# HG changeset patch
# User Marco Cirillo <maranda@lightwitch.org>
# Date 1338220750 0
# Node ID e27adbf4e7438ea9e1cf68ff6128b326f3f6f006
# Parent  6cbc35cdefaf3da8ae792aaa4f8a324a509cfc40
util.sasl.plain: make it return "not-authorized" in case of non-existant accounts instead of "account-disabled" to avoid enumeration.

diff -r 6cbc35cdefaf -r e27adbf4e743 util/sasl/plain.lua
--- a/util/sasl/plain.lua	Sun May 27 11:57:56 2012 +0100
+++ b/util/sasl/plain.lua	Mon May 28 15:59:10 2012 +0000
@@ -64,8 +64,10 @@
 	end
 
 	self.username = authentication
-	if not state then
+	if state == false then
 		return "failure", "account-disabled";
+	elseif state == nil then
+		return "failure", "not-authorized", "Unable to authorize you with the authentication credentials you've sent.";
 	end
 
 	if correct then