[Xfce4-commits] [www/forum.xfce.org] 70/79: Update to fluxbb 1.5.3.

noreply at xfce.org noreply at xfce.org
Tue May 21 14:49:05 CEST 2019


This is an automated email from the git hooks/post-receive script.

s   k   u   n   n   y   k       p   u   s   h   e   d       a       c   o   m   m   i   t       t   o       b   r   a   n   c   h       o   l   d   f   o   r   u   m   
   in repository www/forum.xfce.org.

commit a6bb254ca6e0fbb627cf1b79f05245a54f6a38c6
Author: Nick Schermer <nick at xfce.org>
Date:   Fri Feb 22 15:43:27 2013 +0100

    Update to fluxbb 1.5.3.
---
 db_update.php         |   2 +-
 include/common.php    |   2 +-
 include/functions.php |  18 ++-----
 include/srand.php     | 145 ++++++++++++++++++++++++++++++++++++++++++++++++++
 install.php           |   2 +-
 profile.php           |   2 +-
 6 files changed, 154 insertions(+), 17 deletions(-)

diff --git a/db_update.php b/db_update.php
index c2c261b..9c3d3b3 100644
--- a/db_update.php
+++ b/db_update.php
@@ -7,7 +7,7 @@
  */
 
 // The FluxBB version this script updates to
-define('UPDATE_TO', '1.5.2');
+define('UPDATE_TO', '1.5.3');
 
 define('UPDATE_TO_DB_REVISION', 18);
 define('UPDATE_TO_SI_REVISION', 2);
diff --git a/include/common.php b/include/common.php
index 1a5b2ef..3196313 100644
--- a/include/common.php
+++ b/include/common.php
@@ -10,7 +10,7 @@ if (!defined('PUN_ROOT'))
 	exit('The constant PUN_ROOT must be defined and point to a valid FluxBB installation root directory.');
 
 // Define the version and database revision that this code was written for
-define('FORUM_VERSION', '1.5.2');
+define('FORUM_VERSION', '1.5.3');
 
 define('FORUM_DB_REVISION', 18);
 define('FORUM_SI_REVISION', 2);
diff --git a/include/functions.php b/include/functions.php
index e24336d..8ec3cdb 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -6,6 +6,8 @@
  * License: http://www.gnu.org/licenses/gpl.html GPL version 2 or higher
  */
 
+include PUN_ROOT.'include/srand.php';
+
 
 //
 // Return current timestamp (with microseconds) as a float
@@ -1007,22 +1009,12 @@ function forum_number_format($number, $decimals = 0)
 //
 function random_key($len, $readable = false, $hash = false)
 {
-	$key = '';
+	$key = secure_random_bytes($len);
 
 	if ($hash)
-		$key = substr(pun_hash(uniqid(rand(), true)), 0, $len);
+		$key = substr(bin2hex($key), 0, $len);
 	else if ($readable)
-	{
-		$chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
-
-		for ($i = 0; $i < $len; ++$i)
-			$key .= substr($chars, (mt_rand() % strlen($chars)), 1);
-	}
-	else
-	{
-		for ($i = 0; $i < $len; ++$i)
-			$key .= chr(mt_rand(33, 126));
-	}
+		$key = substr(base64_encode($key), 0, $len);
 
