diff --git a/common/djangoapps/student/models.py b/common/djangoapps/student/models.py index 8f1a467ddd29..86177ee39713 100644 --- a/common/djangoapps/student/models.py +++ b/common/djangoapps/student/models.py @@ -222,12 +222,13 @@ def anonymous_id_for_user(user, course_id, save='DEPRECATED'): # Rotation process of SECRET_KEY with respect to this # function: Rotate at will, since the hashes are stored and # will not change. - hasher = hashlib.md5() + # include the secret key as a salt, and to make the ids unique across different LMS installs. + hasher = hashlib.shake_128() hasher.update(settings.SECRET_KEY.encode('utf8')) hasher.update(text_type(user.id).encode('utf8')) if course_id: hasher.update(text_type(course_id).encode('utf-8')) - anonymous_user_id = hasher.hexdigest() + anonymous_user_id = hasher.hexdigest(16) # pylint: disable=too-many-function-args try: AnonymousUserId.objects.create( diff --git a/lms/djangoapps/courseware/tests/test_module_render.py b/lms/djangoapps/courseware/tests/test_module_render.py index 04c646126941..ef01e42fa198 100644 --- a/lms/djangoapps/courseware/tests/test_module_render.py +++ b/lms/djangoapps/courseware/tests/test_module_render.py @@ -1991,7 +1991,7 @@ def test_per_student_anonymized_id(self, descriptor_class): self.assertEqual( # This value is set by observation, so that later changes to the student # id computation don't break old data - '5afe5d9bb03796557ee2614f5c9611fb', + 'de619ab51c7f4e9c7216b4644c24f3b5', self._get_anonymous_id(CourseKey.from_string(course_id), descriptor_class) ) @@ -2000,14 +2000,14 @@ def test_per_course_anonymized_id(self, descriptor_class): self.assertEqual( # This value is set by observation, so that later changes to the student # id computation don't break old data - 'e3b0b940318df9c14be59acb08e78af5', + '0c706d119cad686d28067412b9178454', self._get_anonymous_id(CourseKey.from_string('MITx/6.00x/2012_Fall'), descriptor_class) ) self.assertEqual( # This value is set by observation, so that later changes to the student # id computation don't break old data - 'f82b5416c9f54b5ce33989511bb5ef2e', + 'e9969c28c12c8efa6e987d6dbeedeb0b', self._get_anonymous_id(CourseKey.from_string('MITx/6.00x/2013_Spring'), descriptor_class) )