Username Enumeration Prevention

Update: Only the EmailRegistrationLogin checkout pane seems to be affected. Perhaps we can solve this by using a more neutral message?

Anybody → credited Grevil → .

@Grevil and me just took a look and it's fine. The message is the same with correct user and wrong password and wrong user. So no risk here.

But it's a good chance to add a test for this, checking all the modified forms :)

That test should simply check that the error messsage shown is the same for all cases, so Usernames can't be guessed! I think that could ne a nice novice functional testing task?

@hlopez thanks, could you please add a link to this issue in the comments and describe what the test is for - protecting us from user enumeration attacks by comparing the message to the expected core messages?

I guess password reset should also be tested.

bluegeek9 → changed the visibility of the branch 2.x to hidden.