<?php

[0] Fix | Delete

/**

[1] Fix | Delete

* Random_* Compatibility Library

[2] Fix | Delete

* for using the new PHP 7 random_* API in PHP 5 projects

[3] Fix | Delete

*

[4] Fix | Delete

* @version 2.0.10

[5] Fix | Delete

* @released 2017-03-13

[6] Fix | Delete

*

[7] Fix | Delete

* The MIT License (MIT)

[8] Fix | Delete

*

[9] Fix | Delete

* Copyright (c) 2015 - 2017 Paragon Initiative Enterprises

[10] Fix | Delete

*

[11] Fix | Delete

* Permission is hereby granted, free of charge, to any person obtaining a copy

[12] Fix | Delete

* of this software and associated documentation files (the "Software"), to deal

[13] Fix | Delete

* in the Software without restriction, including without limitation the rights

[14] Fix | Delete

* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

[15] Fix | Delete

* copies of the Software, and to permit persons to whom the Software is

[16] Fix | Delete

* furnished to do so, subject to the following conditions:

[17] Fix | Delete

*

[18] Fix | Delete

* The above copyright notice and this permission notice shall be included in

[19] Fix | Delete

* all copies or substantial portions of the Software.

[20] Fix | Delete

*

[21] Fix | Delete

* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

[22] Fix | Delete

* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

[23] Fix | Delete

* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

[24] Fix | Delete

* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

[25] Fix | Delete

* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

[26] Fix | Delete

* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

[27] Fix | Delete

* SOFTWARE.

[28] Fix | Delete

*/

[29] Fix | Delete

[30] Fix | Delete

if (!defined('PHP_VERSION_ID')) {

[31] Fix | Delete

// This constant was introduced in PHP 5.2.7

[32] Fix | Delete

$RandomCompatversion = array_map('intval', explode('.', PHP_VERSION));

[33] Fix | Delete

define(

[34] Fix | Delete

'PHP_VERSION_ID',

[35] Fix | Delete

$RandomCompatversion[0] * 10000

[36] Fix | Delete

+ $RandomCompatversion[1] * 100

[37] Fix | Delete

+ $RandomCompatversion[2]

[38] Fix | Delete

);

[39] Fix | Delete

$RandomCompatversion = null;

[40] Fix | Delete

}

[41] Fix | Delete

[42] Fix | Delete

/**

[43] Fix | Delete

* PHP 7.0.0 and newer have these functions natively.

[44] Fix | Delete

*/

[45] Fix | Delete

if (PHP_VERSION_ID >= 70000) {

[46] Fix | Delete

return;

[47] Fix | Delete

}

[48] Fix | Delete

[49] Fix | Delete

if (!defined('RANDOM_COMPAT_READ_BUFFER')) {

[50] Fix | Delete

define('RANDOM_COMPAT_READ_BUFFER', 8);

[51] Fix | Delete

}

[52] Fix | Delete

[53] Fix | Delete

$RandomCompatDIR = dirname(__FILE__);

[54] Fix | Delete

[55] Fix | Delete

require_once $RandomCompatDIR . '/byte_safe_strings.php';

[56] Fix | Delete

require_once $RandomCompatDIR . '/cast_to_int.php';

[57] Fix | Delete

require_once $RandomCompatDIR . '/error_polyfill.php';

[58] Fix | Delete

[59] Fix | Delete

if (!is_callable('random_bytes')) {

[60] Fix | Delete

/**

[61] Fix | Delete

* PHP 5.2.0 - 5.6.x way to implement random_bytes()

[62] Fix | Delete

*

[63] Fix | Delete

* We use conditional statements here to define the function in accordance

[64] Fix | Delete

* to the operating environment. It's a micro-optimization.

[65] Fix | Delete

*

[66] Fix | Delete

* In order of preference:

[67] Fix | Delete

* 1. Use libsodium if available.

