Your project should not use insecure random number functions 54

More information: https://insight.symfony.com/what-we-analyse/php.use_insecure_random_function

New rule! We've recently added this rule to Insight. Don't be surprised to see new suggestions even though the codebase didn't change.
  1. $code_length = max(4, min(8, $code_length)); // Limiter entre 4 et 8
  2. $verification_code = '';
  3. for ($i = 0; $i < $code_length; $i++) {
  4. $verification_code .= mt_rand(0, 9);
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  5. }
  6. $expiry_minutes = defined('EMAIL_VERIFICATION_CODE_EXPIRY') ? (int)EMAIL_VERIFICATION_CODE_EXPIRY : 15;
  7. $expiry_time = date('Y-m-d H:i:s', time() + ($expiry_minutes * 60));
  1. mt_rand(0, 0xffff),
  2. mt_rand(0, 0xffff),
  3. mt_rand(0, 0x0fff) | 0x4000,
  4. mt_rand(0, 0x3fff) | 0x8000,
  5. mt_rand(0, 0xffff),
  6. mt_rand(0, 0xffff),
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. mt_rand(0, 0xffff)
  8. );
  9. }
  10. /**
  1. '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
  2. mt_rand(0, 0xffff),
  3. mt_rand(0, 0xffff),
  4. mt_rand(0, 0xffff),
  5. mt_rand(0, 0x0fff) | 0x4000,
  6. mt_rand(0, 0x3fff) | 0x8000,
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. mt_rand(0, 0xffff),
  8. mt_rand(0, 0xffff),
  9. mt_rand(0, 0xffff)
  10. );
  11. }
  1. return sprintf(
  2. '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
  3. mt_rand(0, 0xffff),
  4. mt_rand(0, 0xffff),
  5. mt_rand(0, 0xffff),
  6. mt_rand(0, 0x0fff) | 0x4000,
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. mt_rand(0, 0x3fff) | 0x8000,
  8. mt_rand(0, 0xffff),
  9. mt_rand(0, 0xffff),
  10. mt_rand(0, 0xffff)
  11. );
  1. mt_rand(0, 0xffff),
  2. mt_rand(0, 0x0fff) | 0x4000,
  3. mt_rand(0, 0x3fff) | 0x8000,
  4. mt_rand(0, 0xffff),
  5. mt_rand(0, 0xffff),
  6. mt_rand(0, 0xffff)
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. );
  8. }
  9. /**
  10. * Get security statistics for dashboard
  1. {
  2. return sprintf(
  3. '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
  4. mt_rand(0, 0xffff),
  5. mt_rand(0, 0xffff),
  6. mt_rand(0, 0xffff),
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. mt_rand(0, 0x0fff) | 0x4000,
  8. mt_rand(0, 0x3fff) | 0x8000,
  9. mt_rand(0, 0xffff),
  10. mt_rand(0, 0xffff),
  11. mt_rand(0, 0xffff)
  1. */
  2. private function generateEventId(): string
  3. {
  4. return sprintf(
  5. '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
  6. mt_rand(0, 0xffff),
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. mt_rand(0, 0xffff),
  8. mt_rand(0, 0xffff),
  9. mt_rand(0, 0x0fff) | 0x4000,
  10. mt_rand(0, 0x3fff) | 0x8000,
  11. mt_rand(0, 0xffff),
  1. mt_rand(0, 0xffff),
  2. mt_rand(0, 0xffff),
  3. mt_rand(0, 0xffff),
  4. mt_rand(0, 0x0fff) | 0x4000,
  5. mt_rand(0, 0x3fff) | 0x8000,
  6. mt_rand(0, 0xffff),
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. mt_rand(0, 0xffff),
  8. mt_rand(0, 0xffff)
  9. );
  10. }
  1. private function generateEventId(): string
  2. {
  3. return sprintf(
  4. '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
  5. mt_rand(0, 0xffff),
  6. mt_rand(0, 0xffff),
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. mt_rand(0, 0xffff),
  8. mt_rand(0, 0x0fff) | 0x4000,
  9. mt_rand(0, 0x3fff) | 0x8000,
  10. mt_rand(0, 0xffff),
  11. mt_rand(0, 0xffff),
  1. mt_rand(0, 0xffff),
  2. mt_rand(0, 0x0fff) | 0x4000,
  3. mt_rand(0, 0x3fff) | 0x8000,
  4. mt_rand(0, 0xffff),
  5. mt_rand(0, 0xffff),
  6. mt_rand(0, 0xffff)
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. );
  8. }
  9. /**
  10. * Get the objective ID
  1. private function generateObjectiveId(): string
  2. {
  3. return sprintf(
  4. '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
  5. mt_rand(0, 0xffff),
  6. mt_rand(0, 0xffff),
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. mt_rand(0, 0xffff),
