Fix cryptographically insecure CSRF tokens

Arinerron · web-flow · commit 2f5c7a10b719 · 2017-04-05T16:16:01.000-07:00
diff --git a/web/login/index.php b/web/login/index.php
@@ -126,7 +126,7 @@
 }
 
 // Generate CSRF token
-$_SESSION['token'] = md5(uniqid(mt_rand(), true));
+$_SESSION['token'] = bin2hex(openssl_random_pseudo_bytes(16)); // generate 32-character cryptographically secure token
 
 require_once($_SERVER['DOCUMENT_ROOT'].'/inc/i18n/'.$_SESSION['language'].'.php');
 require_once('../templates/header.html');

Original file line number	Diff line number	Diff line change
`@@ -126,7 +126,7 @@`
`126`	`126`	`}`
`127`	`127`
`128`	`128`	`// Generate CSRF token`
`129`		`-$_SESSION['token'] = md5(uniqid(mt_rand(), true));`
	`129`	`+$_SESSION['token'] = bin2hex(openssl_random_pseudo_bytes(16)); // generate 32-character cryptographically secure token`
`130`	`130`
`131`	`131`	`require_once($_SERVER['DOCUMENT_ROOT'].'/inc/i18n/'.$_SESSION['language'].'.php');`
`132`	`132`	`require_once('../templates/header.html');`