Login: return HTTP 400 on invalid password or unconfirmed account

1 files changed, 10 insertions, 2 deletions

diff --git a/lib/Travelynx/Controller/Account.pm b/lib/Travelynx/Controller/Account.pm
index bc24c05..f0f2119 100644
--- a/lib/Travelynx/Controller/Account.pm
+++ b/lib/Travelynx/Controller/Account.pm
@@ -260,10 +260,18 @@ sub do_login {
 		else {
 			my $data = $self->users->get_login_data( name => $user );
 			if ( $data and $data->{status} == 0 ) {
-				$self->render( 'login', invalid => 'confirmation' );
+				$self->render(
+					'login',
+					status  => 400,
+					invalid => 'confirmation'
+				);
 			}
 			else {
-				$self->render( 'login', invalid => 'credentials' );
+				$self->render(
+					'login',
+					status  => 400,
+					invalid => 'credentials'
+				);
 			}
 		}
 	}