dev/core#5541 Prevent generation of numeric hashes

[johntwyman]

Overview

This code wraps the hash generation code in CRM/Contact/BAO/Contact/Utils::generateChecksum to ensure numeric hashes can never be created. This is to prevent failures elsewhere in the code base, notably CRM/Mailing/Page/View::run which uses PHP's is_numeric() to check whether or not it should retrieve a mailing's contents via its ID or hash when processing a request for a mailing's public view URL.

Full details in issue #5541.

Before

Hashes generated by md5(uniqid(rand(), TRUE)) can produce numeric outputs such as 7571647522317445 or 109002430016e903.

After

Hash generation is wrapped in a do...while loop to ensure any numeric hash is discarded and a new one generated.

Comments

This is pretty obviously quick and dirty and I'm completely happy for others to decide it should be done in a more robust manner. Seems to me that the checks in CRM/Mailing/Page/View.php could likely be improved too.

I do wonder though how often is_numeric() is being used in a similar manner elsewhere in the code.

[civibot]

🤖 Thank you for contributing to CiviCRM! ❤️ We will need to test and review this PR. 👷

Introduction for new contributors...

• If this is your first PR, an admin will greenlight automated testing with the command ok to test or add to whitelist.
• A series of tests will automatically run. You can see the results at the bottom of this page (if there are any problems, it will include a link to see what went wrong).
• A demo site will be built where anyone can try out a version of CiviCRM that includes your changes.
• If this process needs to be repeated, an admin will issue the command test this please to rerun tests and build a new demo site.
• Before this PR can be merged, it needs to be reviewed. Please keep in mind that reviewers are volunteers, and their response time can vary from a few hours to a few weeks depending on their availability and their knowledge of this particular part of CiviCRM.
• A great way to speed up this process is to "trade reviews" with someone - find an open PR that you feel able to review, and leave a comment like "I'm reviewing this now, could you please review mine?" (include a link to yours). You don't have to wait for a response to get started (and you don't have to stop at one!) the more you review, the faster this process goes for everyone 😄
• To ensure that you are credited properly in the final release notes, please add yourself to contributor-key.yml
• For more information about contributing, see CONTRIBUTING.md.

Quick links for reviewers...

• ➡️ PR Demo site (can be rebuilt with the command test this please).
• 📖 Review standards
• 🗒️ Review template (brief or verbose)

➡️ Online demo of this PR 🔗

[johntwyman]

ping @seamuslee001 - as discussed