From 21a0c580a0ae5c7762cab8922f67ecc43202bd63 Mon Sep 17 00:00:00 2001 From: Jesse Date: Sun, 9 Sep 2018 16:58:54 +0800 Subject: [PATCH] Add option SECURITY_LOGIN_SHOW_USER_EXISTENCE to hide 'user does not exist' in /login error message, fix #673 --- docs/configuration.rst | 6 ++++++ flask_security/core.py | 1 + flask_security/forms.py | 20 ++++++++++++++------ 3 files changed, 21 insertions(+), 6 deletions(-) diff --git a/docs/configuration.rst b/docs/configuration.rst index bc72984f..526bcc9c 100644 --- a/docs/configuration.rst +++ b/docs/configuration.rst @@ -295,6 +295,12 @@ Miscellaneous the value of ``SECURITY_CONFIRMABLE`` is set to ``True``. Defaults to ``False``. +``SECURITY_LOGIN_SHOW_USER_EXISTENCE`` Specifies the login api whether to + show user does not exist message + ``SECURITY_MSG_USER_DOES_NOT_EXIST`` + or empty password message + ``SECURITY_MSG_PASSWORD_NOT_SET``. + Defaults to ``True``. ``SECURITY_CONFIRM_SALT`` Specifies the salt value when generating confirmation links/tokens. Defaults to diff --git a/flask_security/core.py b/flask_security/core.py index 597aa00e..8a2bc790 100644 --- a/flask_security/core.py +++ b/flask_security/core.py @@ -98,6 +98,7 @@ 'CONFIRM_EMAIL_WITHIN': '5 days', 'RESET_PASSWORD_WITHIN': '5 days', 'LOGIN_WITHOUT_CONFIRMATION': False, + 'LOGIN_SHOW_USER_EXISTENCE': True, 'EMAIL_SENDER': LocalProxy(lambda: current_app.config.get( 'MAIL_DEFAULT_SENDER', 'no-reply@localhost' )), diff --git a/flask_security/forms.py b/flask_security/forms.py index 5e974ac0..98c58ac0 100644 --- a/flask_security/forms.py +++ b/flask_security/forms.py @@ -232,14 +232,22 @@ def validate(self): self.user = _datastore.get_user(self.email.data) if self.user is None: - self.email.errors.append(get_message('USER_DOES_NOT_EXIST')[0]) - # Reduce timing variation between existing and non-existung users - hash_password(self.password.data) + if current_app.extensions['security'].login_show_user_existence: + self.email.errors.append(get_message('USER_DOES_NOT_EXIST')[0]) + else: + self.password.errors.append(get_message('INVALID_PASSWORD')[0]) + # Reduce timing variation between existing and non-existung + # users + hash_password(self.password.data) return False if not self.user.password: - self.password.errors.append(get_message('PASSWORD_NOT_SET')[0]) - # Reduce timing variation between existing and non-existung users - hash_password(self.password.data) + if current_app.extensions['security'].login_show_user_existence: + self.password.errors.append(get_message('PASSWORD_NOT_SET')[0]) + else: + self.password.errors.append(get_message('INVALID_PASSWORD')[0]) + # Reduce timing variation between existing and non-existung + # users + hash_password(self.password.data) return False if not self.user.verify_and_update_password(self.password.data): self.password.errors.append(get_message('INVALID_PASSWORD')[0])