mirror of
https://github.com/librenms/librenms.git
synced 2024-10-07 16:52:45 +00:00
Use the same error message for different kind of authentiction errors (#13306)
This prevents usernames to be guess as the application confirms or denies their existence.
This commit is contained in:
@@ -23,7 +23,7 @@ class MysqlAuthorizer extends AuthorizerBase
|
||||
$enabled = $user_data->enabled;
|
||||
|
||||
if (! $enabled) {
|
||||
throw new AuthenticationException($message = 'login denied');
|
||||
throw new AuthenticationException();
|
||||
}
|
||||
|
||||
if (Hash::check($password, $hash)) {
|
||||
|
||||
@@ -128,7 +128,7 @@ class LegacyUserProvider implements UserProvider
|
||||
}
|
||||
|
||||
if (empty($credentials['username']) || ! $authorizer->authenticate($credentials)) {
|
||||
throw new AuthenticationException('Invalid Credentials');
|
||||
throw new AuthenticationException();
|
||||
}
|
||||
|
||||
return true;
|
||||
|
||||
Reference in New Issue
Block a user