#361: Removing additional secret key, per CW's request.

mediagoblin/config_spec.ini

@@ -42,7 +42,6 @@ celery_setup_elsewhere = boolean(default=False)
 allow_attachments = boolean(default=False)
 
 # Cookie stuff
-secret_key = string(default="Something Super Duper Secrit!")
 csrf_cookie_name = string(default='mediagoblin_nonce')
 
 [storage:publicstore]

mediagoblin/middleware/csrf.py

@@ -106,7 +106,7 @@ class CsrfMiddleware(object):
 
         return hashlib.md5("%s%s" %
                            (randrange(0, self.MAX_CSRF_KEY),
-                            mg_globals.app_config['secret_key'])).hexdigest()
+                            randrange(0, self.MAX_CSRF_KEY))).hexdigest()
 
     def verify_tokens(self, request):
         """Verify that the CSRF Cookie exists and that it matches the