Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Say where an edited auth filter belongs
make install copies every filter into the filters directory with mode
0644, so an edited auth-inline.lua there lost its lists on the next
install, which turned every protected repository public, and until then
showed its password hashes to every local user.
| -rw-r--r-- | custom/cgitrc | 7 | |
| -rw-r--r-- | custom/extensions/auth-file.lua | 5 | |
| -rw-r--r-- | custom/extensions/auth-inline.lua | 7 |
3 files changed, 17 insertions, 2 deletions
diff --git a/custom/cgitrc b/custom/cgitrc index c1a5b68..1e2dbaa 100644 --- a/custom/cgitrc +++ b/custom/cgitrc @@ -301,8 +301,11 @@ trust-scan-config=0 # Filter command invoked to authenticate access, gating repositories behind a # login. See custom/extensions/auth-inline.lua and -# custom/extensions/auth-file.lua. Value is a command. Default is none. -#auth-filter=lua:/usr/local/lib/cgit/filters/auth-inline.lua +# custom/extensions/auth-file.lua. make install overwrites the copies it puts +# in /usr/local/lib/cgit/filters, so edit a copy kept elsewhere, readable only +# by root and the web server's group, and point this at it. Value is a +# command. Default is none. +#auth-filter=lua:/etc/cgit/auth-inline.lua # Number of items to display in atom feeds. Value is an integer. Default is 10. max-atom-items=10 diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua index ab56ee1..8a3a771 100644 --- a/custom/extensions/auth-file.lua +++ b/custom/extensions/auth-file.lua @@ -6,6 +6,11 @@ -- access lists in files on disk, which suits a user set that is large or -- maintained by something else. The companion auth-inline.lua behaves -- identically but carries the same lists inside the script. +-- +-- make install puts this script in /usr/local/lib/cgit/filters and overwrites +-- it there on every run. The files it reads are left alone, but any setting +-- changed below is lost, so edit a copy kept where make install never writes, +-- such as /etc/cgit/auth-file.lua, and point auth-filter at it. -- The script runs on Lua 5.1 through 5.5 and LuaJIT, and the runtime has to be -- the same Lua that cgit was built against. On 5.5 it needs luaossl 20260910 diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua index e795717..014caa9 100644 --- a/custom/extensions/auth-inline.lua +++ b/custom/extensions/auth-inline.lua @@ -6,6 +6,13 @@ -- lists in two tables inside the script, which suits a small fixed set of -- users. The companion auth-file.lua behaves identically but reads the same -- lists from files on disk. +-- +-- make install puts this script in /usr/local/lib/cgit/filters and overwrites +-- it there on every run, which would wipe the lists below and leave every +-- repository public. Edit a copy kept where make install never writes, such +-- as /etc/cgit/auth-inline.lua, and point auth-filter at it. The copy holds +-- password hashes, so make it readable only by root and the web server's +-- group, for example root:www-data with mode 0640. -- The script runs on Lua 5.1 through 5.5 and LuaJIT, and the runtime has to be -- the same Lua that cgit was built against. On 5.5 it needs luaossl 20260910 |