  8. mt_rand(0, 0x0fff) | 0x4000,
  9. mt_rand(0, 0x3fff) | 0x8000,
  10. mt_rand(0, 0xffff),
  11. mt_rand(0, 0xffff),
  1. mt_rand(0, 0xffff),
  2. mt_rand(0, 0xffff),
  3. mt_rand(0, 0x0fff) | 0x4000,
  4. mt_rand(0, 0x3fff) | 0x8000,
  5. mt_rand(0, 0xffff),
  6. mt_rand(0, 0xffff),
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. mt_rand(0, 0xffff)
  8. );
  9. }
  10. /**
  1. mt_rand(0, 0xffff),
  2. mt_rand(0, 0xffff),
  3. mt_rand(0, 0xffff),
  4. mt_rand(0, 0x0fff) | 0x4000,
  5. mt_rand(0, 0x3fff) | 0x8000,
  6. mt_rand(0, 0xffff),
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. mt_rand(0, 0xffff),
  8. mt_rand(0, 0xffff)
  9. );
  10. }
  1. return sprintf(
  2. '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
  3. mt_rand(0, 0xffff),
  4. mt_rand(0, 0xffff),
  5. mt_rand(0, 0xffff),
  6. mt_rand(0, 0x0fff) | 0x4000,
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. mt_rand(0, 0x3fff) | 0x8000,
  8. mt_rand(0, 0xffff),
  9. mt_rand(0, 0xffff),
  10. mt_rand(0, 0xffff)
  11. );
  1. '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
  2. mt_rand(0, 0xffff),
  3. mt_rand(0, 0xffff),
  4. mt_rand(0, 0xffff),
  5. mt_rand(0, 0x0fff) | 0x4000,
  6. mt_rand(0, 0x3fff) | 0x8000,
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. mt_rand(0, 0xffff),
  8. mt_rand(0, 0xffff),
  9. mt_rand(0, 0xffff)
  10. );
  11. }
  1. */
  2. private function generateObjectiveId(): string
  3. {
  4. return sprintf(
  5. '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
  6. mt_rand(0, 0xffff),
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. mt_rand(0, 0xffff),
  8. mt_rand(0, 0xffff),
  9. mt_rand(0, 0x0fff) | 0x4000,
  10. mt_rand(0, 0x3fff) | 0x8000,
  11. mt_rand(0, 0xffff),
  1. {
  2. return sprintf(
  3. '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
  4. mt_rand(0, 0xffff),
  5. mt_rand(0, 0xffff),
  6. mt_rand(0, 0xffff),
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. mt_rand(0, 0x0fff) | 0x4000,
  8. mt_rand(0, 0x3fff) | 0x8000,
  9. mt_rand(0, 0xffff),
  10. mt_rand(0, 0xffff),
  11. mt_rand(0, 0xffff)
  1. * @param array $data The order data.
  2. * @return void
  3. */
  4. protected function createOrder(array $data): void
  5. {
  6. $orderId = rand(1000, 9999);
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. $this->message->sendSuccess(['action' => 'create_order', 'order_id' => $orderId]);
  8. }
  9. /**
  10. * Updates an existing order. Placeholder method.
  1. $code_length = defined('EMAIL_VERIFICATION_CODE_LENGTH') ? (int)EMAIL_VERIFICATION_CODE_LENGTH : 6;
  2. $code_length = max(4, min(8, $code_length));
  3. $verification_code = '';
  4. for ($i = 0; $i < $code_length; $i++) {
  5. $verification_code .= mt_rand(0, 9);
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  6. }
  7. // Durée d'expiration
  8. $expiry_minutes = defined('EMAIL_VERIFICATION_CODE_EXPIRY') ? (int)EMAIL_VERIFICATION_CODE_EXPIRY : 15;
  1. */
  2. private function getTotalRequests(): int
  3. {
  4. // In a real implementation, this would query the database
  5. // For simulation, return a random number
  6. return rand(100, 1000);
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. }
  8. /**
  9. * Gets the error count (simulated).
  10. *
  1. *
  2. * @return float The average response time in milliseconds.
  3. */
  4. private function getAverageResponseTime(): float
  5. {
  6. return round(rand(100, 800) / 10, 2);
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. }
  8. /**
  9. * Gets the requests per minute (simulated).
  10. *
  1. 'peak_hours' => [9, 10, 11, 14, 15, 16],
  2. 'avg_concurrent_users' => rand(10, 100),
  3. 'most_used_endpoints' => [
  4. '/api/chat' => rand(100, 500),
  5. '/api/status' => rand(50, 200),
  6. '/api/health' => rand(20, 100)
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. ]
  8. ];
  9. }
  10. /**
  1. return [
