changing Math.random to SecureRandom

1 files changed, 5 insertions, 1 deletions

diff --git a/src/main/java/com/gitblit/models/UserModel.java b/src/main/java/com/gitblit/models/UserModel.java
index d411e504..edbdf028 100644
--- a/src/main/java/com/gitblit/models/UserModel.java
+++ b/src/main/java/com/gitblit/models/UserModel.java
@@ -17,6 +17,7 @@ package com.gitblit.models;
 

 import java.io.Serializable;

 import java.security.Principal;

+import java.security.SecureRandom;

 import java.util.ArrayList;

 import java.util.Collections;

 import java.util.HashSet;

@@ -662,6 +663,9 @@ public class UserModel implements Principal, Serializable, Comparable<UserModel>
 	}

 	

 	public String createCookie() {

-		return StringUtils.getSHA1(String.valueOf(Math.random()));

+		SecureRandom random = new SecureRandom();

+		byte[] values = new byte[20];

+		random.nextBytes(values);

+		return StringUtils.getSHA1(String.valueOf(values));

 	}

 }