Changeset 43368 for branches/4.9/src/wp-admin/includes/misc.php

Timestamp:

06/16/2018 02:12:55 PM (5 years ago)

Author:

johnbillion

Message:

Security: Harden the random aspect of the hash used for user profile and admin email address changes.

Props BjornW

Fixes #43771

Merges [43367] to the 4.9 branch.

Location:

branches/4.9

Files:

• . (modified) (1 prop)
• src/wp-admin/includes/misc.php (modified) (1 diff)

branches/4.9/src/wp-admin/includes/misc.php

@@ -1159 +1159 @@
     }
 
-    $hash = md5( $value . time() . mt_rand() );
+    $hash = md5( $value . time() . wp_rand() );
     $new_admin_email = array(
         'hash'     => $hash,