mirrors/Plume
1
0
Fork 0
mirror of https://git.joinplu.me/Plume/Plume.git synced 2024-12-28 21:10:36 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fake password verification when trying to login with inexistant account

Browse source 
Fix #170
This commit is contained in:
Bat 2018-09-03 18:04:21 +01:00
parent 78b3202a32
commit 3373bb66cd
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/routes/session.rs
View file

@ -57,6 +57,10 @@ fn create(conn: DbConn, data: LenientForm<LoginForm>, flash: Option<FlashMessage
Err(e) => e
};
if let Err(_) = user.clone() {
// Fake password verification, only to avoid different login times
// that could be used to see if an email adress is registered or not
User::get(&*conn, 1).map(|u| u.auth(form.password.clone()));
let mut err = ValidationError::new("invalid_login");
err.message = Some(Cow::from("Invalid username or password"));
errors.add("email_or_name", err)