From 336673770d02b784a252a2651eb82551a3d5fb90 Mon Sep 17 00:00:00 2001
From: emeric <itmfr@yahoo.fr>
Date: Sat, 27 Jul 2019 11:16:45 +0200
Subject: [PATCH] Switched to Wt::WRandom to generate secrets

---
 src/auth/AuthService.cpp | 12 ++----------
 src/ui/Auth.cpp          | 19 ++-----------------
 src/utils/Utils.hpp      | 14 --------------
 3 files changed, 4 insertions(+), 41 deletions(-)

diff --git a/src/auth/AuthService.cpp b/src/auth/AuthService.cpp
index e88d68f9..7418fba8 100644
--- a/src/auth/AuthService.cpp
+++ b/src/auth/AuthService.cpp
@@ -21,10 +21,9 @@
 
 #include "AuthService.hpp"
 
-#include <iomanip>
 #include <Wt/Auth/HashFunction.h>
 #include <Wt/Auth/PasswordStrengthValidator.h>
-#include <Wt/Utils.h>
+#include <Wt/WRandom.h>
 
 #include "database/Session.hpp"
 #include "utils/Utils.hpp"
@@ -73,14 +72,7 @@ AuthService::checkUserPassword(Database::Session& session, const boost::asio::ip
 Database::User::PasswordHash
 AuthService::hashPassword(const std::string& password) const
 {
-	std::array<std::uint8_t, 16> buffer;
-	fillRandom(buffer);
-
-	std::ostringstream oss;
-	for (std::uint8_t b : buffer)
-		oss << std::hex << std::setfill('0') << std::setw(2) << static_cast<int>(b);
-
-	const std::string salt {Wt::Utils::base64Encode(oss.str(), false)};
+	const std::string salt {Wt::WRandom::generateId(32)};
 
 	const Wt::Auth::BCryptHashFunction hashFunc {6};
 	return {salt, hashFunc.compute(password, salt)};
diff --git a/src/ui/Auth.cpp b/src/ui/Auth.cpp
index 9b500386..0c21424e 100644
--- a/src/ui/Auth.cpp
+++ b/src/ui/Auth.cpp
@@ -25,11 +25,11 @@
 #include <Wt/WLineEdit.h>
 #include <Wt/WCheckBox.h>
 #include <Wt/WPushButton.h>
+#include <Wt/WRandom.h>
 
 #include "auth/AuthService.hpp"
 #include "main/Service.hpp"
 #include "utils/Logger.hpp"
-#include "utils/Utils.hpp"
 
 #include "common/Validators.hpp"
 #include "LmsApplication.hpp"
@@ -38,27 +38,12 @@ namespace UserInterface {
 
 static const std::string authCookieName {"LmsAuth"};
 
-static
-std::string
-createSecret()
-{
-	std::array<std::uint8_t, 32> buffer;
-	fillRandom(buffer);
-
-	std::ostringstream oss;
-	for (std::uint8_t b : buffer)
-		oss << std::hex << std::setfill('0') << std::setw(2) << static_cast<int>(b);
-
-	return oss.str();
-}
-
-
 static
 void
 createAuthToken(Database::IdType userId)
 {
 
-	const std::string secret {createSecret()};
+	const std::string secret {Wt::WRandom::generateId(48)};
 	const Wt::WDateTime now {Wt::WDateTime::currentDateTime()};
 	Wt::WDateTime expiry;
 
diff --git a/src/utils/Utils.hpp b/src/utils/Utils.hpp
index 1097f89f..f7ec995a 100644
--- a/src/utils/Utils.hpp
+++ b/src/utils/Utils.hpp
@@ -114,20 +114,6 @@ shuffleContainer(Container& container)
 	std::shuffle(std::begin(container), std::end(container), randGenerator);
 }
 
-template <typename Container>
-void
-fillRandom(Container& container)
-{
-	using value_type = typename Container::value_type;
-	static_assert(std::is_integral<value_type>::value, "Integral required");
-
-	std::random_device rd;
-	std::mt19937_64 randGenerator {rd()};
-	std::uniform_int_distribution<> dist {std::numeric_limits<value_type>::min(), std::numeric_limits<value_type>::max()};
-
-	std::for_each(std::begin(container), std::end(container), [&](auto& elem) { elem = dist(randGenerator); });
-}
-
 template <typename Container>
 typename Container::iterator
 pickRandom(Container& container)