Implement StringUtil::getUUID() in terms of a CSPRNG

diff --git a/wcfsetup/install/files/lib/util/StringUtil.class.php b/wcfsetup/install/files/lib/util/StringUtil.class.php
index 36a556687add125ca0eab5f9b67a852d913753db..9de5d0771ada1aefe044dc10a3cd69a35af0c6b2 100644 (file)
--- a/wcfsetup/install/files/lib/util/StringUtil.class.php
+++ b/wcfsetup/install/files/lib/util/StringUtil.class.php
@@ -56,7 +56,21 @@ final class StringUtil {
         * @return      string
         */
        public static function getUUID() {
-               return sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x', mt_rand(0, 65535), mt_rand(0, 65535), mt_rand(0, 65535), mt_rand(16384, 20479), mt_rand(32768, 49151), mt_rand(0, 65535), mt_rand(0, 65535), mt_rand(0, 65535));
+               return sprintf(
+                       '%04x%04x-%04x-%04x-%02x%02x-%04x%04x%04x',
+                       // time_low
+                       random_int(0, 0xffff), random_int(0, 0xffff),
+                       // time_mid
+                       random_int(0, 0xffff), 
+                       // time_hi_and_version
+                       random_int(0, 0x0fff) | 0x4000,
+                       // clock_seq_hi_and_res
+                       random_int(0, 0x3f) | 0x80,
+                       // clock_seq_low
+                       random_int(0, 0xff),
+                       // node
+                       random_int(0, 0xffff), random_int(0, 0xffff), random_int(0, 0xffff)
+               );
        }
        
        /**