  2. 'hourly' => array_map(function ($hour) {
  3. return ['hour' => $hour, 'errors' => rand(0, 5)];
  4. }, range(0, 23)),
  5. 'daily' => array_map(function ($day) {
  6. return ['day' => $day, 'errors' => rand(0, 50)];
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. }, range(1, 7))
  8. ];
  9. }
  10. /**
  1. *
  2. * @return int The number of requests per minute.
  3. */
  4. private function getRequestsPerMinute(): int
  5. {
  6. return rand(10, 100);
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. }
  8. /**
  9. * Gets memory usage information.
  10. *
  1. */
  2. private function getUsagePatterns(): array
  3. {
  4. return [
  5. 'peak_hours' => [9, 10, 11, 14, 15, 16],
  6. 'avg_concurrent_users' => rand(10, 100),
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. 'most_used_endpoints' => [
  8. '/api/chat' => rand(100, 500),
  9. '/api/status' => rand(50, 200),
  10. '/api/health' => rand(20, 100)
  11. ]
  1. * @return float The CPU usage percentage.
  2. */
  3. private function getCpuUsage(): float
  4. {
  5. // Simulate CPU usage
  6. return round(rand(10, 80) / 10, 1);
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. }
  8. /**
  9. * Gets disk space information.
  10. *
  1. return [
  2. 'peak_hours' => [9, 10, 11, 14, 15, 16],
  3. 'avg_concurrent_users' => rand(10, 100),
  4. 'most_used_endpoints' => [
  5. '/api/chat' => rand(100, 500),
  6. '/api/status' => rand(50, 200),
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. '/api/health' => rand(20, 100)
  8. ]
  9. ];
  10. }
  1. * @return int The error count.
  2. */
  3. private function getErrorCount(): int
  4. {
  5. // Simulate low error count for healthy status
  6. return rand(0, 5);
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. }
  8. /**
  9. * Gets the average response time (simulated).
  10. *
  1. private function getErrorTrends(): array
  2. {
  3. // Simulate error trends
  4. return [
  5. 'hourly' => array_map(function ($hour) {
  6. return ['hour' => $hour, 'errors' => rand(0, 5)];
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. }, range(0, 23)),
  8. 'daily' => array_map(function ($day) {
  9. return ['day' => $day, 'errors' => rand(0, 50)];
  10. }, range(1, 7))
  11. ];
  1. {
  2. return [
  3. 'peak_hours' => [9, 10, 11, 14, 15, 16],
  4. 'avg_concurrent_users' => rand(10, 100),
  5. 'most_used_endpoints' => [
  6. '/api/chat' => rand(100, 500),
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. '/api/status' => rand(50, 200),
  8. '/api/health' => rand(20, 100)
  9. ]
  10. ];
  11. }
  1. // Simulate response time history
  2. $history = [];
  3. for ($i = 0; $i < 24; $i++) {
  4. $history[] = [
  5. 'hour' => $i,
  6. 'avg_response_time' => rand(100, 800) / 10
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. ];
  8. }
  9. return $history;
  10. }
  1. $metrics = [
  2. 'request_rate' => rand(20, 80),
  3. 'average_latency' => rand(100, 300),
  4. 'error_frequency' => rand(0, 10),
  5. 'uptime_percentage' => rand(95, 100),
  6. 'total_requests' => rand(1000, 5000)
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. ];
  8. // Store current metrics for persistence
  9. $this->historyStorage->storeMetrics($metrics);
  1. */
  2. public function getPerformanceData(string $range = '24h'): array
  3. {
  4. // Generate current metrics
  5. $metrics = [
  6. 'request_rate' => rand(20, 80),
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. 'average_latency' => rand(100, 300),
  8. 'error_frequency' => rand(0, 10),
  9. 'uptime_percentage' => rand(95, 100),
  10. 'total_requests' => rand(1000, 5000)
  11. ];
  1. {
  2. // Generate current metrics
  3. $metrics = [
  4. 'request_rate' => rand(20, 80),
  5. 'average_latency' => rand(100, 300),
  6. 'error_frequency' => rand(0, 10),
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. 'uptime_percentage' => rand(95, 100),
