Use the same error message for different kind of authentiction errors (#13306)

This prevents usernames to be guess as the application confirms or denies their existence.
This commit is contained in:
Jellyfrog
2021-10-01 14:12:48 +02:00
committed by GitHub
parent 65b385f0fe
commit 0680dc8cd5
2 changed files with 2 additions and 2 deletions
+1 -1
View File
@@ -23,7 +23,7 @@ class MysqlAuthorizer extends AuthorizerBase
$enabled = $user_data->enabled;
if (! $enabled) {
throw new AuthenticationException($message = 'login denied');
throw new AuthenticationException();
}
if (Hash::check($password, $hash)) {
+1 -1
View File
@@ -128,7 +128,7 @@ class LegacyUserProvider implements UserProvider
}
if (empty($credentials['username']) || ! $authorizer->authenticate($credentials)) {
throw new AuthenticationException('Invalid Credentials');
throw new AuthenticationException();
}
return true;