 	return $key;
 }
diff --git a/include/srand.php b/include/srand.php
new file mode 100644
index 0000000..8243e2e
--- /dev/null
+++ b/include/srand.php
@@ -0,0 +1,145 @@
+<?php
+
+/*
+ * Author:
+ * George Argyros <argyros.george at gmail.com>
+ *
+ * Copyright (c) 2012, George Argyros
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *    * Redistributions of source code must retain the above copyright
+ *      notice, this list of conditions and the following disclaimer.
+ *    * Redistributions in binary form must reproduce the above copyright
+ *      notice, this list of conditions and the following disclaimer in the
+ *      documentation and/or other materials provided with the distribution.
+ *    * Neither the name of the <organization> nor the
+ *      names of its contributors may be used to endorse or promote products
+ *      derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL GEORGE ARGYROS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *
+ *
+ * The function is providing, at least at the systems tested :), 
+ * $len bytes of entropy under any PHP installation or operating system.
+ * The execution time should be at most 10-20 ms in any system.
+ */
+function secure_random_bytes($len = 10)
+{  
+ 
+   /*
+    * Our primary choice for a cryptographic strong randomness function is
+    * openssl_random_pseudo_bytes. 
+    */
+   $SSLstr = '4'; // http://xkcd.com/221/
+   if (function_exists('openssl_random_pseudo_bytes') && 
+       (version_compare(PHP_VERSION, '5.3.4') >= 0 || 
+	substr(PHP_OS, 0, 3) !== 'WIN'))
+   {
+      $SSLstr = openssl_random_pseudo_bytes($len, $strong);
+      if ($strong)
+         return $SSLstr;
+   }
+
+   /*
+    * If mcrypt extension is available then we use it to gather entropy from 
+    * the operating system's PRNG. This is better than reading /dev/urandom 
+    * directly since it avoids reading larger blocks of data than needed. 
+    * Older versions of mcrypt_create_iv may be broken or take too much time 
+    * to finish so we only use this function with PHP 5.3 and above.
+    */
+   if (function_exists('mcrypt_create_iv') && 
+      (version_compare(PHP_VERSION, '5.3.0') >= 0 || 
+       substr(PHP_OS, 0, 3) !== 'WIN')) 
+   {
+      $str = mcrypt_create_iv($len, MCRYPT_DEV_URANDOM);
+      if ($str !== false)
+         return $str;	
+   }
+
+
+   /*
+    * No build-in crypto randomness function found. We collect any entropy 
+    * available in the PHP core PRNGs along with some filesystem info and memory
+    * stats. To make this data cryptographically strong we add data either from 
+    * /dev/urandom or if its unavailable, we gather entropy by measuring the 
+    * time needed to compute a number of SHA-1 hashes. 
+    */
+   $str = '';
+   $bits_per_round = 2; // bits of entropy collected in each clock drift round
+   $msec_per_round = 400; // expected running time of each round in microseconds
+   $hash_len = 20; // SHA-1 Hash length
+   $total = $len; // total bytes of entropy to collect
+
+   $handle = @fopen('/dev/urandom', 'rb');   
+   if ($handle && function_exists('stream_set_read_buffer'))
+      @stream_set_read_buffer($handle, 0);
+
+   do
+   {
+      $bytes = ($total > $hash_len)? $hash_len : $total;
+      $total -= $bytes;
+
+      //collect any entropy available from the PHP system and filesystem
+      $entropy = rand() . uniqid(mt_rand(), true) . $SSLstr;
+      $entropy .= implode('', @fstat(@fopen( __FILE__, 'r')));
+      $entropy .= memory_get_usage();
+      if ($handle) 
+      {
+         $entropy .= @fread($handle, $bytes);
+      }
+      else
+      {	           	
+         // Measure the time that the operations will take on average
+         for ($i = 0; $i < 3; $i ++) 
+         {
+            $c1 = microtime(true);
+            $var = sha1(mt_rand());
+            for ($j = 0; $j < 50; $j++)
+            {
+               $var = sha1($var);
+            }
+            $c2 = microtime(true);
+    	    $entropy .= $c1 . $c2;
+         }
+
+         // Based on the above measurement determine the total rounds
+         // in order to bound the total running time.	
+         $rounds = (int)($msec_per_round*50 / (int)(($c2-$c1)*1000000));
+
+         // Take the additional measurements. On average we can expect
+         // at least $bits_per_round bits of entropy from each measurement.
+         $iter = $bytes*(int)(ceil(8 / $bits_per_round));
+         for ($i = 0; $i < $iter; $i ++)
+         {
+            $c1 = microtime();
+            $var = sha1(mt_rand());
+            for ($j = 0; $j < $rounds; $j++)
+            {
+               $var = sha1($var);
+            }
+            $c2 = microtime();
+            $entropy .= $c1 . $c2;
+         }
+            
+      } 
+      // We assume sha1 is a deterministic extractor for the $entropy variable.
+      $str .= sha1($entropy, true);
+   } while ($len > strlen($str));
+   
+   if ($handle) 
+      @fclose($handle);
+   
+   return substr($str, 0, $len);
+}
\ No newline at end of file
diff --git a/install.php b/install.php
index 0934a8c..0a459c3 100644
--- a/install.php
+++ b/install.php
@@ -7,7 +7,7 @@
  */
 
 // The FluxBB version this script installs
-define('FORUM_VERSION', '1.5.2');
+define('FORUM_VERSION', '1.5.3');
 
 define('FORUM_DB_REVISION', 18);
 define('FORUM_SI_REVISION', 2);
diff --git a/profile.php b/profile.php
index a666bed..5573126 100644
--- a/profile.php
+++ b/profile.php
@@ -1791,7 +1791,7 @@ else
 						if ($cur_category != 0)
 							echo "\n\t\t\t\t\t\t\t".'</div>'."\n";
 
-						echo "\t\t\t\t\t\t\t".'<div class="conl">'."\n\t\t\t\t\t\t\t\t".'<p><strong>'.$cur_forum['cat_name'].'</strong></p>'."\n\t\t\t\t\t\t\t\t".'<div class="rbox">';
+						echo "\t\t\t\t\t\t\t".'<div class="conl">'."\n\t\t\t\t\t\t\t\t".'<p><strong>'.pun_htmlspecialchars($cur_forum['cat_name']).'</strong></p>'."\n\t\t\t\t\t\t\t\t".'<div class="rbox">';
 						$cur_category = $cur_forum['cid'];
 					}
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the Xfce4-commits mailing list