search

cabservicesag / powermail_optin

http://typo3.org/extensions/repository/view/powermail_optin
0 stars 1 forks source link

random string generator security issue #1

Closed wingsuitist closed 9 years ago

wingsuitist commented 9 years ago

Use better random string generator as it was reported in security bulletin and forge.typo3.org issue: https://forge.typo3.org/issues/31557 https://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-017/

wingsuitist commented 9 years ago

php -a Interactive shell

php > class tslib_pibase{function test() { echo 'test'; }}; php > require_once('class.tx_powermail_optin_div.php'); php > ini_set('memory_limit', '2000M'); php > for($i=0; $i<1000000; $i++) { $rand = tx_powermail_optin_div::simpleRandString(); php { if(!empty($check[$rand])) { echo 'already exists'.$rand; } else {$check[$rand]=1;}} php > echo count($check);