Repository navigation
Improve login error message and reject empty credentials - #774
Merged
digininja merged 2 commits intoOct 7, 2026
Merged
Conversation
Owner
|
The error message is already generic, all you've added is an extra few words from what I can tell. As it's not changing any functionality I think leave it as it is in case anyone has built tutorials based on those words. I don't mind the check to see if the creds are empty, if you can separate that out it can stay. |
BibaPutt
force-pushed
the
fix/improved-login-validation
branch
from
October 7, 2026 02:05
297431c to
49b6fe9
Compare
Contributor
Author
|
Fair point, thanks for looking. I've dropped the rewording, the original 'Login failed' message is back untouched. What's left is only the empty-credentials check, which skips the database query and shows 'Username and password cannot be empty. Login failed.' Let me know if you'd like anything else adjusted. |
Owner
|
Remove the generic message comment on line 30 and all is good. |
Owner
|
thanks |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Improves the login error handling in login.php: blank username/password submissions are rejected with a clear message before the database is queried, and the failure message is a single generic string.
Why
Previously any failed login showed a bare 'Login failed' message and empty input still hit the database. The generic message also avoids revealing whether the username or the password was wrong (user enumeration).
How to verify