  8. 'total_requests' => rand(1000, 5000)
  9. ];
  10. // Store current metrics for persistence
  1. public function getPerformanceData(string $range = '24h'): array
  2. {
  3. // Generate current metrics
  4. $metrics = [
  5. 'request_rate' => rand(20, 80),
  6. 'average_latency' => rand(100, 300),
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. 'error_frequency' => rand(0, 10),
  8. 'uptime_percentage' => rand(95, 100),
  9. 'total_requests' => rand(1000, 5000)
  10. ];
  1. $history[] = [
  2. 'timestamp' => $timestamp,
  3. 'latency' => rand(50, 200),
  4. 'error_rate' => rand(0, 5),
  5. 'requests' => rand(10, 50),
  6. 'uptime' => rand(95, 100)
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. ];
  8. }
  9. return array_reverse($history);
  10. }
  1. $timestamp = $baseTime - ($i * $interval);
  2. $history[] = [
  3. 'timestamp' => $timestamp,
  4. 'latency' => rand(50, 200),
  5. 'error_rate' => rand(0, 5),
  6. 'requests' => rand(10, 50),
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. 'uptime' => rand(95, 100)
  8. ];
  9. }
  10. return array_reverse($history);
  1. for ($i = 0; $i < $points; $i++) {
  2. $timestamp = $baseTime - ($i * $interval);
  3. $history[] = [
  4. 'timestamp' => $timestamp,
  5. 'latency' => rand(50, 200),
  6. 'error_rate' => rand(0, 5),
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. 'requests' => rand(10, 50),
  8. 'uptime' => rand(95, 100)
  9. ];
  10. }
  1. for ($i = 0; $i < $points; $i++) {
  2. $timestamp = $baseTime - ($i * $interval);
  3. $history[] = [
  4. 'timestamp' => $timestamp,
  5. 'latency' => rand(50, 200),
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  6. 'error_rate' => rand(0, 5),
  7. 'requests' => rand(10, 50),
  8. 'uptime' => rand(95, 100)
  9. ];
  10. }
  1. // Generate current metrics
  2. $metrics = [
  3. 'request_rate' => rand(20, 80),
  4. 'average_latency' => rand(100, 300),
  5. 'error_frequency' => rand(0, 10),
  6. 'uptime_percentage' => rand(95, 100),
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. 'total_requests' => rand(1000, 5000)
  8. ];
  9. // Store current metrics for persistence
  10. $this->historyStorage->storeMetrics($metrics);
  1. $CLICSHOPPING_MessageStack = Registry::get('MessageStack');
  2. if ($this->_replace === true) {
  3. while (file_exists($this->_destination . DIRECTORY_SEPARATOR . $this->getFilename())) {
  4. $salt = md5(rand(1, 100000));
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  5. $salt = substr($salt, 0, 10);
  6. $this->setFilename($salt . '_' . $this->getFilename());
  7. }
  8. }
  1. if (isset($_GET[$this->_file])) {
  2. $temp_filename = 'temp_' . mt_rand(100000, 999999);
  3. while (file_exists(CLICSHOPPING::BASE_DIR . 'Work/Temp/' . $temp_filename)) {
  4. $temp_filename = 'temp_' . mt_rand(100000, 999999);
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  5. }
  6. $input = fopen('php://input', 'r');
  7. $size = file_put_contents(CLICSHOPPING::BASE_DIR . 'Work/Temp/' . $temp_filename, $input);
  1. public function check(): bool
  2. {
  3. $CLICSHOPPING_MessageStack = Registry::get('MessageStack');
  4. if (isset($_GET[$this->_file])) {
  5. $temp_filename = 'temp_' . mt_rand(100000, 999999);
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  6. while (file_exists(CLICSHOPPING::BASE_DIR . 'Work/Temp/' . $temp_filename)) {
  7. $temp_filename = 'temp_' . mt_rand(100000, 999999);
  8. }
  1. for ($i = 100; $i > 0; $i--) {
  2. $this->performanceHistory[] = [
  3. 'timestamp' => $now - ($i * 900), // Every 15 minutes
  4. 'requests' => rand(100, 1000),
  5. 'latency' => rand(50, 200),
  6. 'error_rate' => rand(0, 5),
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. 'status' => rand(1, 100) > 98 ? 'down' : 'up'
  8. ];
  9. }
  10. }
  11. }
  1. $now = time();
  2. for ($i = 100; $i > 0; $i--) {
  3. $this->performanceHistory[] = [
