Make cache id generation less predictable. Fixes #2326

carrierwaveuploader · May 16, 2019 · 818ad98 · 818ad98
1 parent eb9c52e
commit 818ad98
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/lib/carrierwave/uploader/cache.rb b/lib/carrierwave/uploader/cache.rb
@@ -1,3 +1,5 @@
+require 'securerandom'
+
 module CarrierWave
 
   class FormNotMultipart < UploadError
@@ -24,8 +26,8 @@ def self.increment
   def self.generate_cache_id
     [Time.now.utc.to_i,
       Process.pid,
-      '%04d' % (CarrierWave::CacheCounter.increment % 1000),
-      '%04d' % rand(9999)
+      '%04d' % (CarrierWave::CacheCounter.increment % 10000),
+      '%04d' % SecureRandom.random_number(10000)
     ].map(&:to_s).join('-')
   end