Implement StringUtil::getRandomID() in terms of a CSPRNG

diff --git a/wcfsetup/install/files/lib/util/StringUtil.class.php b/wcfsetup/install/files/lib/util/StringUtil.class.php
index c215dd86359fe954fb4649fd9adadcabe1529bdd..36a556687add125ca0eab5f9b67a852d913753db 100644 (file)
--- a/wcfsetup/install/files/lib/util/StringUtil.class.php
+++ b/wcfsetup/install/files/lib/util/StringUtil.class.php
@@ -42,12 +42,12 @@ final class StringUtil {
        }
        
        /**
-        * Creates a random hash.
+        * Returns a 40 character hexadecimal string generated using a CSPRNG.
         * 
         * @return      string
         */
        public static function getRandomID() {
-               return self::getHash(microtime() . uniqid((string) mt_rand(), true));
+               return bin2hex(random_bytes(20));
        }
        
        /**