Add some security utilities

This adds some security utilities to core including:
- A library for basic crypto operations (e.g. to encrypt passwords)
- A better library for cryptographic actions which allows you to specify the charset
- A library for secure string comparisions

Remove .htaccess

Remove .htaccess

Fix typo

Add public API

Use timing constant comparision

Remove CBC constant

Adjust code

Remove confusing $this

1 files changed, 11 insertions, 6 deletions

diff --git a/lib/private/setup.php b/lib/private/setup.php
index fdf98ab0959..9ea1690b6d9 100644
--- a/lib/private/setup.php
+++ b/lib/private/setup.php
@@ -67,14 +67,19 @@ class OC_Setup {
 		}
 
 		//generate a random salt that is used to salt the local user passwords
-		$salt = OC_Util::generateRandomBytes(30);
-		OC_Config::setValue('passwordsalt', $salt);
+		$salt = \OC::$server->getSecureRandom()->getLowStrengthGenerator()->generate(30);
+		\OC::$server->getConfig()->setSystemValue('passwordsalt', $salt);
+
+		// generate a secret
+		$secret = \OC::$server->getSecureRandom()->getMediumStrengthGenerator()->generate(48);
+		\OC::$server->getConfig()->setSystemValue('secret', $secret);
 
 		//write the config file
-		OC_Config::setValue('trusted_domains', $trustedDomains);
-		OC_Config::setValue('datadirectory', $datadir);
-		OC_Config::setValue('dbtype', $dbtype);
-		OC_Config::setValue('version', implode('.', OC_Util::getVersion()));
+		\OC::$server->getConfig()->setSystemValue('trusted_domains', $trustedDomains);
+		\OC::$server->getConfig()->setSystemValue('datadirectory', $datadir);
+		\OC::$server->getConfig()->setSystemValue('dbtype', $dbtype);
+		\OC::$server->getConfig()->setSystemValue('version', implode('.', OC_Util::getVersion()));
+
 		try {
 			$dbSetup->initialize($options);
 			$dbSetup->setupDatabase($username);