Improve login error messages

RocketChat · Jul 31, 2017 · 5753c31 · 5753c31
1 parent 87b435c
commit 5753c31
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/packages/rocketchat-lib/package.js b/packages/rocketchat-lib/package.js
@@ -99,6 +99,7 @@ Package.onUse(function(api) {
 	api.addFiles('server/lib/configLogger.js', 'server');
 	api.addFiles('server/lib/PushNotification.js', 'server');
 	api.addFiles('server/lib/defaultBlockedDomainsList.js', 'server');
+	api.addFiles('server/lib/loginErrorMessageOverride.js', 'server');
 	api.addFiles('server/lib/notifyUsersOnMessage.js', 'server');
 	api.addFiles('server/lib/roomTypes.js', 'server');
 	api.addFiles('server/lib/sendEmailOnMessage.js', 'server');

diff --git a/packages/rocketchat-lib/server/lib/loginErrorMessageOverride.js b/packages/rocketchat-lib/server/lib/loginErrorMessageOverride.js
@@ -0,0 +1,11 @@
+// Do not disclose if user exists when password is invalid
+const _runLoginHandlers = Accounts._runLoginHandlers;
+Accounts._runLoginHandlers = function(methodInvocation, options) {
+	const result = _runLoginHandlers.call(Accounts, methodInvocation, options);
+
+	if (result.error && result.error.reason === 'Incorrect password') {
+		result.error = new Meteor.Error(403, 'User not found');
+	}
+
+	return result;
+};