[68] Fix | Delete

* 2. fread() /dev/urandom if available (never on Windows)

[69] Fix | Delete

* 3. mcrypt_create_iv($bytes, MCRYPT_DEV_URANDOM)

[70] Fix | Delete

* 4. COM('CAPICOM.Utilities.1')->GetRandom()

[71] Fix | Delete

*

[72] Fix | Delete

* See RATIONALE.md for our reasoning behind this particular order

[73] Fix | Delete

*/

[74] Fix | Delete

if (extension_loaded('libsodium')) {

[75] Fix | Delete

// See random_bytes_libsodium.php

[76] Fix | Delete

if (PHP_VERSION_ID >= 50300 && is_callable('\\Sodium\\randombytes_buf')) {

[77] Fix | Delete

require_once $RandomCompatDIR . '/random_bytes_libsodium.php';

[78] Fix | Delete

} elseif (method_exists('Sodium', 'randombytes_buf')) {

[79] Fix | Delete

require_once $RandomCompatDIR . '/random_bytes_libsodium_legacy.php';

[80] Fix | Delete

}

[81] Fix | Delete

}

[82] Fix | Delete

[83] Fix | Delete

/**

[84] Fix | Delete

* Reading directly from /dev/urandom:

[85] Fix | Delete

*/

[86] Fix | Delete

if (DIRECTORY_SEPARATOR === '/') {

[87] Fix | Delete

// DIRECTORY_SEPARATOR === '/' on Unix-like OSes -- this is a fast

[88] Fix | Delete

// way to exclude Windows.

[89] Fix | Delete

$RandomCompatUrandom = true;

[90] Fix | Delete

$RandomCompat_basedir = ini_get('open_basedir');

[91] Fix | Delete

[92] Fix | Delete

if (!empty($RandomCompat_basedir)) {

[93] Fix | Delete

$RandomCompat_open_basedir = explode(

[94] Fix | Delete

PATH_SEPARATOR,

[95] Fix | Delete

strtolower($RandomCompat_basedir)

[96] Fix | Delete

);

[97] Fix | Delete

$RandomCompatUrandom = (array() !== array_intersect(

[98] Fix | Delete

array('/dev', '/dev/', '/dev/urandom'),

[99] Fix | Delete

$RandomCompat_open_basedir

[100] Fix | Delete

));

[101] Fix | Delete

$RandomCompat_open_basedir = null;

[102] Fix | Delete

}

[103] Fix | Delete

[104] Fix | Delete

if (

[105] Fix | Delete

!is_callable('random_bytes')

[106] Fix | Delete

&&

[107] Fix | Delete

$RandomCompatUrandom

[108] Fix | Delete

&&

[109] Fix | Delete

@is_readable('/dev/urandom')

[110] Fix | Delete

) {

[111] Fix | Delete

// Error suppression on is_readable() in case of an open_basedir

[112] Fix | Delete

// or safe_mode failure. All we care about is whether or not we

[113] Fix | Delete

// can read it at this point. If the PHP environment is going to

[114] Fix | Delete

// panic over trying to see if the file can be read in the first

[115] Fix | Delete

// place, that is not helpful to us here.

[116] Fix | Delete

[117] Fix | Delete

// See random_bytes_dev_urandom.php

[118] Fix | Delete

require_once $RandomCompatDIR . '/random_bytes_dev_urandom.php';

[119] Fix | Delete

}

[120] Fix | Delete

// Unset variables after use

[121] Fix | Delete

$RandomCompat_basedir = null;

[122] Fix | Delete

} else {

[123] Fix | Delete

$RandomCompatUrandom = false;

[124] Fix | Delete

}

[125] Fix | Delete

[126] Fix | Delete

/**

[127] Fix | Delete

* mcrypt_create_iv()

[128] Fix | Delete

*

[129] Fix | Delete

* We only want to use mcypt_create_iv() if:

[130] Fix | Delete

*

[131] Fix | Delete

* - random_bytes() hasn't already been defined

[132] Fix | Delete

* - the mcrypt extensions is loaded

[133] Fix | Delete

* - One of these two conditions is true:

[134] Fix | Delete

* - We're on Windows (DIRECTORY_SEPARATOR !== '/')

[135] Fix | Delete

* - We're not on Windows and /dev/urandom is readabale

[136] Fix | Delete

* (i.e. we're not in a chroot jail)

[137] Fix | Delete

* - Special case:

[138] Fix | Delete

* - If we're not on Windows, but the PHP version is between

[139] Fix | Delete

* 5.6.10 and 5.6.12, we don't want to use mcrypt. It will

[140] Fix | Delete

* hang indefinitely. This is bad.

[141] Fix | Delete

* - If we're on Windows, we want to use PHP >= 5.3.7 or else

[142] Fix | Delete

* we get insufficient entropy errors.

