Changeset 36872

Timestamp:

03/07/2016 06:31:18 AM (11 years ago)

Author:

dd32

Message:

Setup config: Generate the default secret keys & salts from the local CSPRNG if available, falling back to the WordPress.org API and a backup psuedo random source.

Props diddledan.
Fixes #35290

File:

• trunk/src/wp-admin/setup-config.php (modified) (1 diff)

trunk/src/wp-admin/setup-config.php

@@ -277 +277 @@
                 wp_die( $wpdb->error->get_error_message() . $tryagain_link );
 
-        // Fetch or generate keys and salts.
-        $no_api = isset( $_POST['noapi'] );
-        if ( ! $no_api ) {
-                $secret_keys = wp_remote_get( 'https://api.wordpress.org/secret-key/1.1/salt/' );
-        }
-
-        if ( $no_api || is_wp_error( $secret_keys ) ) {
-                $secret_keys = array();
+        // Generate keys and salts using secure CSPRNG; fallback to API if enabled; further fallback to original wp_generate_password().
+        try {
+                $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_ []{}<>~`+=,.;:/?|';
+                $max = strlen($chars) - 1;
                 for ( $i = 0; $i < 8; $i++ ) {
-                        $secret_keys[] = wp_generate_password( 64, true, true );
-                }
-        } else {
-                $secret_keys = explode( "\n", wp_remote_retrieve_body( $secret_keys ) );
-                foreach ( $secret_keys as $k => $v ) {
-                        $secret_keys[$k] = substr( $v, 28, 64 );
+                        $key = '';
+                        for ( $j = 0; $j < 64; $j++ ) {
+                                $key .= substr( $chars, random_int( 0, $max ), 1 );
+                        }
+                        $secret_keys[] = $key;
+                }
+        } catch ( Exception $ex ) {
+                $no_api = isset( $_POST['noapi'] );
+
+                if ( ! $no_api ) {
+                        $secret_keys = wp_remote_get( 'https://api.wordpress.org/secret-key/1.1/salt/' );
+                }
+
+                if ( $no_api || is_wp_error( $secret_keys ) ) {
+                        $secret_keys = array();
+                        for ( $i = 0; $i < 8; $i++ ) {
+                                $secret_keys[] = wp_generate_password( 64, true, true );
+                        }
+                } else {
+                        $secret_keys = explode( "\n", wp_remote_retrieve_body( $secret_keys ) );
+                        foreach ( $secret_keys as $k => $v ) {
+                                $secret_keys[$k] = substr( $v, 28, 64 );
+                        }
                 }
         }