#47378 [Opn->Asn]: Potential for total failure of uniqid() should be documented
ID: 47378
Updated by: bjori@php.net
Reported By: tstarling at wikimedia dot org
-Status: Open
+Status: Assigned
Bug Type: Documentation problem
Operating System: Cygwin
PHP Version: Irrelevant
Assigned To: preinheimer
New Comment:
Whats the status on this?
Previous Comments:
------------------------------------------------------------------------
[2009-02-18 17:22:22] preinheimer@php.net
Hi,
I expect to be able to push my changes into CVS this afternoon, I will
add a note indicating that on Cygwin based systems more_entropy in fact
defaults to TRUE (or on), and that it must either default to on, or
explicitly be enabled to work properly.
In order for the problem you've identified to occcur the user must be
explicitly declining the more entropy option. Also, they have to be
using Cygwin, which was a huge pain in the rear end to get going, but
that's neither here nor there.
thanks again for this submission
paul
------------------------------------------------------------------------
[2009-02-17 21:08:12] preinheimer@php.net
Hi,
Just to give you an update I am working on replicating the situation in
a Cygwin environment (somewhere into the third hour of waiting for this
to all build inside a Cygwin instance, within windows, running in a VM).
I'd like to see this actually happen on the off chance there's another
code branch elsewhere coming into play.
I'll also be taking this opportunity to update a few of the other notes
on the Uniqid page, thank you for bringing this to our attention.
paul
------------------------------------------------------------------------
[2009-02-13 03:58:34] tstarling at wikimedia dot org
Description:
------------
The source code indicates that uniqid() may completely fail on Cygwin
and return false:
#if HAVE_USLEEP && !defined(PHP_WIN32)
if (!more_entropy) {
#if defined(__CYGWIN__)
php_error_docref(NULL TSRMLS_CC, E_WARNING, "You must use 'more
entropy' under CYGWIN");
RETURN_FALSE;
#else
usleep(1);
#endif
}
#endif
This needs to be documented so that unsuspecting web apps don't become
insecure when run on this platform, e.g. giving everyone the same
default password.
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=47378&edit=1
Thread (5 messages)