tyler.durden/icingaweb2
1
0
Fork 0
mirror of https://github.com/Icinga/icingaweb2.git synced 2025-07-21 04:44:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

Require the OpenSSL module instead of providing an unsafe fallback

Browse Source 
refs #7163
This commit is contained in:
Johannes Meyer 2014-11-11 10:19:09 +01:00
parent 8909bd5d59
commit eb4672923f
2 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
library/Icinga/Authentication/Backend/DbUserBackend.php
View File

@ -144,12 +144,7 @@ class DbUserBackend extends UserBackend
*/ */
protected function generateSalt() protected function generateSalt()
{ {
if (function_exists('openssl_random_pseudo_bytes')) {
return openssl_random_pseudo_bytes(self::SALT_LENGTH); return openssl_random_pseudo_bytes(self::SALT_LENGTH);
} else {
// If you know a more secure way to generate a salt, do not hesitate to change this!
return substr(md5(mt_rand()), self::SALT_LENGTH);
}
} }
/** /**

9
modules/setup/library/Setup/WebWizard.php
View File

@ -407,6 +407,15 @@ class WebWizard extends Wizard implements SetupWizard
sprintf(mt('setup', 'You are running PHP on a %s system.'), Platform::getOperatingSystemName()) sprintf(mt('setup', 'You are running PHP on a %s system.'), Platform::getOperatingSystemName())
); );
$requirements->addMandatory(
mt('setup', 'PHP Module: OpenSSL'),
mt('setup', 'The PHP module for OpenSSL is required to generate cryptographically safe password salts.'),
Platform::extensionLoaded('openssl'),
Platform::extensionLoaded('openssl') ? mt('setup', 'The PHP module for OpenSSL is available.') : (
mt('setup', 'The PHP module for OpenSSL is missing.')
)
);
$requirements->addOptional( $requirements->addOptional(
mt('setup', 'PHP Module: JSON'), mt('setup', 'PHP Module: JSON'),
mt('setup', 'The JSON module for PHP is required for various export functionalities as well as APIs.'), mt('setup', 'The JSON module for PHP is required for various export functionalities as well as APIs.'),