Fixing Captcha helper [php<7]

Hi, i was today trying to use tank_auth with the actual version of CI and i got a big problem, when CI is trying to show a captcha, calling create_captcha from the helper, the server dies for time exceed.

So, reading and reading the code, i find the issue, at line 132 of captcha helper randomize the pool only if random_int exists, working only in php7. For people like me, using 5, must add an else statement.

Let's see, change:

Code:

// PHP7 or a suitable polyfill
if (function_exists('random_int'))
            {
                try
                {
                    for ($i = 0; $i < $word_length; $i++)
                    {
                        $word .= $pool[random_int(0, $rand_max)];
                    }
                }
                catch (Exception $e)
                {
                    // This means fallback to the next possible
                    // alternative to random_int()
                    $word = '';
                }
            }

for:

Code:

// PHP7 or a suitable polyfill
if (function_exists('random_int'))
            {
                try
                {
                    for ($i = 0; $i < $word_length; $i++)
                    {
                        $word .= $pool[random_int(0, $rand_max)];
                    }
                }
                catch (Exception $e)
                {
                    // This means fallback to the next possible
                    // alternative to random_int()
                    $word = '';
                }
            }else{ //PHP5
                for ($i = 0; $i < $word_length; $i++)
                {
                    $word .= $pool[rand(0, strlen($pool) - 1)];
                }
            }

I hope i'm writting the thread at the correct sub-forum. Otherwhise, please tell me or move, i thing this is a big bug.

No, you MUST NOT add that else.

https://github.com/bcit-ci/CodeIgniter/c...9504e89f75

Ok! Thank you! Can you explain why the else is not good there? Is rand not secure?

Exactly - rand() is not secure; it's not actually random.
That's the reason why 3.0.3 changed the captcha helper in the first place.