summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorjessib <jessib@leap.se>2013-02-28 11:54:24 -0800
committerjessib <jessib@leap.se>2013-02-28 11:54:24 -0800
commita1279ecca51fbe7014d841ed6bca8842d3441814 (patch)
tree0ed069bda6e312268714a8cb69f0e167b71d816b
parent97fe2b4d19edacf2ea67c7efcfbec50feca305b0 (diff)
When attempting to login, the error messages should not leak information about whether a username is valid.
This also means the error message is more appropriate if somebody tries to login with somebody else's username and their password.
-rw-r--r--users/config/locales/en.yml1
-rw-r--r--users/lib/warden/strategies/secure_remote_password.rb10
2 files changed, 7 insertions, 4 deletions
diff --git a/users/config/locales/en.yml b/users/config/locales/en.yml
index 1b2789e..c1512eb 100644
--- a/users/config/locales/en.yml
+++ b/users/config/locales/en.yml
@@ -7,6 +7,7 @@ en:
login_message: "Please login with your account."
wrong_password: "wrong password"
user_not_found: "could not be found"
+ invalid_user_pass: "Not a valid username/password combination"
update_login_and_password: "Update Login and Password"
cancel_account: "Cancel your account"
remove_account: "Remove Account"
diff --git a/users/lib/warden/strategies/secure_remote_password.rb b/users/lib/warden/strategies/secure_remote_password.rb
index 483336d..5032914 100644
--- a/users/lib/warden/strategies/secure_remote_password.rb
+++ b/users/lib/warden/strategies/secure_remote_password.rb
@@ -26,9 +26,11 @@ module Warden
def validate!
client = session[:handshake].authenticate(params['client_auth'].hex)
- client ?
- success!(User.find_by_login(client.username)) :
- fail!(:password => "wrong_password")
+ if client
+ success!(User.find_by_login(client.username))
+ else
+ fail!({:login => "invalid_user_pass", :password => "invalid_user_pass"})
+ end
end
def initialize!
@@ -39,7 +41,7 @@ module Warden
session[:handshake] = SRP::Session.new(client, params['A'].hex)
custom! json_response(session[:handshake])
else
- fail! :login => "user_not_found"
+ fail!({:login => "invalid_user_pass", :password => "invalid_user_pass"})
end
end