Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Tell a signed-in visitor they have no access
| -rw-r--r-- | custom/extensions/auth-file.lua | 6 | |
| -rw-r--r-- | custom/extensions/auth-inline.lua | 6 | |
| -rw-r--r-- | tests/extensions/test-auth.lua | 7 |
3 files changed, 19 insertions, 0 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua index 3814a1f..f05a59e 100644 --- a/custom/extensions/auth-file.lua +++ b/custom/extensions/auth-file.lua @@ -533,6 +533,12 @@ function body() html("<p class='login-error' role='alert'>Logins are unavailable. The server's error log says why.</p>") return 0 end + -- cgit asks for the form only once the cookie has been turned down, so + -- a session that still verifies belongs to someone not let in here. + local cookie = get_cookie(http["cookie"], session_cookie) + if validate_value("username", cookie, account_hash) then + html("<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>") + end if failed then html("<p class='login-error' role='alert'>Wrong username or password.</p>") end diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua index e7f12cd..878d55e 100644 --- a/custom/extensions/auth-inline.lua +++ b/custom/extensions/auth-inline.lua @@ -496,6 +496,12 @@ function body() html("<p class='login-error' role='alert'>Logins are unavailable. The server's error log says why.</p>") return 0 end + -- cgit asks for the form only once the cookie has been turned down, so + -- a session that still verifies belongs to someone not let in here. + local cookie = get_cookie(http["cookie"], session_cookie) + if validate_value("username", cookie, account_hash) then + html("<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>") + end if failed then html("<p class='login-error' role='alert'>Wrong username or password.</p>") end diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 3a4fabf..db97bb3 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -293,6 +293,13 @@ h.contains("the login form posts to the login url", out, "<form class='login' me h.equals("a first visit says nothing failed", out:find("login-error", 1, true), nil) h.equals("the form carries a signed way back", way_back_in(out), "/repo/log/?q=x") +out = run_action("body", { cookie = session_name .. "=" .. outsider }) +h.contains("a visitor signed in without access is told so", out, + "<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>") +h.check("and can still sign in as someone else", way_back_in(out) ~= nil) +out = run_action("body", { cookie = session_name .. "=" .. forged }) +h.excludes("a forged session is not taken for a signed-in visitor", out, "signed in") + out = run_action("body", { url = "//evil.example/x" }) h.equals("an unsafe destination is swapped for the login page", way_back_in(out), "/?p=login") h.equals("and is not taken for a failed login", out:find("login-error", 1, true), nil) |