From 85f9869f6925ef52c1015916bbc28e13c15abc73 Mon Sep 17 00:00:00 2001
From: Tom Needham <needham.thomas@gmail.com>
Date: Wed, 4 Apr 2012 13:17:03 +0000
Subject: [PATCH] Make the token really random

---
 core/lostpassword/index.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/lostpassword/index.php b/core/lostpassword/index.php
index 9529c0c957c..a9b7d10804f 100644
--- a/core/lostpassword/index.php
+++ b/core/lostpassword/index.php
@@ -12,7 +12,7 @@ require_once('../../lib/base.php');
 // Someone lost their password:
 if (isset($_POST['user'])) {
 	if (OC_User::userExists($_POST['user'])) {
-		$token = sha1($_POST['user'].uniqId());
+		$token = sha1($_POST['user'].md5(uniqid(rand(), true)));
 		OC_Preferences::setValue($_POST['user'], 'owncloud', 'lostpassword', $token);
 		$email = OC_Preferences::getValue($_POST['user'], 'settings', 'email', '');
 		if (!empty($email)) {
-- 
2.39.5