Switch to diceware passwords

webadmin/userprofile.php

@@ -23,8 +23,7 @@ if (isset($_POST['submitremoveuser'])) {
 if (isset($_POST['submitchangepassword'])) {
     $username = htmlspecialchars($_POST['myuser']);
 
-    // Don't rely on php PRNG
-    $newpassword = exec("openssl rand -base64 32 | tr -dc A-Za-z0-9 | head -c 10 ; echo -n ''");
+    $newpassword = exec("diceware");
     exec('cp password_confirm_template.html password_confirm.html');
     exec('sed -i "s|USERNAME|'.$username.'|g" password_confirm.html');
     exec('sed -i "s|NEWPASSWORD|'.$newpassword.'|g" password_confirm.html');