From: Kevin Israel <pleasestand@live.com>
Date: Mon, 29 Apr 2013 04:33:06 +0000 (-0400)
Subject: wfRandomString: Correct bias toward digits 1-7
X-Git-Tag: 1.31.0-rc.0~19834^2
X-Git-Url: https://git.cyclocoop.org/%28%28?a=commitdiff_plain;h=34d49b33a597c23fde84078b6f9d0634cccb99a8;p=lhc%2Fweb%2Fwiklou.git

wfRandomString: Correct bias toward digits 1-7

Two problems with a single line of code:

* dechex() does not include leading zeros, so the first digit
  generated in each iteration cannot be zero unless the return
  value of mt_rand() is 0.

  This also means wfRandomString() is extremely unlikely to
  start a string with '0'.

* mt_rand() does not actually uniformly distribute values over
  [0,2^32-1]; it actually right-shifts one of the bits off (just
  because "[...] the previous php_rand only returns 31 at most"),
  so the maximum value is 0x7fffffff, not 0xffffffff.

  This means wfRandomString() will never start a string with
  any of the digits 8-f.

Including leading zeros and using only the 28 LSBs to form seven
hex digits at a time is the simplest fix.

Change-Id: Ic19b5b97c582485780b24fd35ffef2111cc8b3ca
---

diff --git a/RELEASE-NOTES-1.22 b/RELEASE-NOTES-1.22
index ec424d31ac..f0ec6bbc35 100644
--- a/RELEASE-NOTES-1.22
+++ b/RELEASE-NOTES-1.22
@@ -63,6 +63,8 @@ production.
 * (bug 46768) Usernames of blocking users now display correctly, even if numeric.
 * (bug 39590) {{PAGESIZE}} for the current page and self-transclusions now
   show the most up to date result always instead of being a revision behind.
+* A bias in wfRandomString() toward digits 1-7 has been corrected. Generated
+  strings now can start with digits 0 and 8-f.
 
 === API changes in 1.22 ===
 * (bug 46626) xmldoublequote parameter was removed. Because of a bug, the
diff --git a/includes/GlobalFunctions.php b/includes/GlobalFunctions.php
index 50287b32c4..43caf7a7a4 100644
--- a/includes/GlobalFunctions.php
+++ b/includes/GlobalFunctions.php
@@ -322,8 +322,8 @@ function wfRandom() {
  */
 function wfRandomString( $length = 32 ) {
 	$str = '';
-	while ( strlen( $str ) < $length ) {
-		$str .= dechex( mt_rand() );
+	for ( $n = 0; $n < $length; $n += 7 ) {
+		$str .= sprintf( '%07x', mt_rand() & 0xfffffff );
 	}
 	return substr( $str, 0, $length );
 }