#50943 [NEW]: rand/mt_rand not seeded for every request

From: maarten-baert at hotmail dot com Operating system: Linux PHP version: Irrelevant PHP Bug Type: Documentation problem Bug description: rand/mt_rand not seeded for every request Description: ------------ Rand/mt_rand is not seeded automatically for every request: if I use srand/mt_srand the results of rand/mt_rand in future requests (even in other scripts) are also affected. The server uses PHP Version 5.2.4-2ubuntu5.9, I can't update it so I'm not sure whether this has been fixed in future versions. I can't reproduce this on my own computer (using CLI). Maybe this isn't a bug, but the documentation claims the random number generator is seeded automatically, so if anyone uses rand/mt_rand to generate tokens, captchas (like me), or any other kind of security-related random data, an attacker could use this to get the same data every time. Reproduce code: --------------- <?php echo rand(1,1000); srand(5); // OR echo mt_rand(1,1000); mt_srand(5); ?> Expected result: ---------------- I expected to see a random number every time I refresh the page. Actual result: -------------- The first time I get a random number, but after that I always get 275 (rand) or 775 (mt_rand). -- Edit bug report at http://bugs.php.net/?id=50943&edit=1 -- Try a snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=50943&r=trysnapshot52 Try a snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=50943&r=trysnapshot53 Try a snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=50943&r=trysnapshot60 Fixed in SVN: http://bugs.php.net/fix.php?id=50943&r=fixed Fixed in SVN and need be documented: http://bugs.php.net/fix.php?id=50943&r=needdocs Fixed in release: http://bugs.php.net/fix.php?id=50943&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=50943&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=50943&r=needscript Try newer version: http://bugs.php.net/fix.php?id=50943&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=50943&r=support Expected behavior: http://bugs.php.net/fix.php?id=50943&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=50943&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=50943&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=50943&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=50943&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=50943&r=dst IIS Stability: http://bugs.php.net/fix.php?id=50943&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=50943&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=50943&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=50943&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=50943&r=mysqlcfg