make password reset token completely random

No need for HMAC here because there's no length attack vector here. We
only care for the existance of the file and each reset request is
completely (random) independent from each other.

Conflicts:
	inc/auth.php

1 files changed, 1 insertions, 1 deletions

diff --git a/inc/auth.php b/inc/auth.php
index 0f3dc8b46..6107645cd 100644
--- a/inc/auth.php
+++ b/inc/auth.php
@@ -1007,7 +1007,7 @@ function act_resendpwd() {
         }
 
         // generate auth token
-        $token = md5(auth_cookiesalt().$user); //secret but user based
+        $token = md5(uniqid(mt_rand(), true)); // random secret
         $tfile = $conf['cachedir'].'/'.$token{0}.'/'.$token.'.pwauth';
         $url   = wl('', array('do'=> 'resendpwd', 'pwauth'=> $token), true, '&');