fixes GHSA-hghg-37rg-7r42 increase security on secret_key

install.php

@@ -351,7 +351,7 @@ define(\'DB_COLLATE\', \'\');
 
     $query = '
 INSERT INTO '.$prefixeTable.'config (param,value,comment) 
-   VALUES (\'secret_key\',md5('.pwg_db_cast_to_text(DB_RANDOM_FUNCTION.'()').'),
+   VALUES (\'secret_key\',\''.sha1(random_bytes(1000)).'\'),
    \'a secret key specific to the gallery for internal use\');';
     pwg_query($query);
 

install/db/174-database.php

@@ -0,0 +1,20 @@
+<?php
+// +-----------------------------------------------------------------------+
+// | This file is part of Piwigo.                                          |
+// |                                                                       |
+// | For copyright and license information, please view the COPYING.txt    |
+// | file that was distributed with this source code.                      |
+// +-----------------------------------------------------------------------+
+
+if (!defined('PHPWG_ROOT_PATH'))
+{
+  die('Hacking attempt!');
+}
+
+$upgrade_description = 'increase security on secret_key';
+
+conf_update_param('secret_key', sha1(random_bytes(1000)), true);
+
+echo "\n".$upgrade_description."\n";
+
+?>