Remove personal data from Message ID seed. (#880029/847107)

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@13805 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/class/deliver/Deliver.class.php b/class/deliver/Deliver.class.php
index 356c6d7713038c48b43c1aafeea6406f03edcb9a..fb085cb5f353b4e4e9e27d3b6c0189e95abc877b 100644 (file)
--- a/class/deliver/Deliver.class.php
+++ b/class/deliver/Deliver.class.php
@@ -590,15 +590,9 @@ class Deliver {
         /* Create a message-id */
         $message_id = 'MESSAGE ID GENERATION ERROR! PLEASE CONTACT SQUIRRELMAIL DEVELOPERS';
         if (empty($rfc822_header->message_id)) {
         /* Create a message-id */
         $message_id = 'MESSAGE ID GENERATION ERROR! PLEASE CONTACT SQUIRRELMAIL DEVELOPERS';
         if (empty($rfc822_header->message_id)) {

-            $message_id = '<';
-            /* user-specifc data to decrease collision chance */
-            $seed_data = $username . '.';
-            $seed_data .= (!empty($REMOTE_PORT) ? $REMOTE_PORT . '.' : '');
-            $seed_data .= (!empty($REMOTE_ADDR) ? $REMOTE_ADDR . '.' : '');
-            /* add the current time in milliseconds and randomness */
-            $seed_data .= uniqid(mt_rand(),true);
-            /* put it through one-way hash and add it to the ID */
-            $message_id .= md5($seed_data) . '.squirrel@' . $SERVER_NAME .'>';
+            $message_id = '<'
+                        . md5(GenerateRandomString(16, '', 7) . uniqid(mt_rand(),true))
+                        . '.squirrel@' . $SERVER_NAME .'>';

         }
 
         /* Make an RFC822 Received: line */
         }
 
         /* Make an RFC822 Received: line */

diff --git a/doc/ChangeLog b/doc/ChangeLog
index e880b68a070e53a0250ca6452f19dd07cb53fc63..34767c786fb0e23ca5e36be179f9ae3cb900cf14 100644 (file)
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -321,6 +321,7 @@ Version 1.5.2 - SVN
   - Removed the shut down DSBL blocklists (#2796734).
   - Fixed broken RFC1918 reference in contrib/.htaccess and doc/.htaccess (#2798839).
   - Stop using deprecated ereg functions. (#2820952)
   - Removed the shut down DSBL blocklists (#2796734).
   - Fixed broken RFC1918 reference in contrib/.htaccess and doc/.htaccess (#2798839).
   - Stop using deprecated ereg functions. (#2820952)

+  - Remove personal data from Message ID seed. (#880029/847107)

 
 Version 1.5.1 (branched on 2006-02-12)
 --------------------------------------
 
 Version 1.5.1 (branched on 2006-02-12)
 --------------------------------------