MantisBT: master 17ff24f9

Author Committer Branch Timestamp Parent
Paul Richards Paul Richards master 2014-07-14 14:10 master e8f1057b
Changeset

Use crypto API as random number source to generate filenames

Whilst I can't really see anyone being able to do anything useful with this,
instead of using a seed (of time() + bug ID), which could be predicatable.

We instead use our complex random string routines that dhx added.

In addition, I've fixed the comment on file_generate_unique_name to state
it returns 32 characters and not 64 characters. I did consider whether to
fix the code to match the comment, but in this case, it would seem to be
likely to be less problematic to stick with the shorter string.

In addition, I've dropped the 'file_generate_name' function, in favour of
just having a single function to generate a unique name. Even the while()
loop in the generate_unique_name function seems somewhat excessive:
current downside: it's an extra DB query - given we could prepend the seed
(bugid), add an and the chances of md5() generating a collision is
probably fairly low.

mod - admin/move_attachments.php Diff File
mod - api/soap/mc_file_api.php Diff File
mod - core/file_api.php Diff File