Fixed #27635 -- Used secrets module in django.utils.crypto.

django/utils/crypto.py

@@ -3,7 +3,7 @@
 """
 import hashlib
 import hmac
-import random
+import secrets
 
 from django.conf import settings
 from django.utils.encoding import force_bytes
@@ -43,12 +43,12 @@ def get_random_string(length=12,
     The default length of 12 with the a-z, A-Z, 0-9 character set returns
     a 71-bit value. log_2((26+26+10)^12) =~ 71 bits
     """
-    return ''.join(random.choice(allowed_chars) for i in range(length))
+    return ''.join(secrets.choice(allowed_chars) for i in range(length))
 
 
 def constant_time_compare(val1, val2):
     """Return True if the two strings are equal, False otherwise."""
-    return hmac.compare_digest(force_bytes(val1), force_bytes(val2))
+    return secrets.compare_digest(force_bytes(val1), force_bytes(val2))
 
 
 def pbkdf2(password, salt, iterations, dklen=0, digest=None):