Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.The getToken() function uses the PHP shuffle() function.
The PHP documention on shuffle() specifies the following:
"It uses a pseudo random number generator that is not suitable for cryptographic purposes."
This is because shuffle() is implemented using the C rand() function.
It would be safer to generate the tokens using a native Drupal function like drupal_random_bytes https://api.drupal.org/api/drupal/includes%21bootstrap.inc/function/drup...
This should be fixed for 6.x 7.x and 8.x
Comments
Comment #2
sam hermans commentedComment #3
sam hermans commented