use SecureRandom to generate tokens and secrets

vladansarac · Oct 22, 2012 · c6a56a7 · c6a56a7
1 parent 4d88815
commit c6a56a7
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 4 deletions.
diff --git a/app/models/feed.rb b/app/models/feed.rb
@@ -51,9 +51,8 @@ def author
   end
 
   def populate(finger_data)
-    # TODO: More entropy would be nice
-    self.verify_token = Digest::MD5.hexdigest(rand.to_s)
-    self.secret = Digest::MD5.hexdigest(rand.to_s)
+    self.verify_token = SecureRandom.hex
+    self.secret       = SecureRandom.hex
 
     ostatus_feed = OStatus::Feed.from_url(url)
 

diff --git a/app/models/user.rb b/app/models/user.rb
@@ -90,7 +90,7 @@ def finalize
 
   # Generate a multi-use token for account confirmation and password resets
   def set_perishable_token
-    self.perishable_token = Digest::MD5.hexdigest( rand.to_s )
+    self.perishable_token = SecureRandom.hex
     save
   end