0

I am trying login with invalid customer email address, that doesn't exist in magento db.

When i try to login with that email. I am getting error like

"You did not sign in correctly or your account is temporarily disabled."

even though account doesn't exist.

Shall we show as "Customer Doesn't Exist!!!." instead of above error.

I have used the plugin like below

 public function afterExecute(\Magento\Customer\Controller\Account\LoginPost $subject, $result) 
{       
    $storeScope = \Magento\Store\Model\ScopeInterface::SCOPE_STORE;        
    if ($subject->getRequest()->isPost()) {
        $login = $subject->getRequest()->getPost('login');

        if (!empty($login['username']) && !empty($login['password'])) {

            $customerId = $this->getCustomer(trim($login['username']));
            if(isset($customerId) && $customerId!= ''){
                $currentCustomer = $this->getcurrentcustomer($customerId);                                  
                try {
                    return $result;     
                }
                catch (\Exception $e)
                {
                    $message = "Invalid user Credentials.";
                    $this->messageManager->addError($e->getMessage());
                    $this->session->setUsername($login['username']);
                    $this->responseHttp->setRedirect('customer/account/login');

                }
            }else{
                $message = "The email address not Exist!";
                $this->messageManager->addError($message);
                $result->setPath('customer/account/login');                         
                return $result;                             
            }

        }            
    }

}

public function getCustomer($email)
{
    try{
        $websiteID = $this->_storeManager->getStore()->getWebsiteId();
        $customer = $this->_customer->create()->setWebsiteId($websiteID)->loadByEmail($email);
        $userId = $customer->getId();           
        return $userId;
    }catch (\Exception $e){

        return false;
    }
}

The message is showing but, It is also showing the other message also, How can we hide that? Thanks

0

Showing message "Customer Doesn't Exist!" in case of customer does not exist will be a security issue. Any attacker may enter a random email and will get verified that the account exists in the Magento system or not, this may lead to a brute force attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.