generate truly random secret keys.

The plugin requires PHP7.3 and random_bytes is available in PHP7.0
WPManageNinja · Dec 18, 2023 · 93c0eb6 · 93c0eb6
1 parent 94cea3d
commit 93c0eb6
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/app/Helpers/Helper.php b/app/Helpers/Helper.php
@@ -4,6 +4,9 @@
 
 use FluentSnippets\App\Services\PhpValidator;
 
+use function bin2hex;
+use function random_bytes;
+
 class Helper
 {
     public static function getStorageDir()
@@ -47,14 +50,14 @@ public static function cacheSnippetIndex($fileName = '', $isForced = false, $ext
                     'remove_on_uninstall' => 'no',
                     'force_disabled'      => 'no',
                     'legacy_status'       => 'new',
-                    'secret_key'          => md5(wp_generate_uuid4() . time() . random_int(1000, 10000))
+                    'secret_key'          => bin2hex(random_bytes(16))
                 ],
                 'error_files' => []
             ];
         }
 
         if (empty($previousConfig['meta']['secret_key'])) {
-            $previousConfig['meta']['secret_key'] = md5(wp_generate_uuid4() . time() . random_int(1000, 10000));
+            $previousConfig['meta']['secret_key'] = bin2hex(random_bytes(16));
         }
 
         $data['meta'] = [