Ticket #1180: ticket_1180__rev_8168-getrandbits.diff

django/contrib/sessions/backends/base.py

@@ -2 +2 @@
 import md5
 import os
 import random
-import sys
 import time
 from datetime import datetime, timedelta
 try:
@@ -20 +19 @@
     """
     TEST_COOKIE_NAME = 'testcookie'
     TEST_COOKIE_VALUE = 'worked'
+    RANDOM_BITS = 64
 
     def __init__(self, session_key=None):
         self._session_key = session_key
@@ -111 +111 @@
         "Returns session key that isn't being used."
         # The random module is seeded when this Apache child is created.
         # Use settings.SECRET_KEY as added salt.
+        # Using 63 bits wide RAND_MAX means collision probability at
+        # around 3,000,000,000 keys (that should be quite enough)
+        # due to the birthday paradox:
+        # int(sqrt((2 << 62) - 2)) == 3037000499
         try:
             pid = os.getpid()
         except AttributeError:
             # No getpid() in Jython, for example
             pid = 1
         while 1:
-            session_key = md5.new("%s%s%s%s" % (random.randint(0, sys.maxint - 1),
-                                  pid, time.time(), settings.SECRET_KEY)).hexdigest()
+            session_key = md5.new("%s%s%s%s" %
+                    (random.getrandbits(self.RANDOM_BITS), pid,
+                        time.time(), settings.SECRET_KEY)).hexdigest()
             if not self.exists(session_key):
                 break
         return session_key