openssl_random_pseudo_bytes($bytes, $strong);
+                if ($strong) {
+                        return $buf;
+                }
+        }
+}
+
+endif;
+
+if ( !function_exists('wp_random_positive_int'):
+/**
+ * Generate a random positive integer between 0 and PHP_INT_MAX
+ * 
+ * @return int A random positive integer
+ */
+function wp_random_positive_int() {
+    $buf = wp_random_bytes(PHP_INT_SIZE);
+    if($buf === false) {
+        trigger_error('Random number failure', E_USER_ERROR);
+    }
+    
+    $val = 0;
+    $i = strlen($buf);
+    
+    do {
+        $i--;
+        $val <<= 8;
+        $val |= ord($buf[$i]);
+    } while ($i != 0);
+
+    return $val & PHP_INT_MAX;
+}
+endif;
+    
+if ( !function_exists('wp_secure_rand') ):
+/**
+ * Generates an unbiased, unpredictably random number
+ *
+ * @since x.x.x
+ *
+ * @param int $min Lower limit for the generated number
+ * @param int $max Upper limit for the generated number
+ * @return int A random number between min and max
+ */
+function wp_secure_rand( $min = 0, $max = 0) {
+    $range = $max - $min;
+    if ($range < 2) {
+        return $min;
+    }
+    $rem = (PHP_INT_MAX - $range + 1) % $range;
+    do {
+        $val = wp_random_positive_int();
+        if ($val === false) {
+            // RNG failure
+            return false;
+        }
+    } while ($val < $rem);
+    return (int) ($min + $val % $range);
+}
+
+endif;
+
 if ( !function_exists('wp_rand') ) :
 /**
  * Generates a random number

tests/phpunit/tests/functions.php

@@ -611 +611 @@
                 $json = wp_json_encode( $data, 0, 1 );
                 $this->assertFalse( $json );
         }
+    
+    /**
+     * @ticket 28633
+     */
+    function test_wp_secure_rand() {
+        // Let's load a buffer
+        $buff = array();
+        
+        // How size do we want our test array to be?
+        
+        //$size = wp_rand(16,256);
+        $size = 16;
+        
+        // We should expect 
+        $to_run = 10;
+        
+        // 
+        for($i = 0; $i < $size; ++$i) {
+            $buff[$i] = 0;
+        }
+        
+        $tests = $size * $to_run;
+        
+        for($i = 0; $i < $tests; ++$i) {
+            ++$buff[wp_secure_rand(0, $size - 1)];
+        }
+        
+        // With any luck, all of these should be near $to_run.
+        $passed = 0;
+        for($i = 0; $i < $size; ++$i) {
+            $this->assertNotEquals($buff[$i], 0);
+        }
+        
+        // We can do statistical tests later to ensure the output is unbiased.
+    }
 }