rework seed generation: this is something that really belongs in init.php

so do it there. Input enough random components from diferent dimensions,
so hard to predict.

ChangeLog

@@ -261,6 +261,7 @@ Version 1.5.2 - SVN
     (third party) plugin.
   - Allow a different server address for the POP server to be configured when
     using POP before SMTP.
+  - Seed random number generator in one place during script init.
 
 Version 1.5.1 (branched on 2006-02-12)
 --------------------------------------

functions/global.php

@@ -546,7 +546,6 @@ function sqsetcookie($sName,$sValue='deleted',$iExpire=0,$sPath="",$sDomain="",$
 if (!function_exists('session_regenerate_id')) {
 
     function php_combined_lcg() {
-        sq_mt_randomize();
         $tv = gettimeofday();
         $lcg['s1'] = $tv['sec'] ^ (~$tv['usec']);
         $lcg['s2'] = mt_rand();

functions/strings.php

@@ -635,83 +635,6 @@ function OneTimePadDecrypt ($string, $epad) {
     return $decrypted;
 }
 
-
-/**
- * Randomizes the mt_rand() function.
- *
- * Toss this in strings or integers and it will seed the generator
- * appropriately. With strings, it is better to get them long.
- * Use md5() to lengthen smaller strings.
- *
- * @param mixed $val a value to seed the random number generator. mixed = integer or string.
- * @return void
- * @since 1.0
- */
-function sq_mt_seed($Val) {
-    /* if mt_getrandmax() does not return a 2^n - 1 number,
-       this might not work well.  This uses $Max as a bitmask. */
-    $Max = mt_getrandmax();
-
-    if (! is_int($Val)) {
-            $Val = crc32($Val);
-    }
-
-    if ($Val < 0) {
-        $Val *= -1;
-    }
-
-    if ($Val == 0) {
-        return;
-    }
-
-    mt_srand(($Val ^ mt_rand(0, $Max)) & $Max);
-}
-
-
-/**
- * Init random number generator
- *
- * This function initializes the random number generator fairly well.
- * It also only initializes it once, so you don't accidentally get
- * the same 'random' numbers twice in one session.
- *
- * @return void
- * @since 1.0
- */
-function sq_mt_randomize() {
-    static $randomized;
-
-    if ($randomized) {
-        return;
-    }
-
-    /* Global. */
-    sqgetGlobalVar('REMOTE_PORT', $remote_port, SQ_SERVER);
-    sqgetGlobalVar('REMOTE_ADDR', $remote_addr, SQ_SERVER);
-    sq_mt_seed((int)((double) microtime() * 1000000));
-    sq_mt_seed(md5($remote_port . $remote_addr . getmypid()));
-
-    /* getrusage */
-    if (function_exists('getrusage')) {
-        /* Avoid warnings with Win32 */
-        $dat = @getrusage();
-        if (isset($dat) && is_array($dat)) {
-            $Str = '';
-            foreach ($dat as $k => $v)
-                {
-                    $Str .= $k . $v;
-                }
-            sq_mt_seed(md5($Str));
-        }
-    }
-
-    if(sqgetGlobalVar('UNIQUE_ID', $unique_id, SQ_SERVER)) {
-        sq_mt_seed(md5($unique_id));
-    }
-
-    $randomized = 1;
-}
-
 /**
  * Creates encryption key
  *
@@ -724,8 +647,6 @@ function sq_mt_randomize() {
  * @since 1.0
  */
 function OneTimePadCreate ($length=100) {
-    sq_mt_randomize();
-
     $pad = '';
     for ($i = 0; $i < $length; $i++) {
         $pad .= chr(mt_rand(0,255));
@@ -789,8 +710,6 @@ function GenerateRandomString($size, $chars, $flags = 0) {
         return '';
     }
 
-    sq_mt_randomize(); /* Initialize the random number generator */
-
     $String = '';
     $j = strlen( $chars ) - 1;
     while (strlen($String) < $size) {

include/init.php

@@ -87,6 +87,35 @@ if (!(bool)ini_get('session.use_cookies') ||
     ini_set('session.use_cookies','1');
 }
 
