Ticket #44032: setup-config.php.diff

setup-config.php

@@ -294 +294 @@
 
         // Generate keys and salts using secure CSPRNG; fallback to API if enabled; further fallback to original wp_generate_password().
         try {
-                $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_ []{}<>~`+=,.;:/?|';
-                $max = strlen($chars) - 1;
                 for ( $i = 0; $i < 8; $i++ ) {
-                        $key = '';
-                        for ( $j = 0; $j < 64; $j++ ) {
-                                $key .= substr( $chars, random_int( 0, $max ), 1 );
-                        }
-                        $secret_keys[] = $key;
+                        $raw = random_bytes(64);
+                        $secret_keys[] = base64_encode($raw);
                 }
         } catch ( Exception $ex ) {
                 $no_api = isset( $_POST['noapi'] );