phpbb 2.0 rand_seed function question to developers, please

Discussion of general topics related to the new version and its place in the world. Don't discuss new features, report bugs, ask for support, et cetera. Don't use this to spam for other boards or attack those boards!
Forum rules
Discussion of general topics related to the new release and its place in the world. Don't discuss new features, report bugs, ask for support, et cetera. Don't use this to spam for other boards or attack those boards!
Locked
qspypl
Registered User
Posts: 4
Joined: Thu Apr 17, 2008 9:41 am

phpbb 2.0 rand_seed function question to developers, please

Post by qspypl » Thu Apr 17, 2008 9:56 am

I have question about dss_rand seed function, only developers will tell me for sure if this modification will not harm security.

[extreme optimizing]
Now, security problem arise when i hardcoded querying phpbb_config on EVERY page (in common.php) to simple php array because there is one variable... rand_seed... when its hardcoded its constant but when its not hardcoded it is changing on every page view. Now all i know its used while generating new passwords probably, coul we trick this like this?
current (constant) rand_seed hardcoded in php array:
$board_config = Array (
config_values...
'rand_seed' => '0314027335b60fdcdcffdac0ee1fd8ea',
config_values...
);
this trick will solve this?
$board_config = Array (
config_values...
'rand_seed' => rand_seed(),
config_values...
);
So now rand_seed will not be grabbed from database on every page view but just generated from function on every page view.
Additionaly i could save second query, UPDATE rand_seed value to database on every page view from rand_seed function.

Can i make this 2 modifications without putting our forum on security risk? I am loosing anything on such solution?

Hope everybody understand.

Regards


PS
If this would make security problems, maybe this hack, update rand_seed every ~3 page refreshes, not 1.

if (mt_rand(1,3) == 1) {
dss_rand_function_body
}

This would refresh rand_seed in database not every refresh of page but every 3 refreshes of page.

User avatar
Highway of Life
Registered User
Posts: 1399
Joined: Tue Feb 08, 2005 10:18 pm
Location: I'd love to change the World, but they won't give me the Source Code
Contact:

Re: phpbb 2.0 rand_seed function question to developers, please

Post by Highway of Life » Sun Apr 20, 2008 7:54 am

This forum is not for phpBB2 discussion and/or support.

If you’re referring to phpBB3, it has it’s own $config['rand_seed'];
Image

qspypl
Registered User
Posts: 4
Joined: Thu Apr 17, 2008 9:41 am

Re: phpbb 2.0 rand_seed function question to developers, please

Post by qspypl » Sun Apr 20, 2008 12:47 pm

Yes its phpbb2, but noone can help me besides developers. Its not my fault that at area51 there is no phpbb2 forums anymore.

NeoThermic
Registered User
Posts: 198
Joined: Fri Jan 02, 2004 3:44 pm
Location: United Kingdom
Contact:

Re: phpbb 2.0 rand_seed function question to developers, please

Post by NeoThermic » Mon Apr 21, 2008 1:27 pm

qspypl wrote:Yes its phpbb2, but noone can help me besides developers. Its not my fault that at area51 there is no phpbb2 forums anymore.
Where did you get that crazy idea from?

NeoThermic
phpBB release date pool!
The NeoThermic.com... a well of information. Ask me for the bit bucket so you can drink its goodness. ||新熱です

qspypl
Registered User
Posts: 4
Joined: Thu Apr 17, 2008 9:41 am

Re: phpbb 2.0 rand_seed function question to developers, please

Post by qspypl » Wed Apr 23, 2008 8:57 pm

You really think someone can help me there about this problem? I dont think so.
If you reffering to phpbb2 forums i was speaking about area51 forum, because here are only people who can help me.

ElbertF
Registered User
Posts: 583
Joined: Fri Dec 03, 2004 4:35 pm
Location: tracing..
Contact:

Re: phpbb 2.0 rand_seed function question to developers, please

Post by ElbertF » Wed Apr 23, 2008 9:50 pm

I doubt there is anybody here that isn't on phpBB.com, this is just a testing board. :roll:

User avatar
Kellanved
Former Team Member
Posts: 407
Joined: Sun Jul 30, 2006 4:59 pm
Location: Berlin

Re: phpbb 2.0 rand_seed function question to developers, please

Post by Kellanved » Wed Apr 23, 2008 10:42 pm

I will lock this. This is not the 2.0 dev board and any answer would depend on things like your php version etc. Rule of thumb: a static or time-based seed is a bad idea.
No support via PM.
Trust me, I'm a doctor.

Locked