Software / code / prosody
Changeset
4920:e27adbf4e743
util.sasl.plain: make it return "not-authorized" in case of non-existant accounts instead of "account-disabled" to avoid enumeration.
| author | Marco Cirillo <maranda@lightwitch.org> |
|---|---|
| date | Mon, 28 May 2012 15:59:10 +0000 |
| parents | 4919:6cbc35cdefaf |
| children | 4921:9a01c6bc435e |
| files | util/sasl/plain.lua |
| diffstat | 1 files changed, 3 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/util/sasl/plain.lua Sun May 27 11:57:56 2012 +0100 +++ b/util/sasl/plain.lua Mon May 28 15:59:10 2012 +0000 @@ -64,8 +64,10 @@ end self.username = authentication - if not state then + if state == false then return "failure", "account-disabled"; + elseif state == nil then + return "failure", "not-authorized", "Unable to authorize you with the authentication credentials you've sent."; end if correct then
