diff --git a/src/controllers/session-controller.php b/src/controllers/session-controller.php index de2206c..44123c9 100644 --- a/src/controllers/session-controller.php +++ b/src/controllers/session-controller.php @@ -41,7 +41,7 @@ public function create() if ($private) $token = $this->createHash($data["name"], $data["password"]); else - $token = $this->createHash($data["name"], bin2hex(random_bytes(8))); + $token = $this->createHash($data["name"], $this->randomKey()); $session->setToken($token); $session->setLastAction(new DateTime()); @@ -53,6 +53,16 @@ public function create() return new NumericResponse($session->getId()); } + // Generate a random key for the public session token + private function randomKey() + { + if (PHP_MAJOR_VERSION >= 7) + $bytes = random_bytes(8); + else + $bytes = openssl_random_pseudo_bytes(8); + return bin2hex($bytes); + } + // Add or remove member // URL: /api/session/member/{id}/?{mid} public function member($sessionId, $memberId = 0)