From 1d36e21714ca2f6331ad71c04eae3cd60979bf26 Mon Sep 17 00:00:00 2001 From: Simon Erkelens Date: Wed, 24 Oct 2018 19:32:46 +1300 Subject: [PATCH] There was a bit a double-up on checking if the member existed --- src/controllers/LoginHandler.php | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/src/controllers/LoginHandler.php b/src/controllers/LoginHandler.php index 400ffaf..bef5eca 100644 --- a/src/controllers/LoginHandler.php +++ b/src/controllers/LoginHandler.php @@ -63,13 +63,7 @@ public function doLogin($data, MemberLoginForm $form, HTTPRequest $request) // Also, exclude default admin from forcing a reset if (!$isDefaultAdmin && !HaveIBeenPwnedService::config()->get('allow_pwnd')) { $password = $data['Password']; - $member = null; - $identifierField = Member::config()->get('unique_identifier_field'); - $memberCount = Member::get()->filter([$identifierField => $data['Email']])->count(); - // There's no need to check for the member if it doesn't exist - if ($memberCount !== 0) { - $member = $this->checkLogin($data, $request, $result); - } + $member = $this->checkLogin($data, $request, $result); // How often can we find this password? $breachCount = $this->service->checkPwnedPassword($password); @@ -79,8 +73,8 @@ public function doLogin($data, MemberLoginForm $form, HTTPRequest $request) $this->lockoutMember($member, $breachCount); } - // A breached member or a non-existing member get the reset form - if (($breachCount && $member) || !$memberCount) { + if (!$member || $breachCount) { + // A breached member or a non-existing member get the reset form return $this->redirectToResetPassword(); } }