[TikiWiki-commits] [Git][tikiwiki/tiki][29.x] [FIX] Email2FA: Refactor random string generation logic for improved charset handling

Espoir Baraka pushed to branch 29.x at Tiki Wiki CMS Groupware / Tiki


Commits:
58f230ba by Espoir Baraka at 2026-08-18T10:38:00+02:00
[FIX] Email2FA: Refactor random string generation logic for improved charset handling
---
* [FIX] Email2FA: Refactor random string generation logic for improved charset handling
---
* [FIX] Email2FA: Refactor random string generation logic for improved charset handling
---
* [FIX] Email2FA: Refactor random string generation logic for improved charset handling

(cherry picked from commit c570ce02b6c10654e325ae1beb2d323ba61e0935)

See merge request tikiwiki/tiki!10911

(cherry picked from commit 05943fd3a657f8300dac90e8af2f863c644e7b1f)

See merge request tikiwiki/tiki!10916

(cherry picked from commit 3341bbd7636db156001be5b52fca76647de2e16c)

See merge request tikiwiki/tiki!10931

- - - - -


1 changed file:

- lib/core/TwoFactorAuth/Email2FA.php


Changes:

=====================================
lib/core/TwoFactorAuth/Email2FA.php
=====================================
@@ -135,28 +135,34 @@ class Email2FA implements TwoFactorAuthInterface
     private function generateRandomString($length = 6, $chars = '')
     {
         if (! empty($chars)) {
-            $list = [];
+            $alphabet = '';
             if (preg_match_all('/(.)-(.)/', $chars, $m)) {
                 foreach ($m[0] as $k => $_) {
-                    $class = '';
-                    for ($i = ord($m[1][$k]); $i <= max(ord($m[1][$k]), ord($m[2][$k])); $i++) {
-                        $class .= chr($i);
+                    $start = ord($m[1][$k]);
+                    $end = ord($m[2][$k]);
+                    if ($start > $end) {
+                        [$start, $end] = [$end, $start];
+                    }
+                    for ($i = $start; $i <= $end; $i++) {
+                        $alphabet .= chr($i);
                     }
-                    $list[] = $class;
                 }
                 $chars = str_replace($m[0], '', $chars);
             }
-            if ($chars) {
-                $list[] = $chars;
-            }
+            $alphabet .= $chars;
         } else {
-            $list = ['aeiou', 'AEIOU', 'bcdfghjklmnpqrstvwxyz', 'BCDFGHJKLMNPQRSTVWXYZ', '0123456789'];
+            $alphabet = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
         }
-        shuffle($list);
+
+        $alphabet = implode('', array_unique(str_split($alphabet)));
+        $alphabetLength = strlen($alphabet);
+        if ($alphabetLength < 1) {
+            throw new TwoFactorAuthException(tr('Email 2FA token charset is empty.'));
+        }
+
         $randomString = '';
         for ($i = 0; $i < $length; $i++) {
-            $ch = $list[$i % count($list)];
-            $randomString .= $ch[rand(0, strlen($ch) - 1)];
+            $randomString .= $alphabet[random_int(0, $alphabetLength - 1)];
         }
         return $randomString;
     }



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/58f230ba385964f5d3432dc5cb3b76c68bdb9e6f

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/58f230ba385964f5d3432dc5cb3b76c68bdb9e6f
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs