mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

rand() + uniqid() are not from cryptographic quality

This commit is contained in:
Lukas Reschke 2012-09-29 15:33:10 +02:00
parent 578aa4e425
commit 36f1c9b083
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
core/lostpassword/index.php
View File

@ -13,7 +13,7 @@ require_once '../../lib/base.php';
// Someone lost their password: // Someone lost their password:
if (isset($_POST['user'])) { if (isset($_POST['user'])) {
if (OC_User::userExists($_POST['user'])) { if (OC_User::userExists($_POST['user'])) {
$token = sha1($_POST['user'].md5(uniqid(rand(), true))); $token = hash("sha256", $_POST['user'].openssl_random_pseudo_bytes(10, $cstrong));
OC_Preferences::setValue($_POST['user'], 'owncloud', 'lostpassword', $token); OC_Preferences::setValue($_POST['user'], 'owncloud', 'lostpassword', $token);
$email = OC_Preferences::getValue($_POST['user'], 'settings', 'email', ''); $email = OC_Preferences::getValue($_POST['user'], 'settings', 'email', '');
if (!empty($email)) { if (!empty($email)) {