+1 again. If a correct username and password combination are given, the person submitting the credentials should know that he doesn't have access just like cal pointed out. Its unfair and frustrating to say that the combination is wrong
On 9/13/11, Cal Leeming [Simplicity Media Ltd] <[email protected]> wrote: > +1, if the user/pass is entered, that user is entitled so know what its own > permissions are. > > The error should give "You have insufficient access to this page" or > something like that. > > Cal > > On Tue, Sep 13, 2011 at 6:12 PM, Florian Apolloner > <[email protected]>wrote: > >> -1, This would leak information about the users (But I am sure that's >> discussed at length in the other threads) >> >> -- >> You received this message because you are subscribed to the Google Groups >> "Django developers" group. >> To view this discussion on the web visit >> https://groups.google.com/d/msg/django-developers/-/5iy7pazGNGkJ. >> >> To post to this group, send email to [email protected]. >> To unsubscribe from this group, send email to >> [email protected]. >> For more options, visit this group at >> http://groups.google.com/group/django-developers?hl=en. >> > > -- > You received this message because you are subscribed to the Google Groups > "Django developers" group. > To post to this group, send email to [email protected]. > To unsubscribe from this group, send email to > [email protected]. > For more options, visit this group at > http://groups.google.com/group/django-developers?hl=en. > > -- Sent from my mobile device -- You received this message because you are subscribed to the Google Groups "Django developers" group. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/django-developers?hl=en.
