diff --git a/application/Espo/Core/DataManager.php b/application/Espo/Core/DataManager.php index cf482f8d7b..cad516b815 100644 --- a/application/Espo/Core/DataManager.php +++ b/application/Espo/Core/DataManager.php @@ -219,7 +219,7 @@ class DataManager $cryptKey = $config->get('cryptKey'); if (!$cryptKey) { - $cryptKey = \Espo\Core\Utils\Util::generateKey(); + $cryptKey = \Espo\Core\Utils\Util::generateSecretKey(); $config->set('cryptKey', $cryptKey); } diff --git a/application/Espo/Core/Utils/Crypt.php b/application/Espo/Core/Utils/Crypt.php index 1f3cfd7bfd..2e92e91d7c 100644 --- a/application/Espo/Core/Utils/Crypt.php +++ b/application/Espo/Core/Utils/Crypt.php @@ -97,6 +97,6 @@ class Crypt public function generateKey() { - return \Espo\Core\Utils\Util::generateKey(); + return \Espo\Core\Utils\Util::generateSecretKey(); } } diff --git a/application/Espo/Core/Utils/Util.php b/application/Espo/Core/Utils/Util.php index 32061eb603..151999afca 100644 --- a/application/Espo/Core/Utils/Util.php +++ b/application/Espo/Core/Utils/Util.php @@ -555,28 +555,35 @@ class Util return true; } - public static function generateId() + public static function generateId() : string { return uniqid() . substr(md5(rand()), 0, 4); } - public static function generateApiKey() + public static function generateMoreEntropyId() : string + { + return substr(md5(uniqid(rand(), true)), 0, 16) . substr(md5(rand()), 0, 4); + } + + public static function generateCryptId() : string { if (!function_exists('random_bytes')) { - return self::generateId(); + return self::generateMoreEntropyId(); } return bin2hex(random_bytes(16)); } - public static function generateSecretKey() + public static function generateApiKey() : string { - if (!function_exists('random_bytes')) { - return self::generateId(); - } - return bin2hex(random_bytes(16)); + return self::generateCryptId(); } - public static function generateKey() + public static function generateSecretKey() : string + { + return self::generateCryptId(); + } + + public static function generateKey() : string { return md5(uniqid(rand(), true)); } diff --git a/application/Espo/Entities/UniqueId.php b/application/Espo/Entities/UniqueId.php index 2d88bacf38..7ed1ee8e7b 100644 --- a/application/Espo/Entities/UniqueId.php +++ b/application/Espo/Entities/UniqueId.php @@ -31,6 +31,8 @@ namespace Espo\Entities; class UniqueId extends \Espo\Core\ORM\Entity { - + public function getIdValue() : ?string + { + return $this->get('name'); + } } - diff --git a/application/Espo/Repositories/UniqueId.php b/application/Espo/Repositories/UniqueId.php index 8735b7e1f6..1892683ebc 100644 --- a/application/Espo/Repositories/UniqueId.php +++ b/application/Espo/Repositories/UniqueId.php @@ -44,7 +44,7 @@ class UniqueId extends \Espo\Core\ORM\Repositories\RDB public function getNew() : ?Entity { $entity = parent::getNew(); - $entity->set('name', \Espo\Core\Utils\Util::generateId()); + $entity->set('name', \Espo\Core\Utils\Util::generateMoreEntropyId()); return $entity; } } diff --git a/application/Espo/Repositories/Webhook.php b/application/Espo/Repositories/Webhook.php index 83dc7349b7..b93bb7eb8a 100644 --- a/application/Espo/Repositories/Webhook.php +++ b/application/Espo/Repositories/Webhook.php @@ -52,7 +52,7 @@ class Webhook extends \Espo\Core\ORM\Repositories\RDB protected function fillSecretKey(Entity $entity) { - $secretKey = \Espo\Core\Utils\Util::generateKey(); + $secretKey = \Espo\Core\Utils\Util::generateSecretKey(); $entity->set('secretKey', $secretKey); } diff --git a/application/Espo/Services/User.php b/application/Espo/Services/User.php index 0c9b20a0ba..c9d9993c0e 100644 --- a/application/Espo/Services/User.php +++ b/application/Espo/Services/User.php @@ -245,7 +245,7 @@ class User extends Record throw new Forbidden(json_encode(['reason' => 'Already-Sent'])); } - $requestId = Util::generateId() . Util::generateKey(); + $requestId = Util::generateCryptId(); $passwordChangeRequest = $this->getEntityManager()->getEntity('PasswordChangeRequest'); $passwordChangeRequest->set([ @@ -411,7 +411,7 @@ class User extends Record $entity->set('apiKey', $apiKey); if ($entity->get('authMethod') === 'Hmac') { - $secretKey = \Espo\Core\Utils\Util::generateKey(); + $secretKey = \Espo\Core\Utils\Util::generateSecretKey(); $entity->set('secretKey', $secretKey); } @@ -508,7 +508,7 @@ class User extends Record $entity->set('apiKey', $apiKey); if ($entity->get('authMethod') === 'Hmac') { - $secretKey = \Espo\Core\Utils\Util::generateKey(); + $secretKey = \Espo\Core\Utils\Util::generateSecretKey(); $entity->set('secretKey', $secretKey); } } @@ -559,7 +559,7 @@ class User extends Record if ($entity->isApi()) { if ($entity->isAttributeChanged('authMethod') && $entity->get('authMethod') === 'Hmac') { - $secretKey = \Espo\Core\Utils\Util::generateKey(); + $secretKey = \Espo\Core\Utils\Util::generateSecretKey(); $entity->set('secretKey', $secretKey); } }