Making the secret key source a bit more robust for existing installations

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 3ea935a..fd3a83d 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -526,7 +526,7 @@ $wgProxyScriptPath = "$IP/proxy_check.php";
 /** */
 $wgProxyMemcExpiry = 86400;
 /** This should always be customised in LocalSettings.php */
-$wgSecretKey = 'W1svekXc5u6lZllTZOwnzEk1nbs';
+$wgSecretKey = false;
 /** big list of banned IP addresses, in the keys not the values */
 $wgProxyList = array();
 

diff --git a/includes/User.php b/includes/User.php
index ceccb18..359ce10 100644 (file)
--- a/includes/User.php
+++ b/includes/User.php
@@ -592,8 +592,15 @@ class User {
 
        # Set the random token (used for persistent authentication)
        function setToken( $token = false ) {
-               global $wgSecretKey, $wgDBname;
+               global $wgSecretKey, $wgProxyKey, $wgDBname;
                if ( !$token ) {
+                       if ( $wgSecretKey ) {
+                               $key = $wgSecretKey;
+                       } elseif ( $wgProxyKey ) {
+                               $key = $wgProxyKey;
+                       } else {
+                               $key = microtime();
+                       }
                        $this->mToken = md5( $wgSecretKey . mt_rand( 0, 0x7fffffff ) . $wgDBname . $this->mId );
                } else {
                        $this->mToken = $token;