Elgg\Security\SiteSecret Class Reference

Manages a site-specific secret key, encoded as a 32 byte string "secret". More...

Public Member Functions
	__construct (protected Crypto $crypto, protected ConfigTable $table)
	Constructor. More...
	get ($raw=false)
	Returns the site secret. More...
	getStrength ()
	Get the strength of the site secret. More...
	regenerate ()
	Initialise the site secret (32 bytes: "z" to indicate format + 186-bit key in Base64 URL) and save to config table. More...

Public Attributes
const	CONFIG_KEY = '__site_secret__'

Protected Attributes
string	$key

Detailed Description

Manages a site-specific secret key, encoded as a 32 byte string "secret".

The key can have two formats:

• Since 1.8.17 all keys generated are Base64URL-encoded with the 1st character set to "z" so that the format can be recognized. With one character lost, this makes the keys effectively 186 bits.
• Before 1.8.17 keys were hex-encoded (128 bits) but created from insufficiently random sources.

The hex keys were created with rand() as the only decent source of entropy (the site's creation time is not too difficult to find). As such, systems with a low getrandmax() value created particularly weak keys. You can check key string using getStrength().

Definition at line 24 of file SiteSecret.php.

Constructor & Destructor Documentation

Elgg\Security\SiteSecret::__construct	(	protected Crypto	$crypto,
		protected ConfigTable	$table
	)

Constructor.

Parameters

Crypto	$crypto	Crypto service
ConfigTable	$table	Config table

Definition at line 36 of file SiteSecret.php.

Member Function Documentation

Elgg\Security\SiteSecret::get

(

$raw = false

)

Returns the site secret.

Used to generate difficult to guess hashes for sessions and action tokens.

Parameters

bool

$raw

If true, a binary key will be returned

Returns

string Site secret

Exceptions

RuntimeException

Definition at line 55 of file SiteSecret.php.

Elgg\Security\SiteSecret::getStrength

(

)

Get the strength of the site secret.

If "weak" or "moderate" is returned, this assumes we're running on the same system that created the key.

Returns

string "strong", "moderate", or "weak"

Definition at line 89 of file SiteSecret.php.

Elgg\Security\SiteSecret::regenerate

(

)

Initialise the site secret (32 bytes: "z" to indicate format + 186-bit key in Base64 URL) and save to config table.

Used during installation or regeneration.

Returns

void

Definition at line 113 of file SiteSecret.php.

Member Data Documentation

string Elgg\Security\SiteSecret::$key

protected

Definition at line 28 of file SiteSecret.php.

const Elgg\Security\SiteSecret::CONFIG_KEY = '__site_secret__'

Definition at line 26 of file SiteSecret.php.

---

The documentation for this class was generated from the following file:

• engine/classes/Elgg/Security/SiteSecret.php