Merge pull request #575 from pgrodrigues/0.4.0

Abstract the local strategy login error to thwart hackers
meanjs · Jun 3, 2015 · cd5db4a · cd5db4a
2 parents 716925b + e11ffda
commit cd5db4a
Showing 1 changed file with 2 additions and 7 deletions.
diff --git a/modules/users/server/config/strategies/local.js b/modules/users/server/config/strategies/local.js
@@ -20,14 +20,9 @@ module.exports = function() {
 				if (err) {
 					return done(err);
 				}
-				if (!user) {
+				if (!user || !user.authenticate(password)) {
 					return done(null, false, {
-						message: 'Unknown user'
-					});
-				}
-				if (!user.authenticate(password)) {
-					return done(null, false, {
-						message: 'Invalid password'
+						message: 'Invalid username or password'
 					});
 				}