From 48b375eb090b15e487da0fe27d4e3d58d1728495 Mon Sep 17 00:00:00 2001 From: Marco Cirillo Date: Mon, 28 May 2012 15:59:10 +0000 Subject: util.sasl.plain: make it return "not-authorized" in case of non-existant accounts instead of "account-disabled" to avoid enumeration. --- util/sasl/plain.lua | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/util/sasl/plain.lua b/util/sasl/plain.lua index fb20cf97..ba4645e1 100644 --- a/util/sasl/plain.lua +++ b/util/sasl/plain.lua @@ -64,8 +64,10 @@ local function plain(self, message) end self.username = authentication - if not state then + if state == false then return "failure", "account-disabled"; + elseif state == nil then + return "failure", "not-authorized", "Unable to authorize you with the authentication credentials you've sent."; end if correct then -- cgit v1.2.3