wp_login is too "friendly" -- Information disclosure

[charleshooper]

While it's not exactly the end of the world, if you attempt to login with an invalid username the error message returned is actually "Invalid username." Obviously it works as intended; However, I consider this information disclosure and feel that invalid usernames and passwords should both return the same error message.

[charleshooper]

"Fix" for ticket #3708

[markjaquith]

There are other ways to verify user names. You can reverse engineer them from the author archive URLs (e.g. ​http://example.com/author/mark/). I believe the consensus last time this came up was that it was trivial to figure out the user names anyway, and that it is much more user-friendly to tell them when they messed up their username, and not the password. Also, "admin" is created on install, and can't be changed using WordPress itself, so there's no hiding that.

[charleshooper]

Good point about the author archives, I hadn't really thought about that. Guess I was just excited about submitting my first patch for Wordpress, even IF it was only to change some error messages.

But now that I've been reminded that there are many other ways to get valid Wordpress usernames (that are all quite a bit easier than brute forcing the login) it just doesn't make sense to leave this ticket hanging.

[SergeyBiryukov]

#22421 was marked as a duplicate.

[helen]

#27125 was marked as a duplicate.

[voldemortensen]

#31787 was marked as a duplicate.

[ocean90]

#45318 was marked as a duplicate.

[earnjam]

#45318 was marked as a duplicate.

[afercia]

In 44918:

Accessibility: Login: Display error messages when both the username and password fields are empty.

For accessibility and usability, if an input error is detected, the item that is in error needs to be identified and the error needs to be described to the user in text (WCAG Success Criterion 3.3.1). The login form displays an error when the username field is empty or when the password field is empty. It omits to do so when both fields are empty.

This change restores the login form behavior to the one that used to work in WordPress 2.3 (!) and displays the related error messages also when both fields are empty.

Props birgire, audrasjb.
See #8938, #5405, #3708.
Fixes #42985.

[jorbin]

#53373 was marked as a duplicate.

[jorbin]

#53374 was marked as a duplicate.