I was trying to figure out how authcode is generated for new accounts, and it seems to use the insecure mt_rand() function to generate secure tokens.
From system/ee/ExpressionEngine/Addons/member/mod.member_register.php:
// We generate an authorization code if the member needs to self-activate
if (ee()->config->item('req_mbr_activation') == 'email')
{
$data['authcode'] = ee()->functions->random('alnum', 10);
}I'm pretty sure that comes from system/ee/legacy/libraries/Functions.php:
public function random($type = 'encrypt', $len = 8)
{
return random_string($type, $len);
}Which probably comes from system/ee/legacy/helpers/string_helper.php:
function random_string($type = 'alnum', $len = 8, $antipool = '')
{
switch($type)
{
[...]
case 'alnum' :
[...]
case 'alnum' : $pool = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
break;
[...]
$str .= substr($pool, mt_rand(0, strlen($pool) -1), 1);And mt_rand() isn't designed for secure strings.. from PHP's site (https://www.php.net/manual/en/function.mt-rand.php):
This function does not generate cryptographically secure values, and should not be used for cryptographic purposes. If you need a cryptographically secure value, consider using random_int(), random_bytes(), or openssl_random_pseudo_bytes() instead.
Cheers!
I was trying to figure out how
authcodeis generated for new accounts, and it seems to use the insecure mt_rand() function to generate secure tokens.From system/ee/ExpressionEngine/Addons/member/mod.member_register.php:
I'm pretty sure that comes from system/ee/legacy/libraries/Functions.php:
Which probably comes from system/ee/legacy/helpers/string_helper.php:
And mt_rand() isn't designed for secure strings.. from PHP's site (https://www.php.net/manual/en/function.mt-rand.php):
Cheers!