starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2016-4444 (published 2017-04-11T18:59Z)

The allow_execmod plugin for setroubleshoot before 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux denial with a crafted binary filename, related to the commands.getstatusoutput function.

Severity: MEDIUM
CVSS v2 base score: 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.0, HIGH (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/fedora-selinux/setroubleshoot
commit_details: repo_url: https://github.com/fedora-selinux/setroubleshoot
author: Petr Lautrbach
author_date: 2015-04-09 14:08:49+02:00
msg: plugins: get rid of commands.getstatusoutput()
repository: repo_url: https://github.com/fedora-selinux/setroubleshoot
repo_name: fedora-selinux/setroubleshoot
description: Abandoned, use https://gitlab.com/setroubleshoot
repo_language: Python
owner: fedora-selinux
file_changes: filename: allow_execmod.py
change_type: ModificationType.MODIFY
diff: @@ -91,10 +91,16 @@ setroubleshoot examined '$FIX_TARGET_PATH' to make sure it was built correctly,
         self.set_priority(10)
 
     def analyze(self, avc):
-        import commands
+        import subprocess
         if avc.has_any_access_in(['execmod']):
             # MATCH
-            if (commands.getstatusoutput("eu-readelf -d %s | fgrep -q TEXTREL" % avc.tpath)[0] == 1):
+            # from https://docs.python.org/2.7/library/subprocess.html#replacing-shell-pipeline
+            p1 = subprocess.Popen(['eu-readelf', '-d', avc.tpath], stdout=subprocess.PIPE)
+            p2 = subprocess.Popen(["fgrep", "-q", "TEXTREL"], stdin=p1.stdout, stdout=subprocess.PIPE)
+            p1.stdout.close()  # Allow p1 to receive a SIGPIPE if p2 exits.
+            p1.wait()
+            p2.wait()
+            if p2.returncode == 1:
                 return self.report(("unsafe"))
 
             mcon = selinux.matchpathcon(avc.tpath.strip('"'), S_IFREG)[1]

programming_language: Python
CVE-2023-39525 (published 2023-08-07T21:15Z)

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, in the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path that uses the traversal path. Version 8.1.1 contains a patch for this issue. There are no known workarounds.

CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/PrestaShop/PrestaShop
commit_details: repo_url: https://github.com/PrestaShop/PrestaShop
author: Maxime Flasquin
author_date: 2023-07-20 10:22:24+02:00
msg: Merge remote-tracking branch 'ghsa-m9r4-3fg7-pqm2/8.1.x' into release/8.1.1
repository: repo_url: https://github.com/PrestaShop/PrestaShop
repo_name: PrestaShop/PrestaShop
description: PrestaShop is the universal open-source software platform to build your e-commerce solution.
repo_language: PHP
owner: PrestaShop
CVE-2013-6376 (published 2013-12-14T18:08Z)

The recalculate_apic_map function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (host OS crash) via a crafted ICR write operation in x2apic mode.

Severity: MEDIUM
CVSS v2 base score: 5.2 (AV:A/AC:M/Au:S/C:N/I:N/A:C)

Weakness information:
cwe_id: CWE-189
cwe_name: Numeric Errors
description: Weaknesses in this category are related to improper calculation or conversion of numbers.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Gleb Natapov
author_date: 2013-12-12 21:20:08+01:00
msg: KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

A guest can cause a BUG_ON() leading to a host kernel crash.
When the guest writes to the ICR to request an IPI, while in x2apic
mode the following things happen, the destination is read from
ICR2, which is a register that the guest can control.

kvm_irq_delivery_to_apic_fast uses the high 16 bits of ICR2 as the
cluster id.  A BUG_ON is triggered, which is a protection against
accessing map->logical_map with an out-of-bounds access and manages
to avoid that anything really unsafe occurs.

The logic in the code is correct from real HW point of view. The problem
is that KVM supports only one cluster with ID 0 in clustered mode, but
the code that has the bug does not take this into account.

Reported-by: Lars Bull <larsbull@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: lapic.c
change_type: ModificationType.MODIFY
diff: @@ -143,6 +143,8 @@ static inline int kvm_apic_id(struct kvm_lapic *apic)
 	return (kvm_apic_get_reg(apic, APIC_ID) >> 24) & 0xff;
 }
 