+/**
+ * Initialize seed of random number generator.
+ * We use a number of things to randomize input: current time in ms,
+ * info about the remote client, info about the current process, the
+ * randomness of uniqid and stat of the current file.
+ *
+ * We seed this here only once per init, not only to save cycles
+ * but also to make the result of mt_rand more random (it now also
+ * depends on the number of times mt_rand was called before in this
+ * execution.
+ */
+$seed = microtime() . $_SERVER['REMOTE_PORT'] . $_SERVER['REMOTE_ADDR'] . getmypid();
+
+if (function_exists('getrusage')) {
+    /* Avoid warnings with Win32 */
+    $dat = @getrusage();
+    if (isset($dat) && is_array($dat)) { $seed .= implode('', $dat); }
+}
+
+if(!empty($_SERVER['UNIQUE_ID'])) {
+    $seed .= $_SERVER['UNIQUE_ID'];
+}
+
+$seed .= uniqid(mt_rand(),TRUE);
+$seed .= implode( '', stat( __FILE__) );
+
+/** PHP 4.2 and up don't require seeding, but their used seed algorithm
+ *  is of questionable quality, so we keep doing it ourselves. */
+mt_srand(hexdec(md5($seed)));
 
 /**
  * calculate SM_PATH and calculate the base_uri

plugins/change_password/backend/ldap.php

@@ -550,11 +550,9 @@ function cpw_ldap_password_hash($pass,$crypto,&$msgs,$forced_salt='') {
     case 'smd5':
         // minimal requirement = mhash extension with md5 support and php 4.0.4.
         if( function_exists( 'mhash' ) && function_exists( 'mhash_keygen_s2k' ) && defined('MHASH_MD5')) {
-            sq_mt_seed( (double) microtime() * 1000000 );
             if ($forced_salt!='') {
                 $salt=$forced_salt;
             } else {
-                sq_mt_randomize();
                 $salt = mhash_keygen_s2k( MHASH_MD5, $pass, substr( pack( "h*", md5( mt_rand() ) ), 0, 8 ), 4 );
             }
             $ret = "{SMD5}".base64_encode( mhash( MHASH_MD5, $pass.$salt ).$salt );
@@ -591,11 +589,9 @@ function cpw_ldap_password_hash($pass,$crypto,&$msgs,$forced_salt='') {
     case 'ssha':
         // minimal requirement = mhash extension and php 4.0.4
         if( function_exists( 'mhash' ) && function_exists( 'mhash_keygen_s2k' ) && defined('MHASH_SHA1')) {
-            sq_mt_seed( (double) microtime() * 1000000 );
             if ($forced_salt!='') {
                 $salt=$forced_salt;
             } else {
-                sq_mt_randomize();
                 $salt = mhash_keygen_s2k( MHASH_SHA1, $pass, substr( pack( "h*", md5( mt_rand() ) ), 0, 8 ), 4 );
             }
             $ret = "{SSHA}".base64_encode( mhash( MHASH_SHA1, $pass.$salt ).$salt );

themes/darkness.php

@@ -12,17 +12,13 @@
  * @subpackage themes
  */
 
-/**
- * Load up the usual suspects.. */
-require_once(SM_PATH . 'functions/strings.php');
-
-   // Note:  The text distance is actually pre-squared
-   // Background range is from 24-64, all three colors are the same
-   // Text range is from 196 to 255
-   $BackgroundTargetDistance = 12;
-   $BackgroundAdjust = 1;
-   $TextTargetDistance = 65536;
-   $TextAdjust = 0.95;
+// Note:  The text distance is actually pre-squared
+// Background range is from 24-64, all three colors are the same
+// Text range is from 196 to 255
+$BackgroundTargetDistance = 12;
+$BackgroundAdjust = 1;
+$TextTargetDistance = 65536;
+$TextAdjust = 0.95;
 
 function IsUnique($Distance, $r, $g, $b, $usedArray)
 {
@@ -74,9 +70,6 @@ global $squirrelmail_plugin_hooks;
 $squirrelmail_plugin_hooks['generic_header']['theme_darkness'] =
     'Darkness_HeaderPlugin';
 
-/** seed the random number generator **/
-sq_mt_randomize();
-
 $color[3] = '#000000';
 $color[4] = '#000000';
 $used = array(0);

themes/greenhouse_effect.php

@@ -19,12 +19,6 @@ if (isset($_SERVER['SCRIPT_FILENAME']) && $_SERVER['SCRIPT_FILENAME'] == __FILE_
     die();
 }
 
-/** load sq_mt_randomize() */
-include_once(SM_PATH . 'functions/strings.php');
-
-/** seed the random number generator **/
-sq_mt_randomize();
-
 for ($i = 0; $i <= 16; $i++) {
     /* background/foreground toggle **/
     if ($i == 0 || $i == 3 || $i == 4 || $i == 5

