MantisBT: master caf21ad4

Author Committer Branch Timestamp Parent
dhx dhx master 2012-05-05 19:38 master 3f0f3799
Affected Issues  0014087: Installation script doesn't set the crypto_master_salt causing errors
Changeset

Fix 0014087: Installation: create a cryptographically secure master salt

Commit 3f0f3799e65d8cc8752ac8d5dd27cbaceaaf1ec4 automatically generated
a value for $g_crypto_master_salt during installation based on a very
weak mechanism -- an MD5 hash of the current server time.

This commit correctly generates a 256bit cryptographically secure salt
instead, based on a much stronger source of randomness such as OpenSSL's
PRNG or /dev/urandom on Linux systems.

When a secure salt cannot be generated the user will need to manually
define $g_crypto_master_salt post installation.

Carriage return characters have also been removed from the default
generated config_inc.php file. These characters are redundant and do not
match the line termination standard used throughout MantisBT's code base.

mod - admin/install.php Diff File