  4. 'timestamp' => $now - ($i * 900), // Every 15 minutes
  5. 'requests' => rand(100, 1000),
  6. 'latency' => rand(50, 200),
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. 'error_rate' => rand(0, 5),
  8. 'status' => rand(1, 100) > 98 ? 'down' : 'up'
  9. ];
  10. }
  11. }
  1. $this->performanceHistory[] = [
  2. 'timestamp' => $now - ($i * 900), // Every 15 minutes
  3. 'requests' => rand(100, 1000),
  4. 'latency' => rand(50, 200),
  5. 'error_rate' => rand(0, 5),
  6. 'status' => rand(1, 100) > 98 ? 'down' : 'up'
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. ];
  8. }
  9. }
  10. }
  1. {
  2. $now = time();
  3. for ($i = 100; $i > 0; $i--) {
  4. $this->performanceHistory[] = [
  5. 'timestamp' => $now - ($i * 900), // Every 15 minutes
  6. 'requests' => rand(100, 1000),
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. 'latency' => rand(50, 200),
  8. 'error_rate' => rand(0, 5),
  9. 'status' => rand(1, 100) > 98 ? 'down' : 'up'
  10. ];
  11. }
  1. *
  2. * @return string Returns the anti-spam numeric confirmation string for display or verification purposes.
  3. */
  4. public static function getConfirmationNumericAntiSpam(): string
  5. {
  6. $random_number = rand(1, 200);
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. $number = $random_number + 3;
  8. $antispam = ' (' . $random_number . ' + ' . CLICSHOPPING::getDef('text_antispam') . ') x 1';
  9. $_SESSION['createResponseAntiSpam'] = md5($number);
  1. *
  2. * @return string The temporary password.
  3. */
  4. private function generateTemporaryPassword(): string
  5. {
  6. return substr(md5(uniqid(rand(), true)), 0, 8);
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. }
  8. /**
  9. * Inserts the primary customer record into the :table_customers table.
  10. *
  1. *
  2. * @return string The temporary password.
  3. */
  4. private function generateTemporaryPassword(): string
  5. {
  6. return substr(md5(uniqid(rand(), true)), 0, 8);
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. }
  8. /**
  9. * Inserts the primary customer record into the :table_customers table.
  10. *
  1. $code_length = max(4, min(8, $code_length)); // Limiter entre 4 et 8
  2. $verification_code = '';
  3. for ($i = 0; $i < $code_length; $i++) {
  4. $verification_code .= mt_rand(0, 9);
    The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  5. }
  6. $expiry_minutes = defined('EMAIL_VERIFICATION_CODE_EXPIRY') ? (int)EMAIL_VERIFICATION_CODE_EXPIRY : 15;
  7. $expiry_time = date('Y-m-d H:i:s', time() + ($expiry_minutes * 60));
  1. * @return string The sanitized or generated product model.
  2. */
  3. public function getProductModel(): string
  4. {
  5. if (empty($_POST['products_model'])) {
  6. $rand = rand();
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. $products_model = \defined('CONFIGURATION_PREFIX_MODEL') ? CONFIGURATION_PREFIX_MODEL . $rand : '';
  8. } else {
  9. $products_model = HTML::sanitize($_POST['products_model']);
  10. }
  1. $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
  2. $charactersLength = strlen($characters);
  3. $randomString = '';
  4. for ($i = 0; $i < $length; $i++) {
  5. $randomString .= $characters[rand(0, $charactersLength - 1)];
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  6. }
  7. return $randomString;
  8. }
  9. /**
  1. $error = true;
  2. $CLICSHOPPING_MessageStack->add($CLICSHOPPING_Customers->getDef('error_email_address_exist'), 'error');
  3. }
  4. if ($error === false) {
  5. $customers_password = 'clicshopping_' . rand(5, 500);
    The function rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
    Time to fix: about 2 hours
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  6. // Autorisation aux clients de modifier informations societe et adresse principal + Ajout adresse
  7. if ($customers_modify_company !== 1) {
  8. $customers_modify_company = 0;
  9. }

