ston1th/gowiki
0
0
Fork 0
Code Issues 2 Releases Activity

fix possible username enumeration

Browse source
This commit is contained in:
ston1th 2019-01-21 19:56:39 +01:00
commit d8c4bef3a3
1 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
pkg/server/handler.go
View file

@ -111,12 +111,13 @@ func loginHandler(ctx *Context) {
}
password := ctx.Form("password")
if data.User == "" || password == "" {
ctx.Error("empty user or password")
ctx.Error("empty username or password")
return
}
u, err := ctx.Srv.DB.Login(data.User, password)
if err != nil {
ctx.Error(err)
log.Println("login:", data.User, err)
ctx.Error("bad username or password")
return
}
if u.Secret == "" {