Current function:
protected function generateRandomKey($len = 20)
{
$string = '';
$pool = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
for ($i = 1; $i <= $len; $i++)
{
$string .= substr($pool, rand(0, 61), 1);
}
return md5($string);
}
There are may issues with this random generator. The $string construction is using an extremely weak method; rand() is also not a good choice. md5() is known for its collisions.
Indeed, on a test database with 1500 Remember Me keys, we have about 40 keys assigned to multiple users (up to 3).
Here is my proposal of a much stronger generateRandomKey() function:
protected function generateRandomKey()
{
return base_convert(sha1(uniqid(mt_rand(), true)), 16, 36);
}
It will return a 31 character string using alphanumeric characters (base 36), thus it will fit in the 32 character limit which was used by the md5 (hexadecimal, base 16).
sfDoctrineGuardPlugin is also affected.
