summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authoreliott <eliott@cactuswax.net>2008-02-17 20:37:49 -0800
committerSimo Leone <simo@archlinux.org>2008-02-18 17:55:28 -0600
commit4d9d5d39666addc2afbb61bb04b00dc1ed707ecc (patch)
treeddc134b03ab8c87737cd62862f01ffc9960031fb
parentaedf2ab6a390b62f1a0de8afe18a5aa53075b9ef (diff)
downloadaurweb-4d9d5d39666addc2afbb61bb04b00dc1ed707ecc.tar.xz
Fix for information leak in login logic.
Fix for information leak in login logic. No point telling people they have a valid username when the pass is wrong, etc.
-rw-r--r--web/lang/en/index_po.inc7
-rw-r--r--web/lib/aur.inc6
2 files changed, 5 insertions, 8 deletions
diff --git a/web/lang/en/index_po.inc b/web/lang/en/index_po.inc
index 66a7834..bdeb87f 100644
--- a/web/lang/en/index_po.inc
+++ b/web/lang/en/index_po.inc
@@ -35,16 +35,12 @@ $_t["en"]["For now, it's just a place holder."] = "For now, it's just a place ho
$_t["en"]["It's more important to get the login functionality finished."] = "It's more important to get the login functionality finished.";
-$_t["en"]["Error looking up username, %s."] = "Error looking up username, %s.";
-
$_t["en"]["Login"] = "Login";
$_t["en"]["Though we can't vouch for their contents, we provide a %hlist of user repositories%h for your convenience."] = "Though we can't vouch for their contents, we provide a %hlist of user repositories%h for your convenience.";
$_t["en"]["If you have feedback about the AUR, please leave it in %hFlyspray%h."] = "If you have feedback about the AUR, please leave it in %hFlyspray%h.";
-$_t["en"]["Incorrect password for username, %s."] = "Incorrect password for username, %s.";
-
$_t["en"]["Latest Packages:"] = "Latest Packages:";
$_t["en"]["Discussion about the AUR takes place on the %sTUR Users List%s."] = "Discussion about the AUR takes place on the %sTUR Users List%s.";
@@ -94,6 +90,9 @@ $_t["en"]["The most popular packages will be provided as binary packages in [com
$_t["en"]["Packages added or updated in the past 7 days"] = "Packages added or updated in the past 7 days";
$_t["en"]["Out-of-date"] = "Out-of-date";
+
$_t["en"]["DISCLAIMER"] = "DISCLAIMER: Unsupported PKGBUILDs are user produced content, by downloading them you agree to do so at your own risk.";
+$_t["en"]["Login failure: Bad user or pass."] = "Login failure: Bad user or pass.";
+
?>
diff --git a/web/lib/aur.inc b/web/lib/aur.inc
index 234dca9..e7e8c49 100644
--- a/web/lib/aur.inc
+++ b/web/lib/aur.inc
@@ -356,13 +356,11 @@ function html_header($title="") {
$q.= "AND Passwd = '" . mysql_real_escape_string($_POST["pass"]) . "'";
$result = db_query($q, $dbh);
if (!$result) {
- $login_error = __("Error looking up username, %s.",
- array(htmlspecialchars($_POST["user"])));
+ $login_error = __("Login failure: Bad user or pass.");
} else {
$row = mysql_fetch_row($result);
if (empty($row)) {
- $login_error = __("Incorrect password for username, %s.",
- array(htmlspecialchars($_POST["user"])));
+ $login_error = __("Login failure: Bad user or pass.");
} elseif ($row[1]) {
$login_error = __("Your account has been suspended.");
}