+#define KVM_X2APIC_CID_BITS 0
+
 static void recalculate_apic_map(struct kvm *kvm)
 {
 	struct kvm_apic_map *new, *old = NULL;
@@ -180,7 +182,8 @@ static void recalculate_apic_map(struct kvm *kvm)
 		if (apic_x2apic_mode(apic)) {
 			new->ldr_bits = 32;
 			new->cid_shift = 16;
-			new->cid_mask = new->lid_mask = 0xffff;
+			new->cid_mask = (1 << KVM_X2APIC_CID_BITS) - 1;
+			new->lid_mask = 0xffff;
 		} else if (kvm_apic_sw_enabled(apic) &&
 				!new->cid_mask /* flat mode */ &&
 				kvm_apic_get_reg(apic, APIC_DFR) == APIC_DFR_CLUSTER) {

programming_language: C
CVE-2014-8321 (published 2020-01-31T22:15Z)

Stack-based buffer overflow in the gps_tracker function in airodump-ng.c in Aircrack-ng before 1.2 RC 1 allows local users to execute arbitrary code or gain privileges via unspecified vectors.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/aircrack-ng/aircrack-ng
commit_details: repo_url: https://github.com/aircrack-ng/aircrack-ng
author: Thomas d'Otreppe
author_date: 2014-10-03 01:51:21+00:00
msg: Airodump-ng: Fixed GPS stack overflow (Closes #13 on GitHub).

git-svn-id: http://svn.aircrack-ng.org/trunk@2416 28c6078b-6c39-48e3-add9-af49d547ecab
repository: repo_url: https://github.com/aircrack-ng/aircrack-ng
repo_name: aircrack-ng/aircrack-ng
description: WiFi security auditing tools suite
repo_language: C
owner: aircrack-ng
file_changes: filename: airodump-ng.c
change_type: ModificationType.MODIFY
diff: @@ -4497,7 +4497,7 @@ void gps_tracker( void )
         	}
 
         	// New version, JSON
-        	if( recv( gpsd_sock, line + pos, sizeof( line ) - 1, 0 ) <= 0 )
+        	if( recv( gpsd_sock, line + pos, sizeof( line ) - pos - 1, 0 ) <= 0 )
         		return;
 
         	// search for TPV class: {"class":"TPV"

programming_language: C
CVE-2020-13398 (published 2020-05-22T18:15Z)

An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.3, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/FreeRDP/FreeRDP
commit_details: repo_url: https://github.com/FreeRDP/FreeRDP
author: akallabeth
author_date: 2020-05-18 17:10:08+02:00
msg: Updated changelog for 2.1.1

(cherry picked from commit 470b21d32dd9c6b4673209c8be1e896882581a2c)
repository: repo_url: https://github.com/FreeRDP/FreeRDP
repo_name: FreeRDP/FreeRDP
description: FreeRDP is a free remote desktop protocol library and clients
repo_language: C
owner: FreeRDP
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,21 @@
+# 2020-05-20  Version 2.1.1
+
+Important notes:
+* CVE: GHSL-2020-100 OOB Read in ntlm_read_ChallengeMessage
+* CVE: GHSL-2020-101 OOB Read in security_fips_decrypt due to uninitialized value
+* CVE: GHSL-2020-102 OOB Write in crypto_rsa_common
+* Enforce synchronous legacy RDP encryption count (#6156)
+* Fixed some leaks and crashes missed in 2.1.0
+* Removed dynamic channel listener limits
+* Lots of resource cleanup fixes (clang sanitizers)
+* A couple of performance improvements
+* Various small annoyances eliminated (typos, prefilled username for windows client, ...)
+
+
+For a complete and detailed change log since the last release candidate run:
+git log 2.1.0..2.1.1
+
+
 # 2020-05-05  Version 2.1.0
 
 Important notes:

programming_language: Markdown
CVE-2022-23590 (published 2022-02-04T23:15Z)

Tensorflow is an Open Source Machine Learning Framework. A `GraphDef` from a TensorFlow `SavedModel` can be maliciously altered to cause a TensorFlow process to crash due to encountering a `StatusOr` value that is an error and forcibly extracting the value from it. We have patched the issue in multiple GitHub commits and these will be included in TensorFlow 2.8.0 and TensorFlow 2.7.1, as both are affected.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-754
cwe_name: Improper Check for Unusual or Exceptional Conditions
description: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
extended_description: 
            The programmer may assume that certain events or conditions will never occur or do not need to be worried about, such as low memory conditions, lack of access to resources due to restrictive permissions, or misbehaving clients or components. However, attackers may intentionally trigger these unusual conditions, thus violating the programmer's assumptions, possibly introducing instability, incorrect behavior, or a vulnerability.
            Note that this entry is not exclusively about the use of exceptions and exception handling, which are mechanisms for both checking and handling unusual or unexpected conditions.
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Dan Moldovan
author_date: 2021-11-12 08:17:57-08:00
msg: Check for type inference error on node construction.

