diff options
| author | Marco Cirillo <maranda@lightwitch.org> | 2012-05-28 15:59:10 +0000 |
|---|---|---|
| committer | Marco Cirillo <maranda@lightwitch.org> | 2012-05-28 15:59:10 +0000 |
| commit | 48b375eb090b15e487da0fe27d4e3d58d1728495 (patch) | |
| tree | e7522ce58b9a13cd1d66a04e2b5940819d44388c /util/sasl | |
| parent | f215d57872b12301f6c8796cdbd4a3aa694e1bd5 (diff) | |
| download | prosody-48b375eb090b15e487da0fe27d4e3d58d1728495.tar.gz prosody-48b375eb090b15e487da0fe27d4e3d58d1728495.zip | |
util.sasl.plain: make it return "not-authorized" in case of non-existant accounts instead of "account-disabled" to avoid enumeration.
Diffstat (limited to 'util/sasl')
| -rw-r--r-- | util/sasl/plain.lua | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/util/sasl/plain.lua b/util/sasl/plain.lua index fb20cf97..ba4645e1 100644 --- a/util/sasl/plain.lua +++ b/util/sasl/plain.lua @@ -64,8 +64,10 @@ local function plain(self, message) end self.username = authentication - if not state then + if state == false then return "failure", "account-disabled"; + elseif state == nil then + return "failure", "not-authorized", "Unable to authorize you with the authentication credentials you've sent."; end if correct then |