Remove the use of `rand`

Created on 29 February 2024, 10 months ago
Updated 18 April 2024, 8 months ago

Problem/Motivation

The WebformSubmissionConditionsValidator uses rand to generate a random value to make sure users can't determine an element's value/result. PHP advises not to use randfor purposes that require returned values to be unguessable https://www.php.net/manual/en/function.rand.php. Instead use random_int because it is "more secure".

Proposed resolution

Replace rand() with random_int(0, mt_getrandmax())

πŸ“Œ Task
Status

Fixed

Version

6.2

Component

Code

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024