From 25941623b19730204f09ef484b22bbd2ad658b49 Mon Sep 17 00:00:00 2001 From: deilann Date: Fri, 7 Feb 2014 17:44:56 -0800 Subject: [PATCH 1/2] putting in issue ticket correctly putting in issue ticket for "report a bug" --- views/options/social/tavern.jade | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/views/options/social/tavern.jade b/views/options/social/tavern.jade index 1221da51b4..ac08376161 100644 --- a/views/options/social/tavern.jade +++ b/views/options/social/tavern.jade @@ -39,7 +39,7 @@ a(target='_blank', href='http://habitrpg.wikia.com/wiki/Glossary')=env.t('glossary') tr td - a(target='_blank', href='https://github.com/HabitRPG/habitrpg/issues')=env.t('reportAP') + a(target='_blank', href='https://github.com/HabitRPG/habitrpg/issues/2760')=env.t('reportAP') tr td a(target='_blank', href='https://trello.com/c/8gzGlle8')=env.t('requestAF') From 8d03cfc6b59b82900badbc9b4397f079e11ee2e1 Mon Sep 17 00:00:00 2001 From: Lorian Date: Fri, 7 Feb 2014 21:08:13 -0800 Subject: [PATCH 2/2] Made incorrect username and password show the same error, for security purposes. --- src/controllers/auth.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/controllers/auth.js b/src/controllers/auth.js index 25bc4d78bb..47c3b19c24 100644 --- a/src/controllers/auth.js +++ b/src/controllers/auth.js @@ -108,14 +108,14 @@ api.loginLocal = function(req, res, next) { if (!(username && password)) return res.json(401, {err:'Missing :username or :password in request body, please provide both'}); User.findOne({'auth.local.username': username}, function(err, user){ if (err) return next(err); - if (!user) return res.json(401, {err:"Username '" + username + "' not found. Usernames are case-sensitive, click 'Forgot Password' if you can't remember the capitalization."}); + if (!user) return res.json(401, {err:"Username or password incorrect. Click 'Forgot Password' for help with either. (Note: usernames are case-sensitive)"}); // We needed the whole user object first so we can get his salt to encrypt password comparison User.findOne({ 'auth.local.username': username, 'auth.local.hashed_password': utils.encryptPassword(password, user.auth.local.salt) }, function(err, user){ if (err) return next(err); - if (!user) return res.json(401,{err:'Incorrect password'}); + if (!user) return res.json(401,{err:"Username or password incorrect. Click 'Forgot Password' for help with either. (Note: usernames are case-sensitive)"}); res.json({id: user._id,token: user.apiToken}); }); });