Use cryptographically secure random generator

cpanfile

@@ -19,3 +19,4 @@ requires 'Locale::Maketext::Extract';
 requires 'File::MimeInfo';
 requires 'IO::Scalar';
 requires 'Image::ExifTool';
+requires 'Data::Entropy';

cpanfile.snapshot

@@ -32,6 +32,13 @@ DISTRIBUTIONS
     requirements:
       Digest::MD5 2.00
       ExtUtils::MakeMaker 0
+  Crypt-Rijndael-1.13
+    pathname: L/LE/LEONT/Crypt-Rijndael-1.13.tar.gz
+    provides:
+      Crypt::Rijndael 1.13
+    requirements:
+      ExtUtils::MakeMaker 0
+      perl 5.006
   DBD-SQLite-1.40
     pathname: I/IS/ISHIGAKI/DBD-SQLite-1.40.tar.gz
     provides:
@@ -143,6 +150,48 @@ DISTRIBUTIONS
       ExtUtils::MakeMaker 6.48
       Test::Simple 0.90
       perl 5.008
+  Data-Entropy-0.007
+    pathname: Z/ZE/ZEFRAM/Data-Entropy-0.007.tar.gz
+    provides:
+      Data::Entropy 0.007
+      Data::Entropy::Algorithms 0.007
+      Data::Entropy::RawSource::CryptCounter 0.007
+      Data::Entropy::RawSource::Local 0.007
+      Data::Entropy::RawSource::RandomOrg 0.007
+      Data::Entropy::RawSource::RandomnumbersInfo 0.007
+      Data::Entropy::Source 0.007
+    requirements:
+      Carp 0
+      Crypt::Rijndael 0
+      Data::Float 0.008
+      Errno 1.00
+      Exporter 0
+      HTTP::Lite 2.2
+      IO::File 1.03
+      Module::Build 0
+      Params::Classify 0
+      Test::More 0
+      constant 0
+      integer 0
+      parent 0
+      perl 5.006
+      strict 0
+      warnings 0
+  Data-Float-0.012
+    pathname: Z/ZE/ZEFRAM/Data-Float-0.012.tar.gz
+    provides:
+      Data::Float 0.012
+    requirements:
+      Carp 0
+      Exporter 0
+      Module::Build 0
+      Test::More 0
+      constant 0
+      integer 0
+      parent 0
+      perl 5.006
+      strict 0
+      warnings 0
   Data-Validate-Domain-0.10
     pathname: N/NE/NEELY/Data-Validate-Domain-0.10.tar.gz
     provides:
@@ -1145,6 +1194,17 @@ DISTRIBUTIONS
       File::Temp 0
       Test::More 0
       Test::Warn 0
+  HTTP-Lite-2.44
+    pathname: N/NE/NEILB/HTTP-Lite-2.44.tar.gz
+    provides:
+      HTTP::Lite 2.44
+    requirements:
+      ExtUtils::MakeMaker 0
+      Fcntl 0
+      Socket 1.3
+      perl 5.005
+      strict 0
+      warnings 0
   IO-Socket-SSL-2.019
     pathname: S/SU/SULLR/IO-Socket-SSL-2.019.tar.gz
     provides:
@@ -1693,6 +1753,20 @@ DISTRIBUTIONS
       Test::More 0.47
       Test::Script 1.06
       perl 5.006
+  Params-Classify-0.013
+    pathname: Z/ZE/ZEFRAM/Params-Classify-0.013.tar.gz
+    provides:
+      Params::Classify 0.013
+    requirements:
+      Exporter 0
+      ExtUtils::ParseXS 2.2006
+      Module::Build 0
+      Scalar::Util 1.01
+      Test::More 0
+      parent 0
+      perl 5.006001
+      strict 0
+      warnings 0
   Params-Util-1.07
     pathname: A/AD/ADAMK/Params-Util-1.07.tar.gz
     provides:

lib/Lutim.pm

@@ -3,6 +3,7 @@ use Mojo::Base 'Mojolicious';
 use Mojo::Util qw(quote);
 use LutimModel;
 use Crypt::CBC;
+use Data::Entropy qw(entropy_source);
 
 $ENV{MOJO_TMPDIR} = 'tmp';
 mkdir($ENV{MOJO_TMPDIR}, 0700) unless (-d $ENV{MOJO_TMPDIR});
@@ -129,7 +130,7 @@ sub startup {
             my @chars  = ('a'..'z','A'..'Z','0'..'9');
             my $result = '';
             foreach (1..$length) {
-                $result .= $chars[rand scalar(@chars)];
+                $result .= $chars[entropy_source->get_int(scalar(@chars))];
             }
             return $result;
         }

templates/about.html.ep

@@ -16,7 +16,7 @@
     <p><%= l('Only the uploader! (well, only if he\'s the only owner of the images\' rights before the upload)') %></p>
     <p><%= l('Unlike many image sharing services, you don\'t give us rights on uploaded images.') %></p>
     <h4><%= l('How to report an image?') %></h4>
-    <p><%= l('Please contact the administrator: %1') %></p>
+    <p><%= l('Please contact the administrator: %1', config('contact')) %></p>
     <h4><%= l('How do you pronounce Lutim?') %></h4>
     <p><%== l('Juste like you pronounce the French word <a href="https://fr.wikipedia.org/wiki/Lutin">lutin</a> (/ly.tɛ̃/).') %></p>
     <h4><%= l('What about the software which provides the service?') %></h4>