Your project uses legacy callable syntax instead of first-class callable syntax 25

More information: https://insight.symfony.com/what-we-analyse/php.use_first_class_callable_syntax

New rule! We've recently added this rule to Insight. Don't be surprised to see new suggestions even though the codebase didn't change.
  1. if (class_exists('Memcached')) {
  2. $this->orig_module_name = session_module_name();
  3. session_set_save_handler(
  4. [$this, 'open'],
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  5. [$this, 'close'],
  6. [$this, 'read'],
  7. [$this, 'write'],
  8. [$this, 'destroy'],
  9. [$this, 'gc']
  • gyakutsuki

    change but there are false posittive
  1. [$this, 'open'],
  2. [$this, 'close'],
  3. [$this, 'read'],
  4. [$this, 'write'],
  5. [$this, 'destroy'],
  6. [$this, 'gc']
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. );
  8. }
  9. }
  10. /**
  • gyakutsuki

    change but there are false posittive
  1. session_set_save_handler(
  2. [$this, 'open'],
  3. [$this, 'close'],
  4. [$this, 'read'],
  5. [$this, 'write'],
  6. [$this, 'destroy'],
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. [$this, 'gc']
  8. );
  9. }
  10. }
  • gyakutsuki

    change but there are false posittive
  1. session_set_save_handler(
  2. [$this, 'open'],
  3. [$this, 'close'],
  4. [$this, 'read'],
  5. [$this, 'write'],
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  6. [$this, 'destroy'],
  7. [$this, 'gc']
  8. );
  9. }
  10. }
  • gyakutsuki

    change but there are false posittive
  1. $this->orig_module_name = session_module_name();
  2. session_set_save_handler(
  3. [$this, 'open'],
  4. [$this, 'close'],
  5. [$this, 'read'],
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  6. [$this, 'write'],
  7. [$this, 'destroy'],
  8. [$this, 'gc']
  9. );
  10. }
  • gyakutsuki

