More secure tokens

api/funkwhale_api/users/models.py

@@ -1,9 +1,7 @@
 # -*- coding: utf-8 -*-
 from __future__ import absolute_import, unicode_literals
 
-import binascii
 import datetime
-import os
 import random
 import string
 import uuid
@@ -31,8 +29,9 @@ from funkwhale_api.federation import models as federation_models
 from funkwhale_api.federation import utils as federation_utils
 
 
-def get_token(length=15):
-    return binascii.b2a_hex(os.urandom(length)).decode("utf-8")
+def get_token(length=30):
+    choices = string.ascii_lowercase + string.ascii_uppercase + "0123456789"
+    return "".join(random.choice(choices) for i in range(length))
 
 
 PERMISSIONS_CONFIGURATION = {

api/funkwhale_api/users/oauth/views.py

@@ -93,7 +93,7 @@ class ApplicationViewSet(
         app = self.get_object()
         if not app.user_id or request.user != app.user:
             return response.Response(status=404)
-        app.token = models.get_token(15)
+        app.token = models.get_token()
         app.save(update_fields=["token"])
         serializer = serializers.CreateApplicationSerializer(app)
         return response.Response(serializer.data, status=200)