ilkon/Tank-Auth — Issue #10: get_user_by_login
Author: phena109
Created: 2011-12-08 14:11:21+00:00
State: open

I was expecting the function need both email AND username. but in fact it checks for either one. ie if either match is fine which actually decreases the security.

i however don't think removing such function is the best to TA's users. instead, a new function should be created which verify both to be correct. leaving the option to users. how's that?