From d8c4bef3a330a988c012510f26c6612f19e8f4d5 Mon Sep 17 00:00:00 2001
From: ston1th <ston1th@giftfish.de>
Date: Mon, 21 Jan 2019 19:56:39 +0100
Subject: [PATCH] fix possible username enumeration

---
 pkg/server/handler.go | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkg/server/handler.go b/pkg/server/handler.go
index 9a5866f..94b82ef 100644
--- a/pkg/server/handler.go
+++ b/pkg/server/handler.go
@@ -111,12 +111,13 @@ func loginHandler(ctx *Context) {
 		}
 		password := ctx.Form("password")
 		if data.User == "" || password == "" {
-			ctx.Error("empty user or password")
+			ctx.Error("empty username or password")
 			return
 		}
 		u, err := ctx.Srv.DB.Login(data.User, password)
 		if err != nil {
-			ctx.Error(err)
+			log.Println("login:", data.User, err)
+			ctx.Error("bad username or password")
 			return
 		}
 		if u.Secret == "" {