Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Log failed logins
The login posts outside any repository, so the log line names the
repository by the page its signed way back leads to.
| -rw-r--r-- | custom/extensions/auth-file.lua | 7 | |
| -rw-r--r-- | custom/extensions/auth-inline.lua | 7 | |
| -rw-r--r-- | tests/extensions/test-auth.lua | 7 |
3 files changed, 21 insertions, 0 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua index 790c1fd..81c5710 100644 --- a/custom/extensions/auth-file.lua +++ b/custom/extensions/auth-file.lua @@ -489,6 +489,13 @@ function authenticate_post() end end + -- A failed login is logged with the name, stripped of control characters + -- that could forge a line of their own, but never with the password. + if session == "" then + local name = (username or ""):gsub("%c", "") + io.stderr:write("[cgit] Failed login as " .. name .. " for " .. redirect .. "\n") + end + -- A failed login answers with an empty session, which clears the cookie. redirect_to(session == "" and flag_failure(redirect) or redirect) set_cookie(session_cookie, session) diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua index 99e33d2..cb9802c 100644 --- a/custom/extensions/auth-inline.lua +++ b/custom/extensions/auth-inline.lua @@ -452,6 +452,13 @@ function authenticate_post() end end + -- A failed login is logged with the name, stripped of control characters + -- that could forge a line of their own, but never with the password. + if session == "" then + local name = (username or ""):gsub("%c", "") + io.stderr:write("[cgit] Failed login as " .. name .. " for " .. redirect .. "\n") + end + -- A failed login answers with an empty session, which clears the cookie. redirect_to(session == "" and flag_failure(redirect) or redirect) set_cookie(session_cookie, session) diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 73843ab..1fb9c21 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -337,11 +337,18 @@ h.contains("a good login redirects back", out, "Status: 302") h.contains("to where the form said", out, "Location: /repo/\n") local granted = out:match("Set%-Cookie: __Host%-cgitauth=([^;]*);") h.equals("and grants a session that verifies", granted and validate_value("username", granted, account_hash), "Alice") +h.equals("and logs nothing", h.error_log(), "") out = login("Alice", "wrong", way_back) h.contains("a bad password redirects the same way", out, "Status: 302") h.contains("back to the page with the failure flagged", out, "Location: /repo/?login=failed\n") h.contains("but clears the session cookie", out, "Set-Cookie: " .. session_name .. "=; ") +h.contains("and is logged with the name and the page", h.error_log(), + "[cgit] Failed login as Alice for /repo/\n") +h.excludes("but never with the password", h.error_log(), "wrong") +login("eve\r\n[cgit] Forged", "x", way_back) +h.contains("a name cannot forge a log line of its own", h.error_log(), + "[cgit] Failed login as eve[cgit] Forged for /repo/\n") -- A failed login for a name with no account spends crypt on a configured -- hash, the same work a real check costs, so timing tells nothing. |