Normalize login error message

include/Webservices/Login.php

@@ -31,7 +31,9 @@
 		if($user->status != 'Inactive'){
 			return $user;
 		}
-		throw new WebServiceException(WebServiceErrorCode::$AUTHREQUIRED,'Given user is inactive');
+		// Finer exception message could be handy to enumeration attacks - so normalize it. 
+		//throw new WebServiceException(WebServiceErrorCode::$AUTHREQUIRED,'Given user is inactive');
+		throw new WebServiceException(WebServiceErrorCode::$INVALIDUSERPWD,"Invalid username or password");
 	}
 	
 	function vtws_getActiveToken($userId){
@@ -60,4 +62,4 @@
 		return null;
 	}
 	
-?>
\ No newline at end of file
+?>

[Nilay Khatri]

👍

[maie]

Does the error message not use i18n?