Use PHP7 function random_bytes() to generate tokens if available

2 files changed, 5 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index d48a18a5..87142bc4 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,6 +8,7 @@ New features:
 Improvements:
 
 * Improve error handling of plugins
+* Use PHP7 function random_bytes() to generate tokens if available
 
 Internal code refactoring:
 
diff --git a/app/Core/Security/Token.php b/app/Core/Security/Token.php
index 2bb66ef2..9fd2d02b 100644
--- a/app/Core/Security/Token.php
+++ b/app/Core/Security/Token.php
@@ -21,8 +21,10 @@ class Token extends Base
      */
     public static function getToken()
     {
-        if (function_exists('openssl_random_pseudo_bytes')) {
-            return bin2hex(\openssl_random_pseudo_bytes(30));
+        if (function_exists('random_bytes')) {
+            return bin2hex(random_bytes(30));
+        } elseif (function_exists('openssl_random_pseudo_bytes')) {
+            return bin2hex(openssl_random_pseudo_bytes(30));
         } elseif (ini_get('open_basedir') === '' && strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
             return hash('sha256', file_get_contents('/dev/urandom', false, null, 0, 30));
         }