Merge pull request #689 from whitj00/patch-4

New issue Don't reveal whether password is <20 or >20 characters in RPC

src/rpcserver.cpp

@@ -827,11 +827,10 @@ void ServiceConnection(AcceptedConnection *conn)
         if (!HTTPAuthorized(mapHeaders))
         {
             LogPrintf("ThreadRPCServer incorrect password attempt from %s\n", conn->peer_address_to_string());
-            /* Deter brute-forcing short passwords.
+            /* Deter brute-forcing
                If this results in a DoS the user really
                shouldn't have their RPC port exposed. */
-            if (mapArgs["-rpcpassword"].size() < 20)
-                MilliSleep(250);
+            MilliSleep(250);
 
             conn->stream() << HTTPReply(HTTP_UNAUTHORIZED, "", false) << std::flush;
             break;