diff options
| author | Marco Cirillo <maranda@lightwitch.org> | 2012-05-28 15:59:10 +0000 |
|---|---|---|
| committer | Marco Cirillo <maranda@lightwitch.org> | 2012-05-28 15:59:10 +0000 |
| commit | 7a3d816c476aeebe5c1157b286ade4067f543ae5 (patch) | |
| tree | e7522ce58b9a13cd1d66a04e2b5940819d44388c /util/sasl | |
| parent | 683bfb3342c3c4097c39c534da2e8c142c8ea63b (diff) | |
| download | prosody-7a3d816c476aeebe5c1157b286ade4067f543ae5.tar.gz prosody-7a3d816c476aeebe5c1157b286ade4067f543ae5.zip | |
util.sasl.plain: make it return "not-authorized" in case of non-existant accounts instead of "account-disabled" to avoid enumeration.
Diffstat (limited to 'util/sasl')
| -rw-r--r-- | util/sasl/plain.lua | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/util/sasl/plain.lua b/util/sasl/plain.lua index fb20cf97..ba4645e1 100644 --- a/util/sasl/plain.lua +++ b/util/sasl/plain.lua @@ -64,8 +64,10 @@ local function plain(self, message) end self.username = authentication - if not state then + if state == false then return "failure", "account-disabled"; + elseif state == nil then + return "failure", "not-authorized", "Unable to authorize you with the authentication credentials you've sent."; end if correct then |