! should use tokenizer here, but for now a simple update in install

elkarte · Jan 7, 2020 · 1a8aded · 1a8aded
1 parent ea6606f
commit 1a8aded
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/install/Install_Controller.php b/install/Install_Controller.php
@@ -1067,7 +1067,7 @@ private function action_adminAccount()
 			{
 				require_once(SUBSDIR . '/Auth.subs.php');
 
-				$incontext['member_salt'] = substr(md5(mt_rand()), 0, 4);
+				$incontext['member_salt'] = substr(sha1(mt_rand() . microtime()), 0, 16);
 
 				// Format the username properly.
 				$_POST['username'] = preg_replace('~[\t\n\r\x0B\0\xA0]+~', ' ', $_POST['username']);

diff --git a/install/upgrade.php b/install/upgrade.php
@@ -869,7 +869,7 @@ function checkLogin()
 					if ($valid_password)
 					{
 						$password = validateLoginPassword($_POST['passwrd'], '', $_POST['user'], true);
-						$password_salt = substr(md5(mt_rand()), 0, 4);
+						$password_salt = substr(sha1(mt_rand() . microtime()), 0, 16);
 
 						// Update the password hash and set up the salt.
 						require_once(SUBSDIR . '/Members.subs.php');