Merge pull request #36093 from nextcloud/techdebt/noid/improve-share-pw-generation

Improve password generation for link shares

1 files changed, 9 insertions, 6 deletions

diff --git a/apps/files_sharing/src/utils/GeneratePassword.js b/apps/files_sharing/src/utils/GeneratePassword.js
index 6da6076b937..63cc68983a1 100644
--- a/apps/files_sharing/src/utils/GeneratePassword.js
+++ b/apps/files_sharing/src/utils/GeneratePassword.js
@@ -25,6 +25,7 @@ import Config from '../services/ConfigService'
 import { showError, showSuccess } from '@nextcloud/dialogs'
 
 const config = new Config()
+// note: some chars removed on purpose to make them human friendly when read out
 const passwordSet = 'abcdefgijkmnopqrstwxyzABCDEFGHJKLMNPQRSTWXYZ23456789'
 
 /**
@@ -49,10 +50,12 @@ export default async function() {
 		}
 	}
 
-	// generate password of 10 length based on passwordSet
-	return Array(10).fill(0)
-		.reduce((prev, curr) => {
-			prev += passwordSet.charAt(Math.floor(Math.random() * passwordSet.length))
-			return prev
-		}, '')
+	const array = new Uint8Array(10)
+	const ratio = passwordSet.length / 255
+	self.crypto.getRandomValues(array)
+	let password = ''
+	for (let i = 0; i < array.length; i++) {
+		password += passwordSet.charAt(array[i] * ratio)
+	}
+	return password
 }