yesod-core 1.6.19.0 → 1.6.20

raw patch · 4 files changed

+28/−4 lines, 4 filesdep +entropyPVP ok

version bump matches the API change (PVP)

Dependencies added: entropy

API changes (from Hackage documentation)

Files

• ChangeLog.md +5/−0
• src/Yesod/Core/Dispatch.hs +14/−2
• src/Yesod/Core/Types.hs +7/−1
• yesod-core.cabal +2/−1

@@ -1,5 +1,10 @@ # ChangeLog for yesod-core +## 1.6.20++* Generate CSRF tokens using a secure entropy source [#1726](https://github.com/yesodweb/yesod/pull/1726)+* Change semantics of `yreGen` and `defaultGen`+ ## 1.6.19.0  * Change order of priority in `languages`[#1721](https://github.com/yesodweb/yesod/pull/1721)

@@ -46,6 +46,7 @@  import Data.ByteString.Lazy.Char8 () +import Data.Bits ((.|.), finiteBitSize, shiftL) import Data.Text (Text) import qualified Data.ByteString as S import qualified Data.ByteString.Lazy as BL@@ -59,7 +60,7 @@ import Yesod.Core.Internal.Run import Text.Read (readMaybe) import System.Environment (getEnvironment)-import qualified System.Random as Random+import System.Entropy (getEntropy) import Control.AutoUpdate (mkAutoUpdate, defaultUpdateSettings, updateAction, updateFreq) import Yesod.Core.Internal.Util (getCurrentMaxExpiresRFC1123) @@ -92,8 +93,19 @@             , yreGetMaxExpires = getMaxExpires             } +-- | Generate a random number uniformly distributed in the full range+-- of 'Int'.+--+-- Note: Before 1.6.20, this generates pseudo-random number in an+-- unspecified range. The range size may not be a power of 2. Since+-- 1.6.20, this uses a secure entropy source and generates in the full+-- range of 'Int'. defaultGen :: IO Int-defaultGen = Random.getStdRandom Random.next+defaultGen = bsToInt <$> getEntropy bytes+  where+    bits = finiteBitSize (undefined :: Int)+    bytes = div (bits + 7) 8+    bsToInt = S.foldl' (\v i -> shiftL v 8 .|. fromIntegral i) 0  -- | Pure low level function to construct WAI application. Usefull -- when you need not standard way to run your app, or want to embed it

@@ -196,7 +196,13 @@     , yreSite           :: !site     , yreSessionBackend :: !(Maybe SessionBackend)     , yreGen            :: !(IO Int)-    -- ^ Generate a random number+    -- ^ Generate a random number uniformly distributed in the full+    -- range of 'Int'.+    --+    -- Note: Before 1.6.20, the default value generates pseudo-random+    -- number in an unspecified range. The range size may not be a power+    -- of 2. Since 1.6.20, the default value uses a secure entropy source+    -- and generates in the full range of 'Int'.     , yreGetMaxExpires  :: !(IO Text)     } 

@@ -1,5 +1,5 @@ name:            yesod-core-version:         1.6.19.0+version:         1.6.20 license:         MIT license-file:    LICENSE author:          Michael Snoyman <michael@snoyman.com>@@ -39,6 +39,7 @@                    , containers            >= 0.2                    , cookie                >= 0.4.3    && < 0.5                    , deepseq               >= 1.3+                   , entropy                    , fast-logger           >= 2.2                    , http-types            >= 0.7                    , memory