From 6630a8f3d50b3beada3817c313dfe455ba8f6205 Mon Sep 17 00:00:00 2001 From: Petter Reinholdtsen Date: Thu, 26 Sep 2013 20:04:27 +0200 Subject: [PATCH] Make sure login do not throw exception for unknown users. --- modules/installed/lib/auth.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/installed/lib/auth.py b/modules/installed/lib/auth.py index 74f387595..fb2ad2ac9 100644 --- a/modules/installed/lib/auth.py +++ b/modules/installed/lib/auth.py @@ -27,7 +27,10 @@ def check_credentials(username, passphrase): cfg.log(error) return error - u = cfg.users[username] + if username in cfg.users: + u = cfg.users[username] + else: + u = None # hash the password whether the user exists, to foil timing # side-channel attacks pass_hash = hashlib.md5(passphrase).hexdigest()