Changeset 34981 for trunk/src/wp-includes/pluggable.php

Timestamp:

10/09/2015 04:27:41 AM (9 years ago)

Author:

dd32

Message:

Use PHP7's random_int() CSPRNG functionality in wp_rand() with a fallback to the random_compat library for PHP 5.x.
random_compat offers a set of compatible functions for older versions of PHP, filling in the gap by using other PHP extensions when available.
We still include our existing wp_rand() functionality as a fallback for when no proper CSPRNG exists on the system.

Take Two, this was previously committed in [34922] but had an issue on PHP 5.2 which sarciszewski has now resolved.

Props sarciszewski
See #28633

File:

• trunk/src/wp-includes/pluggable.php (modified) (3 diffs)

trunk/src/wp-includes/pluggable.php

@@ -2139 +2139 @@
  *
  * @since 2.6.2
+ * @since 4.4 Uses PHP7 random_int() or the random_compat library if avaialble.
  *
  * @global string $rnd_value
  * @staticvar string $seed
+ * @staticvar bool $external_rand_source_available
  *
  * @param int $min Lower limit for the generated number
@@ -2149 +2151 @@
 function wp_rand( $min = 0, $max = 0 ) {
     global $rnd_value;
+
+    // Some misconfigured 32bit environments (Entropy PHP, for example) truncate integers larger than PHP_INT_MAX to PHP_INT_MAX rather than overflowing them to floats.
+    $max_random_number = 3000000000 === 2147483647 ? (float) "4294967295" : 4294967295; // 4294967295 = 0xffffffff
+
+    // We only handle Ints, floats are truncated to their integer value.
+    $min = (int) $min;
+    $max = (int) $max;
+
+    // Use PHP's CSPRNG, or a compatible method
+    static $use_random_int_functionality = true;
+    if ( $use_random_int_functionality ) {
+        try {
+            $_max = ( 0 != $max ) ? $max : $max_random_number;
+            // wp_rand() can accept arguements in either order, PHP cannot.
+            $_max = max( $min, $_max );
+            $_min = min( $min, $_max );
+            $val = random_int( $_min, $_max );
+            if ( false !== $val ) {
+                return absint( $val );
+            } else {
+                $use_random_int_functionality = false;
+            }
+        } catch ( Throwable $t ) { 
+            $use_random_int_functionality = false;
+        } catch ( Exception $e ) {
+            $use_random_int_functionality = false;
+        }
+    }
 
     // Reset $rnd_value after 14 uses
@@ -2173 +2203 @@
 
     $value = abs(hexdec($value));
-
-    // Some misconfigured 32bit environments (Entropy PHP, for example) truncate integers larger than PHP_INT_MAX to PHP_INT_MAX rather than overflowing them to floats.
-    $max_random_number = 3000000000 === 2147483647 ? (float) "4294967295" : 4294967295; // 4294967295 = 0xffffffff
 
     // Reduce the value to be within the min - max range