From 2f5c7a10b7193c6176aa3c149e9872bbb4399bf7 Mon Sep 17 00:00:00 2001 From: Arinerron Date: Wed, 5 Apr 2017 16:16:01 -0700 Subject: [PATCH] Fix cryptographically insecure CSRF tokens --- web/login/index.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/login/index.php b/web/login/index.php index 4be64eccb..d2aacefd7 100644 --- a/web/login/index.php +++ b/web/login/index.php @@ -126,7 +126,7 @@ if (empty($_SESSION['language'])) { } // Generate CSRF token -$_SESSION['token'] = md5(uniqid(mt_rand(), true)); +$_SESSION['token'] = bin2hex(openssl_random_pseudo_bytes(16)); // generate 32-character cryptographically secure token require_once($_SERVER['DOCUMENT_ROOT'].'/inc/i18n/'.$_SESSION['language'].'.php'); require_once('../templates/header.html');