Bugfix: WinVaultKeyring.get_credential with non-existent username returns credential of other user (#698)

keyring/backends/Windows.py

@@ -164,7 +164,8 @@ def get_credential(self, service, username):
             res = self._get_password(self._compound_name(username, service))
         # get any first password under the service name
         if not res:
-            res = self._get_password(service)
-            if not res:
-                return None
+            cred = self._get_password(service)
+            res = cred if username is None or username == cred["UserName"] else None
+        if not res:
+            return None
         return SimpleCredential(res['UserName'], res.value)

keyring/testing/backend.py

@@ -181,3 +181,20 @@ def test_new_with_properties(self):
         assert alt.foo == 'bar'
         with pytest.raises(AttributeError):
             self.keyring.foo  # noqa: B018
+
+    def test_wrong_username_returns_none(self):
+        keyring = self.keyring
+        service = 'test_wrong_username_returns_none'
+        cred = keyring.get_credential(service, None)
+        assert cred is None
+
+        password_1 = 'password1'
+        password_2 = 'password2'
+        self.set_password(service, 'user1', password_1)
+        self.set_password(service, 'user2', password_2)
+
+        assert keyring.get_credential(service, "user1").password == password_1
+        assert keyring.get_credential(service, "user2").password == password_2
+
+        # Missing/wrong username should not return a cred
+        assert keyring.get_credential(service, "nobody!") is None

newsfragments/698.bugfix.rst

@@ -0,0 +1 @@
+In get_credential, now returns None when the indicated username is not found.