PiperOrigin-RevId: 409415804
Change-Id: Ieb6e020906b96f522bf8e2fa103715ddbbdc434a
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: graph.cc
change_type: ModificationType.MODIFY
diff: @@ -561,6 +561,11 @@ Node* Graph::AddNode(NodeDef node_def, Status* status) {
     VLOG(3) << "AddNode: found type constructor for " << node_def.name();
     const auto ctor_type =
         full_type::SpecializeType(AttrSlice(node_def), op_reg_data->op_def);
+    if (!ctor_type.ok()) {
+      *status = errors::InvalidArgument("type error: ",
+                                        ctor_type.status().ToString());
+      return nullptr;
+    }
     const FullTypeDef ctor_typedef = ctor_type.ValueOrDie();
     if (ctor_typedef.type_id() != TFT_UNSET) {
       *(node_def.mutable_experimental_type()) = ctor_typedef;

programming_language: C++
CVE-2021-33564 (published 2021-05-29T14:15Z)

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-88
cwe_name: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
description: The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
extended_description: 
            When creating commands using interpolation into a string, developers may assume that only the arguments/options that they specify will be processed.  This assumption may be even stronger when the programmer has encoded the command in a way that prevents separate commands from being provided maliciously, e.g. in the case of shell metacharacters.  When constructing the command, the developer may use whitespace or other delimiters that are required to separate arguments when the command. However, if an attacker can provide an untrusted input that contains argument-separating delimiters, then the resulting command will have more arguments than intended by the developer.  The attacker may then be able to change the behavior of the command.  Depending on the functionality supported by the extraneous arguments, this may have security-relevant consequences.
         
         

Fix information:
repo_url: https://github.com/markevans/dragonfly
commit_details: repo_url: https://github.com/markevans/dragonfly
author: Mark Evans
author_date: 2021-05-19 09:49:04+01:00
msg: Merge branch 'better-security'
repository: repo_url: https://github.com/markevans/dragonfly
repo_name: markevans/dragonfly
description: A Ruby gem for on-the-fly processing - suitable for image uploading in Rails, Sinatra and much more!
repo_language: Ruby
owner: markevans
CVE-2024-26132 (published 2024-02-29T01:44Z)

Element Android is an Android Matrix Client. A third-party malicious application installed on the same phone can force Element Android, version 0.91.0 through 1.6.12, to share files stored under the `files` directory in the application\'s private data directory to an arbitrary room. The impact of the attack is reduced by the fact that the databases stored in this folder are encrypted. However, it contains some other potentially sensitive information, such as the FCM token. Forks of Element Android which have set `android:exported="false"` in the `AndroidManifest.xml` file for the `IncomingShareActivity` activity are not impacted. This issue is fixed in Element Android 1.6.12. There is no known workaround to mitigate the issue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/element-hq/element-android
commit_details: repo_url: https://github.com/element-hq/element-android
author: Benoit Marty
author_date: 2024-02-16 11:51:56+01:00
msg: Store temporary files created for Camera in the media folder.
repository: repo_url: https://github.com/element-hq/element-android
repo_name: element-hq/element-android
description: A Matrix collaboration client for Android.
repo_language: Kotlin
owner: element-hq
file_changes: filename: +picker.bugfix
change_type: ModificationType.ADD
diff: @@ -0,0 +1 @@
+Store temporary files created for Camera in the media folder.

programming_language: Markdown
filename: MediaFileUtils.kt
change_type: ModificationType.MODIFY
diff: @@ -24,7 +24,7 @@ import java.util.Locale
 
 internal fun createTemporaryMediaFile(context: Context, mediaType: MediaType): File {
     val timeStamp: String = SimpleDateFormat("yyyyMMdd_HHmmss", Locale.getDefault()).format(Date())
-    val storageDir: File = context.filesDir.also { it.mkdirs() }
+    val storageDir: File = File(context.filesDir, "media").also { it.mkdirs() }
     val fileSuffix = when (mediaType) {
         MediaType.IMAGE -> ".jpg"
         MediaType.VIDEO -> ".mp4"

programming_language: Scala
filename: multipicker_provider_paths.xml
change_type: ModificationType.MODIFY
diff: @@ -2,5 +2,5 @@
 <paths>
     <files-path
         name="external_files"
-        path="." />
-</paths>
\ No newline at end of file
+        path="media" />
+</paths>

programming_language: Markdown
CVE-2020-27790 (published 2022-08-18T19:15Z)

A floating point exception issue was discovered in UPX in PackLinuxElf64::invert_pt_dynamic() function of p_lx_elf.cpp file. An attacker with a crafted input file could trigger this issue that could cause a crash leading to a denial of service. The highest impact is to Availability.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/upx/upx
commit_details: repo_url: https://github.com/upx/upx
author: John Reiser
author_date: 2020-01-13 17:10:02-08:00
msg: Detect bogus DT_SYMENT.

