From cb7168f5362cd2f8d5667b33e5c9a899a116961a Mon Sep 17 00:00:00 2001
From: Arinerron <me@arinerron.com>
Date: Wed, 5 Apr 2017 16:18:44 -0700
Subject: [PATCH] Fix cryptographically insecure CSRF token bug

---
 web/inc/main.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/web/inc/main.php b/web/inc/main.php
index 75482cd1b..1356ec35f 100644
--- a/web/inc/main.php
+++ b/web/inc/main.php
@@ -59,10 +59,10 @@ if ((!isset($_SESSION['user'])) && (!defined('NO_AUTH_REQUIRED'))) {
     exit;
 }
 
+// Generate CSRF token
 if (isset($_SESSION['user'])) {
     if(!isset($_SESSION['token'])){
-        $token = uniqid(mt_rand(), true);
-        $_SESSION['token'] = $token;
+        $_SESSION['token'] = bin2hex(openssl_random_pseudo_bytes(16));
     }
 }