use random_bytes() instead of custom function

1 files changed, 1 insertions, 56 deletions

diff --git a/lib/classes/CSRFProtection.php b/lib/classes/CSRFProtection.php
index 6bda658..4a99592 100644
--- a/lib/classes/CSRFProtection.php
+++ b/lib/classes/CSRFProtection.php
@@ -125,7 +125,7 @@ class CSRFProtection
 
         // create a token, if there is none
         if (!isset($_SESSION[self::TOKEN])) {
-            $_SESSION[self::TOKEN] = base64_encode(self::randomBytes(32));
+            $_SESSION[self::TOKEN] = base64_encode(random_bytes(32));
         }
 
         return $_SESSION[self::TOKEN];
@@ -149,59 +149,4 @@ class CSRFProtection
             self::token()
         );
     }
-
-
-    /**
-     * Returns a string of highly randomized bytes (over the full 8-bit range).
-     *
-     * This function is better than simply calling mt_rand() or any other
-     * built-in PHP function because it can return a long string of bytes
-     * (compared to < 4 bytes normally from mt_rand()) and uses the best
-     * available pseudo-random source.
-     *
-     * This function was copied from Drupal's includes/bootstrap.inc.
-     *
-     * @param integer $count The number of characters (bytes) to return in the string.
-     */
-    private static function randomBytes($count)
-    {
-        static $random_state, $bytes;
-
-        // Initialize on the first call. The contents of $_SERVER includes a mix of
-        // user-specific and system information that varies a little with each page.
-        if (!isset($random_state)) {
-            $random_state = print_r($_SERVER, TRUE);
-            if (function_exists('getmypid')) {
-                // Further initialize with the somewhat random PHP process ID.
-                $random_state .= getmypid();
-            }
-            $bytes = '';
-        }
-        if (mb_strlen($bytes) < $count) {
-            // /dev/urandom is available on many *nix systems and is considered the
-            // best commonly available pseudo-random source.
-            if ($fh = @fopen('/dev/urandom', 'rb')) {
-                // PHP only performs buffered reads, so in reality it will always read
-                // at least 4096 bytes. Thus, it costs nothing extra to read and store
-                // that much so as to speed any additional invocations.
-                $bytes .= fread($fh, max(4096, $count));
-                fclose($fh);
-            }
-            // If /dev/urandom is not available or returns no bytes, this loop will
-            // generate a good set of pseudo-random bytes on any system.
-            // Note that it may be important that our $random_state is passed
-            // through hash() prior to being rolled into $output, that the two hash()
-            // invocations are different, and that the extra input into the first one -
-            // the microtime() - is prepended rather than appended. This is to avoid
-            // directly leaking $random_state via the $output stream, which could
-            // allow for trivial prediction of further "random" numbers.
-            while (mb_strlen($bytes) < $count) {
-                $random_state = hash('sha256', microtime() . mt_rand() . $random_state);
-                $bytes .= hash('sha256', mt_rand() . $random_state, TRUE);
-            }
-        }
-        $output = mb_substr($bytes, 0, $count);
-        $bytes = mb_substr($bytes, $count);
-        return $output;
-    }
 }