themes/in_the_pink.php

@@ -20,12 +20,6 @@ if (isset($_SERVER['SCRIPT_FILENAME']) && $_SERVER['SCRIPT_FILENAME'] == __FILE_
     die();
 }
 
-/** load sq_mt_randomize() */
-include_once(SM_PATH . 'functions/strings.php');
-
-/* seed the random number generator */
-sq_mt_randomize();
-
 for ($i = 0; $i <= 16; $i++) {
     /* background/foreground toggle */
     if ($i == 0 or $i == 3 or $i == 4 or $i == 5 or $i == 9 or $i == 10 or $i == 12 or $i == 16) {

themes/kind_of_blue.php

@@ -20,12 +20,6 @@ if (isset($_SERVER['SCRIPT_FILENAME']) && $_SERVER['SCRIPT_FILENAME'] == __FILE_
     die();
 }
 
-/** load sq_mt_randomize() */
-include_once(SM_PATH . 'functions/strings.php');
-
-/** seed the random number generator */
-sq_mt_randomize();
-
 for ($i = 0; $i <= 16; $i++) {
     /* background/foreground toggle */
     if ($i == 0 or $i == 3 or $i == 4 or $i == 5 or $i == 9 or $i == 10 or $i == 12 or $i == 16) {

themes/monostochastic.php

@@ -20,12 +20,6 @@ if (isset($_SERVER['SCRIPT_FILENAME']) && $_SERVER['SCRIPT_FILENAME'] == __FILE_
     die();
 }
 
-/** load sq_mt_randomize() */
-include_once(SM_PATH . 'functions/strings.php');
-
-/** seed the random number generator */
-sq_mt_randomize();
-
 /** light(1) or dark(0) background toggle **/
 $bg = mt_rand(0,1);
 

themes/random.php

@@ -20,10 +20,6 @@ if (isset($_SERVER['SCRIPT_FILENAME']) && $_SERVER['SCRIPT_FILENAME'] == __FILE_
 
 /** load required functions */
 include_once(SM_PATH . 'functions/global.php');
-include_once(SM_PATH . 'functions/strings.php');
-
-/** Initialize the random number generator */
-sq_mt_randomize();
 
 global $theme;
 

themes/shades_of_grey.php

@@ -19,12 +19,6 @@ if (isset($_SERVER['SCRIPT_FILENAME']) && $_SERVER['SCRIPT_FILENAME'] == __FILE_
     die();
 }
 
-/** load sq_mt_randomize() */
-include_once(SM_PATH . 'functions/strings.php');
-
-/** seed the random number generator */
-sq_mt_randomize();
-
 for ($i = 0; $i <= 16; $i++) {
     /* background/foreground toggle */
     if ($i == 0 or $i == 3 or $i == 4 or $i == 5 or $i == 9 or $i == 10 or $i == 12 or $i == 16) {

themes/spice_of_life.php

@@ -19,12 +19,6 @@ if (isset($_SERVER['SCRIPT_FILENAME']) && $_SERVER['SCRIPT_FILENAME'] == __FILE_
     die();
 }
 
-/** load sq_mt_randomize() */
-include_once(SM_PATH . 'functions/strings.php');
-
-/** seed the random number generator **/
-sq_mt_randomize();
-
 /** light(1) or dark(0) background? **/
 $bg = mt_rand(0,1);
 

themes/spice_of_life_dark.php

@@ -19,12 +19,6 @@ if (isset($_SERVER['SCRIPT_FILENAME']) && $_SERVER['SCRIPT_FILENAME'] == __FILE_
     die();
 }
 
-/** load sq_mt_randomize() */
-include_once(SM_PATH . 'functions/strings.php');
-
-/** seed the random number generator **/
-sq_mt_randomize();
-
 for ($i = 0; $i <= 16; $i++) {
     /** background/foreground toggle **/
     if ($i == 0 or $i == 3 or $i == 4 or $i == 5 or $i == 9 or $i == 10 or $i == 12 or $i == 16) {

themes/spice_of_life_lite.php

@@ -19,12 +19,6 @@ if (isset($_SERVER['SCRIPT_FILENAME']) && $_SERVER['SCRIPT_FILENAME'] == __FILE_
     die();
 }
 
-/** load sq_mt_randomize() */
-include_once(SM_PATH . 'functions/strings.php');
-
-/** seed the random number generator **/
-sq_mt_randomize();
-
 for ($i = 0; $i <= 16; $i++) {
     /** background/foreground toggle **/
     if ($i == 0 or $i == 3 or $i == 4 or $i == 5 or $i == 9 or $i == 10 or $i == 12 or $i == 16) {