moved the secure random class from JMSSecurityExtraBundle to Symfony (closes #3595)

1 files changed, 10 insertions, 25 deletions

diff --git a/Http/RememberMe/PersistentTokenBasedRememberMeServices.php b/Http/RememberMe/PersistentTokenBasedRememberMeServices.php
index 8944672..d36eb01 100644
--- a/Http/RememberMe/PersistentTokenBasedRememberMeServices.php
+++ b/Http/RememberMe/PersistentTokenBasedRememberMeServices.php
@@ -19,6 +19,7 @@ use Symfony\Component\Security\Core\Exception\AuthenticationException;
 use Symfony\Component\Security\Core\Exception\CookieTheftException;
 use Symfony\Component\Security\Core\Authentication\RememberMe\PersistentToken;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Util\Prng;
 
 /**
  * Concrete implementation of the RememberMeServicesInterface which needs
@@ -30,6 +31,12 @@ use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 class PersistentTokenBasedRememberMeServices extends AbstractRememberMeServices
 {
     private $tokenProvider;
+    private $prng;
+
+    public function setPrng(Prng $prng)
+    {
+        $this->prng = $prng;
+    }
 
     /**
      * Sets the token provider
@@ -79,7 +86,7 @@ class PersistentTokenBasedRememberMeServices extends AbstractRememberMeServices
         }
 
         $series = $persistentToken->getSeries();
-        $tokenValue = $this->generateRandomValue();
+        $tokenValue = $this->prng->nextBytes(64);
         $this->tokenProvider->updateToken($series, $tokenValue, new \DateTime());
         $request->attributes->set(self::COOKIE_ATTR_NAME,
             new Cookie(
@@ -101,8 +108,8 @@ class PersistentTokenBasedRememberMeServices extends AbstractRememberMeServices
      */
     protected function onLoginSuccess(Request $request, Response $response, TokenInterface $token)
     {
-        $series = $this->generateRandomValue();
-        $tokenValue = $this->generateRandomValue();
+        $series = $this->prng->nextBytes(64);
+        $tokenValue = $this->prng->nextBytes(64);
 
         $this->tokenProvider->createNewToken(
             new PersistentToken(
@@ -126,26 +133,4 @@ class PersistentTokenBasedRememberMeServices extends AbstractRememberMeServices
             )
         );
     }
-
-    /**
-     * Generates a cryptographically strong random value
-     *
-     * @return string
-     */
-    protected function generateRandomValue()
-    {
-        if (function_exists('openssl_random_pseudo_bytes')) {
-            $bytes = openssl_random_pseudo_bytes(64, $strong);
-
-            if (true === $strong && false !== $bytes) {
-                return base64_encode($bytes);
-            }
-        }
-
-        if (null !== $this->logger) {
-            $this->logger->warn('Could not produce a cryptographically strong random value. Please install/update the OpenSSL extension.');
-        }
-
-        return base64_encode(hash('sha512', uniqid(mt_rand(), true), true));
-    }
 }