From 00d862bb44930c64a969ebe69223c5cf85b9fa0f Mon Sep 17 00:00:00 2001
From: frankfarmer <frank@wikia-inc.com>
Date: Sat, 10 Oct 2015 07:49:56 -0700
Subject: [PATCH] Correct implemenation of User::randomPassword By default,
randomPassword is meant to generate a 10 character random password. This is
achieved by the generation of a random 10 digit base32 int.
The return value SHOULD ideally be evenly distributed between 0000000000 and vvvvvvvvvv
However, the 2012 implementation of this function actually returns a value between 0 and 7vvvvvvvvv. The old implementation can easily be observed generating passwords as short as 7 characters when tested, and can theoretically generate a password with just a single character.
$sourceLength is set to 12.5 when attempting to generate a default 10 char password in the 2012 implementation (which results in only 12 hex chars returned). 13 hex digits are necessary to get a full 0 - vvvvvvvvvv distribution (the full space of 10 digit base 32 ints). This actually gives us a few bits too many, so we take only the least significant bits, giving us a full, even distribution of the desired keyspace. Even then, we might theoretically get back a number with only 1-9 digits; we then zero-pad these to get a 10 character representation.