Description: Multisite: Use `wp_rand()` in signup key creation.
Author: jeremyfelt
Origin: upstream, https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4
Bug-Debian: https://bugs.debian.org/851310
Applied-Upstream: 4.7.1
Reviewed-by: Craig Small <csmall@debian.org>
Last-Update: 2017-01-14
--- a/wp-includes/ms-functions.php
+++ b/wp-includes/ms-functions.php
@@ -713,7 +713,7 @@
 function wpmu_signup_blog( $domain, $path, $title, $user, $user_email, $meta = array() )  {
 	global $wpdb;
 
-	$key = substr( md5( time() . rand() . $domain ), 0, 16 );
+	$key = substr( md5( time() . wp_rand() . $domain ), 0, 16 );
 	$meta = serialize($meta);
 
 	$wpdb->insert( $wpdb->signups, array(
@@ -748,7 +748,7 @@
 	// Format data
 	$user = preg_replace( '/\s+/', '', sanitize_user( $user, true ) );
 	$user_email = sanitize_email( $user_email );
-	$key = substr( md5( time() . rand() . $user_email ), 0, 16 );
+	$key = substr( md5( time() . wp_rand() . $user_email ), 0, 16 );
 	$meta = serialize($meta);
 
 	$wpdb->insert( $wpdb->signups, array(
