SECURITY: Do not reveal if user exists during login failure

This is meant for private wikis where the list of users may
be secret. It is only meant to prevent trivial enumeration
of usernames. It is not designed to prevent enumeration
via timing attacks.

Bug: T134100
Change-Id: I7afaa955a4b393ef00b11e420709bd62b84fbc71

includes/auth/LocalPasswordPrimaryAuthenticationProvider.php

@@ -96,7 +96,10 @@ class LocalPasswordPrimaryAuthenticationProvider
 			__METHOD__
 		);
 		if ( !$row ) {
-			return AuthenticationResponse::newAbstain();
+			// Do not reveal whether its bad username or
+			// bad password to prevent username enumeration
+			// on private wikis. (T134100)
+			return $this->failResponse( $req );
 		}
 
 		$oldRow = clone $row;

languages/i18n/en.json

@@ -467,7 +467,7 @@
 	"nosuchusershort": "There is no user by the name \"$1\".\nCheck your spelling.",
 	"nouserspecified": "You have to specify a username.",
 	"login-userblocked": "This user is blocked. Login not allowed.",
-	"wrongpassword": "Incorrect password entered.\nPlease try again.",
+	"wrongpassword": "Incorrect username or password entered.\nPlease try again.",
 	"wrongpasswordempty": "Password entered was blank.\nPlease try again.",
 	"passwordtooshort": "Passwords must be at least {{PLURAL:$1|1 character|$1 characters}}.",
 	"passwordtoolong": "Passwords cannot be longer than {{PLURAL:$1|1 character|$1 characters}}.",