[143] Fix | Delete

*/

[144] Fix | Delete

if (

[145] Fix | Delete

!is_callable('random_bytes')

[146] Fix | Delete

&&

[147] Fix | Delete

// Windows on PHP < 5.3.7 is broken, but non-Windows is not known to be.

[148] Fix | Delete

(DIRECTORY_SEPARATOR === '/' || PHP_VERSION_ID >= 50307)

[149] Fix | Delete

&&

[150] Fix | Delete

// Prevent this code from hanging indefinitely on non-Windows;

[151] Fix | Delete

// see https://bugs.php.net/bug.php?id=69833

[152] Fix | Delete

(

[153] Fix | Delete

DIRECTORY_SEPARATOR !== '/' ||

[154] Fix | Delete

(PHP_VERSION_ID <= 50609 || PHP_VERSION_ID >= 50613)

[155] Fix | Delete

)

[156] Fix | Delete

&&

[157] Fix | Delete

extension_loaded('mcrypt')

[158] Fix | Delete

) {

[159] Fix | Delete

// See random_bytes_mcrypt.php

[160] Fix | Delete

require_once $RandomCompatDIR . '/random_bytes_mcrypt.php';

[161] Fix | Delete

}

[162] Fix | Delete

$RandomCompatUrandom = null;

[163] Fix | Delete

[164] Fix | Delete

/**

[165] Fix | Delete

* This is a Windows-specific fallback, for when the mcrypt extension

[166] Fix | Delete

* isn't loaded.

[167] Fix | Delete

*/

[168] Fix | Delete

if (

[169] Fix | Delete

!is_callable('random_bytes')

[170] Fix | Delete

&&

[171] Fix | Delete

extension_loaded('com_dotnet')

[172] Fix | Delete

&&

[173] Fix | Delete

class_exists('COM')

[174] Fix | Delete

) {

[175] Fix | Delete

$RandomCompat_disabled_classes = preg_split(

[176] Fix | Delete

'#\s*,\s*#',

[177] Fix | Delete

strtolower(ini_get('disable_classes'))

[178] Fix | Delete

);

[179] Fix | Delete

[180] Fix | Delete

if (!in_array('com', $RandomCompat_disabled_classes)) {

[181] Fix | Delete

try {

[182] Fix | Delete

$RandomCompatCOMtest = new COM('CAPICOM.Utilities.1');

[183] Fix | Delete

if (method_exists($RandomCompatCOMtest, 'GetRandom')) {

[184] Fix | Delete

// See random_bytes_com_dotnet.php

[185] Fix | Delete

require_once $RandomCompatDIR . '/random_bytes_com_dotnet.php';

[186] Fix | Delete

}

[187] Fix | Delete

} catch (com_exception $e) {

[188] Fix | Delete

// Don't try to use it.

[189] Fix | Delete

}

[190] Fix | Delete

}

[191] Fix | Delete

$RandomCompat_disabled_classes = null;

[192] Fix | Delete

$RandomCompatCOMtest = null;

[193] Fix | Delete

}

[194] Fix | Delete

[195] Fix | Delete

/**

[196] Fix | Delete

* throw new Exception

[197] Fix | Delete

*/

[198] Fix | Delete

if (!is_callable('random_bytes')) {

[199] Fix | Delete

/**

[200] Fix | Delete

* We don't have any more options, so let's throw an exception right now

[201] Fix | Delete

* and hope the developer won't let it fail silently.

[202] Fix | Delete

*

[203] Fix | Delete

* @param mixed $length

[204] Fix | Delete

* @return void

[205] Fix | Delete

* @throws Exception

[206] Fix | Delete

*/

[207] Fix | Delete

function random_bytes($length)

[208] Fix | Delete

{

[209] Fix | Delete

unset($length); // Suppress "variable not used" warnings.

[210] Fix | Delete

throw new Exception(

[211] Fix | Delete

'There is no suitable CSPRNG installed on your system'

[212] Fix | Delete

);

[213] Fix | Delete

}

[214] Fix | Delete

}

[215] Fix | Delete

}

[216] Fix | Delete

[217] Fix | Delete

if (!is_callable('random_int')) {

[218] Fix | Delete

require_once $RandomCompatDIR . '/random_int.php';

[219] Fix | Delete

}

[220] Fix | Delete

[221] Fix | Delete

$RandomCompatDIR = null;

[222] Fix | Delete

[223] Fix | Delete