https://github.com/upx/upx/issues/331
	modified:   p_lx_elf.cpp
repository: repo_url: https://github.com/upx/upx
repo_name: upx/upx
description: UPX - the Ultimate Packer for eXecutables
repo_language: C++
owner: upx
file_changes: filename: p_lx_elf.cpp
change_type: ModificationType.MODIFY
diff: @@ -1614,9 +1614,17 @@ PackLinuxElf32::invert_pt_dynamic(Elf32_Dyn const *dynp)
         unsigned const  z_sym = dt_table[Elf32_Dyn::DT_SYMENT];
         unsigned const sz_sym = !z_sym ? sizeof(Elf32_Sym)
             : get_te32(&dynp0[-1+ z_sym].d_val);
+        if (sz_sym < sizeof(Elf32_Sym)) {
+            char msg[50]; snprintf(msg, sizeof(msg),
+                "bad DT_SYMENT %x", sz_sym);
+            throwCantPack(msg);
+        }
         if (v_sym < v_str) {
             symnum_end = (v_str - v_sym) / sz_sym;
         }
+        if (symnum_end < 1) {
+            throwCantPack("bad DT_SYMTAB");
+        }
     }
     // DT_HASH often ends at DT_SYMTAB
     unsigned const v_hsh = elf_unsigned_dynamic(Elf32_Dyn::DT_HASH);
@@ -5104,9 +5112,17 @@ PackLinuxElf64::invert_pt_dynamic(Elf64_Dyn const *dynp)
         unsigned const  z_sym = dt_table[Elf64_Dyn::DT_SYMENT];
         unsigned const sz_sym = !z_sym ? sizeof(Elf64_Sym)
             : get_te64(&dynp0[-1+ z_sym].d_val);
+        if (sz_sym < sizeof(Elf64_Sym)) {
+            char msg[50]; snprintf(msg, sizeof(msg),
+                "bad DT_SYMENT %x", sz_sym);
+            throwCantPack(msg);
+        }
         if (v_sym < v_str) {
             symnum_end = (v_str - v_sym) / sz_sym;
         }
+        if (symnum_end < 1) {
+            throwCantPack("bad DT_SYMTAB");
+        }
     }
     // DT_HASH often ends at DT_SYMTAB
     unsigned const v_hsh = elf_unsigned_dynamic(Elf64_Dyn::DT_HASH);

programming_language: C++
CVE-2018-12649 (published 2018-06-22T14:29Z)

An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method instead of a POST HTTP method in the login part, because this protection was only covering POST requests.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-307
cwe_name: Improper Restriction of Excessive Authentication Attempts
description: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/MISP/MISP
commit_details: repo_url: https://github.com/MISP/MISP
author: iglocska
author_date: 2018-06-21 15:48:32+02:00
msg: fix: [security] Brute force protection can be bypased with a PUT request

- fixes an issue where brute forcing the login would work by using PUT requests
- as reported by Silver Saks from CCDCOE
repository: repo_url: https://github.com/MISP/MISP
repo_name: MISP/MISP
description: MISP (core software) - Open Source Threat Intelligence and Sharing Platform
repo_language: PHP
owner: MISP
file_changes: filename: UsersController.php
change_type: ModificationType.MODIFY
diff: @@ -856,13 +856,13 @@ class UsersController extends AppController {
 	}
 
 	public function login() {
-		$this->Bruteforce = ClassRegistry::init('Bruteforce');
-		if ($this->request->is('post') && isset($this->request->data['User']['email'])) {
-			if ($this->Bruteforce->isBlacklisted($_SERVER['REMOTE_ADDR'], $this->request->data['User']['email'])) {
-				throw new ForbiddenException('You have reached the maximum number of login attempts. Please wait ' . Configure::read('SecureAuth.expire') . ' seconds and try again.');
-			}
-		}
 		if ($this->request->is('post') || $this->request->is('put')) {
+			$this->Bruteforce = ClassRegistry::init('Bruteforce');
+			if (!empty($this->request->data['User']['email'])) {
+				if ($this->Bruteforce->isBlacklisted($_SERVER['REMOTE_ADDR'], $this->request->data['User']['email'])) {
+					throw new ForbiddenException('You have reached the maximum number of login attempts. Please wait ' . Configure::read('SecureAuth.expire') . ' seconds and try again.');
+				}
+			}
 			// Check the length of the user's authkey
 			$userPass = $this->User->find('first', array(
 				'conditions' => array('User.email' => $this->request->data['User']['email']),

programming_language: PHP