Context Navigation

Changes between Version 1 and Version 5 of Ticket #36651

Ticket #36651
- Property Resolution → invalid
- Property Status new → closed
- Property Summary Security concerrn in ModelBackend → Brute-force password attack against inactive users returns distinct error message

-              v1
+              v5
 We have implemented user account lock after 3 consecutive failed login attempts.
 When user try to login in 4-th item we have to show correct error message about user account is locked, but for now it's impossible without rewriting "authenticate" function again.
+When user try to login in 4-th item we have to show correct error message about account is locked, but for now it's impossible without rewriting "authenticate" function again.
 But the current code checks password first, then check user can authenticate.
 It means if user receives different error message, user can sure at least username and password are correct.
+The current code checks password first, then check user can authenticate.
+It means if user receives different error message, attacker can sure at least username and password are correct.
 It may allow hackers can try with different password as many as times until they receive different error message.