Fix #1994 Lockable no longer leaks account existence

2012-10-25 16:51:56 -05:00 · 2012-10-25 16:51:56 -05:00 · 00a01c2bc4
parent 00e8841e93
commit 00a01c2bc4
1 changed files with 5 additions and 1 deletions
--- a/lib/devise/models/lockable.rb
+++ b/lib/devise/models/lockable.rb
@ -105,7 +105,11 @@ module Devise
      end

      def unauthenticated_message
-        if lock_strategy_enabled?(:failed_attempts) && attempts_exceeded?
+        # If set to paranoid mode, do not show the locked message because it
+        # leaks the existence of an account.
+        if Devise.paranoid
+          super
+        elsif lock_strategy_enabled?(:failed_attempts) && attempts_exceeded?
          :locked
        else
          super