Add more randomness to reset password mechanism.

1 files changed, 1 insertions, 1 deletions

diff --git a/modules/user/controllers/password.php b/modules/user/controllers/password.php
index f5190974..38fa66be 100644
--- a/modules/user/controllers/password.php
+++ b/modules/user/controllers/password.php
@@ -52,7 +52,7 @@ class Password_Controller extends Controller {
     $user_name = $form->reset->inputs["name"]->value;
     $user = user::lookup_by_name($user_name);
     if ($user && !empty($user->email)) {
-      $user->hash = md5(rand());
+      $user->hash = md5(uniqid(mt_rand(), true));
       $user->save();
       $message = new View("reset_password.html");
       $message->confirm_url = url::abs_site("password/do_reset?key=$user->hash");