From b7667b65ebfecc92e9fddb0628ecb59161f96403 Mon Sep 17 00:00:00 2001
From: chenping <chenping@shopex.cn>
Date: Mon, 6 Jul 2026 21:10:22 +0800
Subject: [PATCH] =?UTF-8?q?[TBID:SCRUM-7404]=20fix:=20=E4=BF=AE=E5=A4=8DSQ?=
 =?UTF-8?q?L=E6=B3=A8=E5=85=A5=E6=BC=8F=E6=B4=9E?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

# Conflicts:
#	app/taoexlib/lib/request/sms.php
---
 app/taoexlib/lib/request/sms.php | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/app/taoexlib/lib/request/sms.php b/app/taoexlib/lib/request/sms.php
index f5ecee3e..5466fa33 100644
--- a/app/taoexlib/lib/request/sms.php
+++ b/app/taoexlib/lib/request/sms.php
@@ -249,13 +249,29 @@ class taoexlib_request_sms{
         return md5($str . md5($token));
     }
 
+    /**
+     * 生成高熵回调 code（避免 microtime 可被穷举）
+     * @return string
+     */
+    protected static function generate_sms_callback_code()
+    {
+        if (function_exists('random_bytes')) {
+            return bin2hex(random_bytes(16));
+        }
+        if (function_exists('openssl_random_pseudo_bytes')) {
+            return bin2hex(openssl_random_pseudo_bytes(16));
+        }
+
+        return md5(uniqid((string) mt_rand(), true) . base_certificate::get('certificate_id'));
+    }
+
     /**
      * 刷新短信回调 code 并写入 kv（带过期时间）
      * @return string
      */
     public static function refresh_sms_callback_code()
     {
-        $code = md5(microtime());
+        $code = self::generate_sms_callback_code();
         base_kvstore::instance('taoexlib')->store(
             self::SMS_CALLBACK_CODE_KEY,
             $code,