Boundaries are not unique on Windows [#2045699]

$boundary = md5(uniqid($_SERVER['REQUEST_TIME']));
$boundary for "multipart/alternative" and $boundary for "multipart/mixed" are equal

We ask me "WHY?"
I don't know!

php 5.4.17
win xp

We need $more_entropy!

function mimemail_multipart_body($parts, $content_type = 'multipart/mixed; charset=utf-8', $sub_part = FALSE) {
-  $boundary = md5(uniqid($_SERVER['REQUEST_TIME']));
+  $boundary = md5(uniqid($_SERVER['REQUEST_TIME'], true));

Comment	File	Size	Author
#4	mimemail-2045699-4-d7.patch	620 bytes	sgabe
#4	mimemail-2045699-4-d6.patch	478 bytes	sgabe

Comments

Comment #1

dmitriy.trt commented 9 August 2013 at 18:28

From the PHP manual discussion:

As others below note, without prefix and without "added entropy", this function simply returns the UNIX timestamp with added microsecond counter as a hex number; it's more or less just microtime(), in hexit form.

[...]

Also worth to note is that since microtime() only works on systems that have gettimeofday() present, which Windows natively DOES NOT, uniqid() might yield just the single-second-resolution UNIX timestamp in a Windows environment.