Refactor generating of private key and random strings

Generating of private key is atomic now.
More secure random strings on PHP 7+.

adminer/include/adminer.inc.php

@@ -25,12 +25,16 @@ class Adminer {
 	function connectSsl() {
 	}
 
-	/** Get key used for permanent login
+	/**
-	* @param bool
+	 * Gets a private key used for permanent login.
-	* @return string cryptic string which gets combined with password or false in case of an error
+	 *
-	*/
+	 * @param bool $create
+	 *
+	 * @return string|false Cryptic string which gets combined with password or false in case of an error.
+	 * @throws \Random\RandomException
+	 */
 	function permanentLogin($create = false) {
-		return password_file($create);
+		return get_private_key($create);
 	}
 
 	/** Return key used to group brute force attacks; behind a reverse proxy, you want to return the last part of X-Forwarded-For

adminer/include/auth.inc.php

@@ -1,4 +1,5 @@
 <?php
+
 $connection = '';
 
 $has_token = $_SESSION["token"];
@@ -171,9 +172,10 @@ function unset_permanent() {
 }
 
 /** Renders an error message and a login form
-* @param string plain text
+ * @param string plain text
-* @return null exits
+ * @return null exits
-*/
+ * @throws \Random\RandomException
+ */
 function auth_error($error) {
 	global $adminer, $has_token;
 	$session_name = session_name();
@@ -198,7 +200,7 @@ function auth_error($error) {
 		$error = lang('Session support must be enabled.');
 	}
 	$params = session_get_cookie_params();
-	cookie("adminer_key", ($_COOKIE["adminer_key"] ? $_COOKIE["adminer_key"] : rand_string()), $params["lifetime"]);
+	cookie("adminer_key", ($_COOKIE["adminer_key"] ?: get_random_string()), $params["lifetime"]);
 	page_header(lang('Login'), $error, null);
 	echo "<form action='' method='post'>\n";
 	echo "<div>";

adminer/include/design.inc.php

@@ -142,14 +142,20 @@ function csp() {
 	);
 }
 
-/** Get a CSP nonce
+/**
-* @return string Base64 value
+ * Gets a CSP nonce.
-*/
+ *
-function get_nonce() {
+ * @return string Base64 value.
+ * @throws \Random\RandomException
+ */
+function get_nonce()
+{
 	static $nonce;
+
 	if (!$nonce) {
-		$nonce = base64_encode(rand_string());
+		$nonce = base64_encode(get_random_string(true));
 	}
+
 	return $nonce;
 }
 

adminer/include/functions.inc.php

@@ -1,4 +1,5 @@
 <?php
+
 /** Get database connection
 * @return Min_DB
 */
@@ -1249,6 +1250,17 @@ function write_and_unlock_file($file, $data)
 	rewind($file);
 	fwrite($file, $data);
 	ftruncate($file, strlen($data));
+
+	unlock_file($file);
+}
+
+/**
+ * Unlocks and closes the file.
+ *
+ * @param resource $file
+ */
+function unlock_file($file)
+{
 	flock($file, LOCK_UN);
 	fclose($file);
 }
@@ -1258,31 +1270,44 @@ function write_and_unlock_file($file, $data)
  *
  * @param $create bool
  * @return string|false Returns false if the file can not be created.
+ * @throws \Random\RandomException
  */
-function password_file($create) {
+function get_private_key($create)
+{
 	$filename = get_temp_dir() . "/adminer.key";
 
-	$return = file_exists($filename) ? file_get_contents($filename) : false;
+	if (!$create && !file_exists($filename)) {
-	if ($return || !$create) {
+		return false;
-		return $return;
 	}
 
-	$file = @fopen($filename, "w"); // @ - can have insufficient rights //! is not atomic
+	$file = open_file_with_lock($filename);
-	if ($file) {
+	if (!$file) {
-		chmod($filename, 0660);
+		return false;
-		$return = rand_string();
-		fwrite($file, $return);
-		fclose($file);
 	}
 
-	return $return;
+	$key = stream_get_contents($file);
+	if (!$key) {
+		$key = get_random_string();
+		write_and_unlock_file($file, $key);
+	} else {
+		unlock_file($file);
+	}
+
+	return $key;
 }
 
-/** Get a random string
+/**
-* @return string 32 hexadecimal characters
+ * Returns a random 32 characters long string.
-*/
+ *
-function rand_string() {
+ * @param $binary bool
-	return md5(uniqid(mt_rand(), true));
+ * @return string
+ * @throws \Random\RandomException
+ */
+function get_random_string($binary = false)
+{
+	$bytes = function_exists('random_bytes') ? random_bytes(32) : uniqid(mt_rand(), true);
+
+	return $binary ? $bytes : md5($bytes);
 }
 
 /** Format value to use in select

editor/include/adminer.inc.php

@@ -16,8 +16,11 @@ class Adminer {
 	function connectSsl() {
 	}
 
+	/**
+	 * @throws \Random\RandomException
+	 */
 	function permanentLogin($create = false) {
-		return password_file($create);
+		return get_private_key($create);
 	}
 
 	function bruteForceKey() {