external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix for information leak in login logic.

Browse source 
Fix for information leak in login logic.
No point telling people they have a valid username when the pass is wrong, etc.
This commit is contained in:
eliott 2008-02-17 20:37:49 -08:00 • committed by Simo Leone
parent aedf2ab6a3
commit 4d9d5d3966
2 changed files with 5 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

6
web/lib/aur.inc
View file

@ -356,13 +356,11 @@ function html_header($title="") {
$q.= "AND Passwd = '" . mysql_real_escape_string($_POST["pass"]) . "'";
$result = db_query($q, $dbh);
if (!$result) {
$login_error = __("Error looking up username, %s.",
array(htmlspecialchars($_POST["user"])));
$login_error = __("Login failure: Bad user or pass.");
} else {
$row = mysql_fetch_row($result);
if (empty($row)) {
$login_error = __("Incorrect password for username, %s.",
array(htmlspecialchars($_POST["user"])));
$login_error = __("Login failure: Bad user or pass.");
} elseif ($row[1]) {
$login_error = __("Your account has been suspended.");
}