Lukas Reschke bc6d17ed74 Add check for availability of /dev/urandom ... Without /dev/urandom being available to read the medium RNG will rely only on the following components on a Linux system: 1. MicroTime: microtime() . memory_get_usage() as seed and then a garbage collected microtime for loop 2. MTRand: chr((mt_rand() ^ mt_rand()) % 256) 3. Rand: chr((rand() ^ rand()) % 256) 4. UniqId: Plain uniqid() An adversary with the possibility to predict the seed used by the PHP process may thus be able to predict future tokens which is an unwanted behaviour. One should note that this behaviour is documented in our documentation to ensure that users get aware of this even without reading our documentation this will add a post setup check to the administrative interface. Thanks to David Black from d1b.org for bringing this again to our attention.		2015-05-26 14:16:07 +02:00
..
controller	Add check for availability of /dev/urandom	2015-05-26 14:16:07 +02:00
middleware	Use 403 instead of 200 response	2015-01-29 12:04:54 +01:00