[MM-29296] model/user: add lock to source (#16054)

* model/user: add lock to source

* guard rand creation with locking

* use locked random

* remove assignment

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

model/user.go

@@ -14,6 +14,7 @@ import (
 	"regexp"
 	"sort"
 	"strings"
+	"sync"
 	"time"
 	"unicode/utf8"
 
@@ -890,7 +891,22 @@ func UsersWithGroupsAndCountFromJson(data io.Reader) *UsersWithGroupsAndCount {
 	return uwg
 }
 
-var passwordRandomSource = rand.NewSource(time.Now().Unix())
+type lockedRand struct {
+	mu sync.Mutex
+	rn *rand.Rand
+}
+
+func (r *lockedRand) Intn(n int) int {
+	r.mu.Lock()
+	m := r.rn.Intn(n)
+	r.mu.Unlock()
+	return m
+}
+
+var passwordRandom = lockedRand{
+	rn: rand.New(rand.NewSource(time.Now().Unix())),
+}
+
 var passwordSpecialChars = "!$%^&*(),."
 var passwordNumbers = "0123456789"
 var passwordUpperCaseLetters = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
@@ -898,16 +914,14 @@ var passwordLowerCaseLetters = "abcdefghijklmnopqrstuvwxyz"
 var passwordAllChars = passwordSpecialChars + passwordNumbers + passwordUpperCaseLetters + passwordLowerCaseLetters
 
 func GeneratePassword(minimumLength int) string {
-	r := rand.New(passwordRandomSource)
-
 	// Make sure we are guaranteed at least one of each type to meet any possible password complexity requirements.
-	password := string([]rune(passwordUpperCaseLetters)[r.Intn(len(passwordUpperCaseLetters))]) +
-		string([]rune(passwordNumbers)[r.Intn(len(passwordNumbers))]) +
-		string([]rune(passwordLowerCaseLetters)[r.Intn(len(passwordLowerCaseLetters))]) +
-		string([]rune(passwordSpecialChars)[r.Intn(len(passwordSpecialChars))])
+	password := string([]rune(passwordUpperCaseLetters)[passwordRandom.Intn(len(passwordUpperCaseLetters))]) +
+		string([]rune(passwordNumbers)[passwordRandom.Intn(len(passwordNumbers))]) +
+		string([]rune(passwordLowerCaseLetters)[passwordRandom.Intn(len(passwordLowerCaseLetters))]) +
+		string([]rune(passwordSpecialChars)[passwordRandom.Intn(len(passwordSpecialChars))])
 
 	for len(password) < minimumLength {
-		i := r.Intn(len(passwordAllChars))
+		i := passwordRandom.Intn(len(passwordAllChars))
 		password = password + string([]rune(passwordAllChars)[i])
 	}