aboutsummaryrefslogtreecommitdiffstats
path: root/util
diff options
context:
space:
mode:
authorMarco Cirillo <maranda@lightwitch.org>2012-05-28 15:59:10 +0000
committerMarco Cirillo <maranda@lightwitch.org>2012-05-28 15:59:10 +0000
commit48b375eb090b15e487da0fe27d4e3d58d1728495 (patch)
treee7522ce58b9a13cd1d66a04e2b5940819d44388c /util
parentf215d57872b12301f6c8796cdbd4a3aa694e1bd5 (diff)
downloadprosody-48b375eb090b15e487da0fe27d4e3d58d1728495.tar.gz
prosody-48b375eb090b15e487da0fe27d4e3d58d1728495.zip
util.sasl.plain: make it return "not-authorized" in case of non-existant accounts instead of "account-disabled" to avoid enumeration.
Diffstat (limited to 'util')
-rw-r--r--util/sasl/plain.lua4
1 files changed, 3 insertions, 1 deletions
diff --git a/util/sasl/plain.lua b/util/sasl/plain.lua
index fb20cf97..ba4645e1 100644
--- a/util/sasl/plain.lua
+++ b/util/sasl/plain.lua
@@ -64,8 +64,10 @@ local function plain(self, message)
end
self.username = authentication
- if not state then
+ if state == false then
return "failure", "account-disabled";
+ elseif state == nil then
+ return "failure", "not-authorized", "Unable to authorize you with the authentication credentials you've sent.";
end
if correct then