You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I understand that your is_banned function checks if an existing user is banned. However, in a case where if the user doesn't exist in the system, this function will return FALSE, which means this non-existing user is not banned.
For security, I think it would be better to return TRUE for all users not found.
The text was updated successfully, but these errors were encountered:
https://github.com/magefly/CodeIgniter-Aauth/blob/7ae5ef5fbc424b3e75bec3389a483d95e5cd5bc8/application/libraries/Aauth.php#L1072
I understand that your is_banned function checks if an existing user is banned. However, in a case where if the user doesn't exist in the system, this function will return FALSE, which means this non-existing user is not banned.
For security, I think it would be better to return TRUE for all users not found.
The text was updated successfully, but these errors were encountered: