do not disclose information, show generic error on login page

diff --git a/core/templates/login.php b/core/templates/login.php
index 819010c54853e172cbdfdb495d86e438f60cce1a..8cf22407ba901e6da1f188aa599cd6fb58842a22 100644 (file)
--- a/core/templates/login.php
+++ b/core/templates/login.php
@@ -12,6 +12,12 @@
                                <small><?php p($l->t('Please contact your administrator.')); ?></small>
                        </div>
                <?php endif; ?>
+               <?php if (isset($_['internalexception']) && ($_['internalexception'])): ?>
+                       <div class="warning">
+                               <?php p($l->t('An internal error occured.')); ?><br>
+                               <small><?php p($l->t('Please try again or contact your administrator.')); ?></small>
+                       </div>
+               <?php endif; ?>
                <p id="message" class="hidden">
                        <img class="float-spinner" src="<?php p(\OCP\Util::imagePath('core', 'loading-dark.gif'));?>"/>
                        <span id="messageText"></span>

diff --git a/lib/base.php b/lib/base.php
index 495d753476107ff9b567a6892903555a04a2ae51..e74d9247c6140382c3100789b698de80fe285891 100644 (file)
--- a/lib/base.php
+++ b/lib/base.php
@@ -829,15 +829,21 @@ class OC {
                OC_App::loadApps(array('prelogin'));
                $error = array();
 
-               // auth possible via apache module?
-               if (OC::tryApacheAuth()) {
-                       $error[] = 'apacheauthfailed';
-               } // remember was checked after last login
-               elseif (OC::tryRememberLogin()) {
-                       $error[] = 'invalidcookie';
-               } // logon via web form
-               elseif (OC::tryFormLogin()) {
-                       $error[] = 'invalidpassword';
+               try {
+                       // auth possible via apache module?
+                       if (OC::tryApacheAuth()) {
+                               $error[] = 'apacheauthfailed';
+                       } // remember was checked after last login
+                       elseif (OC::tryRememberLogin()) {
+                               $error[] = 'invalidcookie';
+                       } // logon via web form
+                       elseif (OC::tryFormLogin()) {
+                               $error[] = 'invalidpassword';
+                       }
+               } catch (\Exception $ex) {
+                       \OCP\Util::logException('handleLogin', $ex);
+                       // do not disclose information. show generic error
+                       $error[] = 'internalexception';
                }
 
                OC_Util::displayLoginPage(array_unique($error));