7f6ebb0ea84979ccf5935d69622d96cf38f8e3a6
SHA1("JETSESSION" + time(0)) meant two sessions started in the same second got the identical id, and the whole 160-bit value was derivable from a public, second-granularity input - not a real session identifier. Replaced with 20 bytes straight from OpenSSL RAND_bytes(), already linked via -lcrypto. Verified via a real jet-2.0 test: session get/set/persist across separate processes still works via the cookie, and two back-to-back new-session requests now get genuinely different ids.
Languages
HTML
50.2%
TeX
18.7%
C++
15%
JavaScript
7.5%
CSS
4.4%
Other
4.2%