I have a strange situation where a client has requested their Magento CE 1.8 store alerts the user to know whether it was the email address, or password that was incorrect when attempting to log in

Currently: enter image description here

Desired: (if email exists but password incorrect) 'Password incorrect'

aside from the huge security flaw this presents

How can I achieve this?


You have rewrite the Mage_Customer_Model_Customer::authenticate() function to do this.


public function authenticate($login, $password)
        throw Mage::exception('Mage_Core', Mage::helper('customer')->__('Invalid Email Address'));
    if ($this->getConfirmation() && $this->isConfirmationRequired()) {
        throw Mage::exception('Mage_Core', Mage::helper('customer')->__('This account is not confirmed.'),
    if (!$this->validatePassword($password)) {
        throw Mage::exception('Mage_Core', Mage::helper('customer')->__('Invalid password.'));
    Mage::dispatchEvent('customer_customer_authenticated', array(
       'model'    => $this,
       'password' => $password,

    return true;

Refer this for model rewrite

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.