From 503942bf6ee70ca4b480e0a3a3eeacba1777cb0c Mon Sep 17 00:00:00 2001 From: azerom960 Date: Tue, 29 Sep 2026 23:17:53 -0400 Subject: [PATCH 1/2] RDKEMW-25973: Enable PHP session entropy to strengthen session ID generation Enable session.entropy_file = /dev/urandom and session.entropy_length = 16 to use cryptographic entropy for PHP session ID generation. This prevents weak session IDs that could be predicted or brute-forced. Adds a focused security regression test that verifies the entropy settings are configured. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- source/Styles/xb3/config/php.ini | 8 ++++---- tests/php_session_entropy_test.sh | 13 +++++++++++++ 2 files changed, 17 insertions(+), 4 deletions(-) create mode 100644 tests/php_session_entropy_test.sh diff --git a/source/Styles/xb3/config/php.ini b/source/Styles/xb3/config/php.ini index 82c25b2..2aa4ffb 100755 --- a/source/Styles/xb3/config/php.ini +++ b/source/Styles/xb3/config/php.ini @@ -1596,15 +1596,15 @@ session.referer_check = ; How many bytes to read from the file. ; http://php.net/session.entropy-length -session.entropy_length = 0 +;session.entropy_length = 0 ; Specified here to create the session id. ; http://php.net/session.entropy-file -;session.entropy_file = /dev/urandom -session.entropy_file = +session.entropy_file = /dev/urandom +;session.entropy_file = ; http://php.net/session.entropy-length -;session.entropy_length = 16 +session.entropy_length = 16 ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. diff --git a/tests/php_session_entropy_test.sh b/tests/php_session_entropy_test.sh new file mode 100644 index 0000000..46f1a2a --- /dev/null +++ b/tests/php_session_entropy_test.sh @@ -0,0 +1,13 @@ +#!/bin/sh +if sed -n '1603p' source/Styles/xb3/config/php.ini | grep -q "session.entropy_file.*=.*dev/urandom"; then + echo "PASS: session.entropy_file set to /dev/urandom" +else + echo "FAIL: session.entropy_file not set to /dev/urandom" + exit 1 +fi +if sed -n '1607p' source/Styles/xb3/config/php.ini | grep -q "session.entropy_length.*=.*16"; then + echo "PASS: session.entropy_length set to 16" +else + echo "FAIL: session.entropy_length not set to 16" + exit 1 +fi From d776ba7f50d927a6135a2c3a1454cefd59edc81e Mon Sep 17 00:00:00 2001 From: azerom960 Date: Wed, 30 Sep 2026 01:18:42 -0400 Subject: [PATCH 2/2] RDKEMW-25973: Trigger fresh CI run to clear stale pr-lint checks Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com]