    change but there are false posittive
  1. if (class_exists('Memcached')) {
  2. $this->orig_module_name = session_module_name();
  3. session_set_save_handler(
  4. [$this, 'open'],
  5. [$this, 'close'],
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  6. [$this, 'read'],
  7. [$this, 'write'],
  8. [$this, 'destroy'],
  9. [$this, 'gc']
  10. );
  • gyakutsuki

    change but there are false posittive
  1. $this->db = Registry::get('Db');
  2. }
  3. // Register shutdown function to flush buffer
  4. if ($bufferEnabled) {
  5. register_shutdown_function([$this, 'flushBuffer']);
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  6. }
  7. $this->stats = new SecurityStatistics();
  8. }
  • gyakutsuki

    change but there are false posittive
  1. return $document;
  2. }
  3. public function embedDocuments(array $documents): array
  4. {
  5. return array_map([$this, 'embedDocument'], $documents);
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  6. }
  7. public function getEmbeddingLength(): int
  8. {
  9. return NewVector::getEmbeddingLength();
  • gyakutsuki

    change but there are false posittive
  1. [$this, 'open'],
  2. [$this, 'close'],
  3. [$this, 'read'],
  4. [$this, 'write'],
  5. [$this, 'destroy'],
  6. [$this, 'gc']
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. );
  8. }
  9. }
  10. /**
  • gyakutsuki

    change but there are false posittive
  1. $this->orig_module_name = session_module_name();
  2. session_set_save_handler(
  3. [$this, 'open'],
  4. [$this, 'close'],
  5. [$this, 'read'],
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  6. [$this, 'write'],
  7. [$this, 'destroy'],
  8. [$this, 'gc']
  9. );
  10. }
  • gyakutsuki

    change but there are false posittive
  1. if (class_exists('\Redis')) {
  2. $this->orig_module_name = session_module_name();
  3. session_set_save_handler(
  4. [$this, 'open'],
  5. [$this, 'close'],
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  6. [$this, 'read'],
  7. [$this, 'write'],
  8. [$this, 'destroy'],
  9. [$this, 'gc']
  10. );
  • gyakutsuki

    change but there are false posittive
  1. if (class_exists('\Redis')) {
  2. $this->orig_module_name = session_module_name();
  3. session_set_save_handler(
  4. [$this, 'open'],
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  5. [$this, 'close'],
  6. [$this, 'read'],
  7. [$this, 'write'],
  8. [$this, 'destroy'],
  9. [$this, 'gc']
  • gyakutsuki

    change but there are false posittive
  1. session_set_save_handler(
  2. [$this, 'open'],
  3. [$this, 'close'],
  4. [$this, 'read'],
  5. [$this, 'write'],
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  6. [$this, 'destroy'],
  7. [$this, 'gc']
  8. );
  9. }
  10. }
  • gyakutsuki

    change but there are false posittive
  1. session_set_save_handler(
  2. [$this, 'open'],
  3. [$this, 'close'],
  4. [$this, 'read'],
  5. [$this, 'write'],
  6. [$this, 'destroy'],
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  7. [$this, 'gc']
  8. );
  9. }
  10. }
  • gyakutsuki

    change but there are false posittive
  1. if (!isset($args[2])) {
  2. $args[2] = $this->vendor . '-' . $this->code;
  3. }
  4. return call_user_func_array([$this->lang, 'getDef'], $args);
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  5. }
  6. /**
  7. * Checks whether a definitions file exists for the specified group and optionally a language code.
  8. *
  • gyakutsuki

    change but there are false posittive
  1. return $document;
  2. }
  3. public function embedDocuments(array $documents): array
  4. {
  5. return array_map([$this, 'embedDocument'], $documents);
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  6. }
  7. public function getEmbeddingLength(): int
  8. {
  9. return NewVector::getEmbeddingLength();
  • gyakutsuki

    change but there are false posittive
  1. if (isset($cache)) {
  2. if (!is_array($cache)) {
  3. $cache = [$cache];
  4. }
  5. call_user_func_array([$Q, 'setCache'], $cache);
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  6. }
  7. $Q->execute();
  8. return $Q;
  • gyakutsuki

