"<?xml version="1.0"?><api><login result="Failed" reason="Incorrect password entered. Please try again." /></api>"
This is on action=login using format=xml (sorry, I found this via Huggle :()
Description
Description
Event Timeline
Comment Actions
This comes from the backwards compatibility to allow people to try to still log in with the main account via action=login: if the BotPassword login fails, it tries it as a main-account login instead and returns the error from that.
ApiLogin doesn't return WrongPass since 1.27. Only NeedToken, WrongToken, Success, Failed, or Aborted.
Comment Actions
The bot login error could just be displayed as a warning. That's unlikely to break any legacy bots (and if the bot login failed, there is not much left to break anyway).
Comment Actions
Just as a historical note, when we added deprecation warnings to ApiLogin for the deprecation of NeedToken it broke several bots. ;)
Another thing we could potentially do is to use the BotPassword response if the AuthManager login failed and the username specified doesn't exist. There's potential for false positives there too (e.g. a central account with no local account), but I'm not inclined to spend a whole lot of effort on this.