strk/friendica
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Update lostpass.php

Browse source 
use CSPRNG for password reset token generation
This commit is contained in:
Lynn Stephenson 2020-04-04 08:06:49 +00:00 committed by GitHub
parent efd549d466
commit f459a35cf4
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
mod/lostpass.php
View file

@ -41,7 +41,7 @@ function lostpass_post(App $a)
DI::baseUrl()->redirect(); DI::baseUrl()->redirect();
} }
$pwdreset_token = Strings::getRandomName(12) . random_int(1000, 9999); $pwdreset_token = Strings::getRandomHex(32);
$fields = [ $fields = [
'pwdreset' => $pwdreset_token, 'pwdreset' => $pwdreset_token,