    change but there are false posittive
  1. $this->read();
  2. }
  3. if (is_array($this->listing) && (count($this->listing) > 0)) {
  4. if ($sort_by_directories === true) {
  5. usort($this->listing, array($this, 'sortListing'));
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  6. }
  7. return $this->listing;
  8. }
  • gyakutsuki

    change but there are false posittive
  1. $page = $matches[2];
  2. }
  3. $args[0] = 'Shop/public/Sites/' . $req_site . DIRECTORY_SEPARATOR . $page;
  4. $url = forward_static_call_array([self::class, 'link'], $args);
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  5. return $url;
  6. }
  7. /**
  • gyakutsuki

    change but there are false posittive
  1. */
  2. public static function getDef(): string
  3. {
  4. $CLICSHOPPING_Language = Registry::get('Language');
  5. return call_user_func_array([$CLICSHOPPING_Language, 'getDef'], func_get_args());
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  6. }
  7. /**
  8. * Checks if the specified route exists by comparing the beginning of the $_GET keys with the given path array.
  9. *
  • gyakutsuki

    change but there are false posittive
  1. */
  2. public static function redirect(): string
  3. {
  4. $args = func_get_args();
  5. $url = call_user_func_array([self::class, 'link'], $args);
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  6. if ((strstr($url, "\n") !== false) || (strstr($url, "\r") !== false)) {
  7. $url = self::link(null, '', false);
  8. }
  • gyakutsuki

    change but there are false posittive
  1. $page = $matches[2];
  2. }
  3. $args[0] = $req_site . DIRECTORY_SEPARATOR . self::getConfig('http_images_path', $req_site) . $page;
  4. $url = forward_static_call_array([static::class, 'link'], $args);
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  5. return $url;
  6. }
  7. /**
  • gyakutsuki

    change but there are false posittive
  1. // Extract tables from DELETE FROM
  2. $tables = array_merge($tables, self::extractDeleteTable($normalizedQuery, $upperQuery));
  3. // Remove duplicates and clean table names
  4. $tables = array_unique($tables);
  5. $tables = array_map([self::class, 'cleanTableName'], $tables);
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  6. $tables = array_filter($tables); // Remove empty strings
  7. return array_values($tables);
  8. }
  • gyakutsuki

    change but there are false posittive
  1. ($this->onOpen)();
  2. }
  3. try {
  4. // Utilisation du streaming de la nouvelle classe Stream
  5. Stream::executeStreaming($parameters, [$this, 'processStreamData']);
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by ClicShopping
  6. } catch (Exception $e) {
  7. throw $e;
  8. } finally {
  9. $this->connected = false;
  • gyakutsuki

    change but there are false posittive
  1. */
  2. public function invalidateCacheByTables(array $tableNames): int
  3. {
  4. $invalidated = 0;
  5. $cleanTableNames = array_map(
  6. [SQLTableParser::class, 'cleanTableName'],
    Use the first-class callable syntax ($this->method(...))
    Time to fix: about 15 minutes
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  7. $tableNames
  8. );
  9. // Invalidate from Redis
  10. if ($this->useRedis && $this->redis) {
  • gyakutsuki

    change but there are false posittive

Your project should use dedicated PHP string functions

More information: https://insight.symfony.com/what-we-analyse/php.use_string_function

  1. // Track statistics
  2. if (strlen($columnComment) > 0) {
  3. $backup_stats['columns_with_comments']++;
  4. }
  5. if (strpos(strtolower($columnType), 'vector') !== false) {
    Consider replacing strpos() with str_contains() for improved readability.
    Time to fix: about 1 hour
    Read doc Permalink Copy Prompt
    Last edited by clicshopping
  6. $backup_stats['vector_columns']++;
  7. }
  8. $schema .= ' ' . $Qfields->value('COLUMN_NAME') . ' ' . $columnType;
  • gyakutsuki

    not included