Say when a login fails, and line up the form

A wrong password sent the reader back to the same empty form, which
looked no different from a crash. The redirect now carries a flag the
form reads, the same for an unknown user as for a wrong password, and
the form leaves the flag out of the way back it signs.

1 file changed, 22 insertions, 8 deletions

diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.luaindex 354adac..a03e1ea 100644--- a/custom/extensions/auth-file.lua+++ b/custom/extensions/auth-file.lua@@ -476,6 +476,18 @@ function redirect_to(url) 	html("Location: " .. strip_controls(url) .. "\n") end +-- A failed login lands back on the page it came from with this flag, which+-- the form reads to say so and leaves out of the way back it signs.+local failed_flag = "login=failed"++local function flag_failure(url)+	return url .. (url:find("?", 1, true) and "&" or "?") .. failed_flag+end++local function drop_failure_flag(url)+	return (url:gsub("[?&]" .. failed_flag .. "$", ""))+end+ function not_found() 	html("Status: 404 Not Found\n") 	html("Cache-Control: no-cache, no-store\n\n")@@ -484,9 +496,8 @@ end -- The three actions cgit can ask for follow, and they are the same in both -- variants, so a change to one belongs in the other. --- The redirect goes out before the password is checked, so a wrong password--- and a right one answer with the same status and location and differ only in--- the cookie.+-- A wrong password and an unknown user answer alike, so the flag on the way+-- back says only that the login failed. function authenticate_post() 	local redirect = validate_value("redirect", post["redirect"]) @@ -495,8 +506,6 @@ function authenticate_post() 		return 0 	end -	redirect_to(redirect)- 	local username = post["username"] 	local password = post["password"] 	local session = ""@@ -514,6 +523,7 @@ function authenticate_post() 	end  	-- A failed login answers with an empty session, which clears the cookie.+	redirect_to(session == "" and flag_failure(redirect) or redirect) 	set_cookie(session_cookie, session)  	html("\n")@@ -541,13 +551,17 @@ end -- The form carries a signed redirect token, so the browser lands back on the -- page that was asked for. function body()-	local target = cgit["url"]+	local target = drop_failure_flag(cgit["url"])+	local failed = target ~= cgit["url"] 	if not is_safe_redirect(target) then 		target = cgit["login"] 	end  	html("<h2>Authentication Required</h2>")-	html("<form method='post' action='")+	if failed then+		html("<p class='login-error' role='alert'>Wrong username or password.</p>")+	end+	html("<form class='login' method='post' action='") 	html_attr(cgit["login"]) 	html("'>") 	html("<input type='hidden' name='redirect' value='")@@ -560,7 +574,7 @@ function body() 	html("<tr><td><label for='password'>Password:</label></td><td>") 	html("<input id='password' name='password' type='password'") 	html(" autocomplete='current-password'></td></tr>")-	html("<tr><td colspan='2'>")+	html("<tr><td></td><td>") 	html("<input value='Login' type='submit'></td></tr>") 	html("</table></form>") 
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index 354adac..a03e1ea 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -476,6 +476,18 @@ function redirect_to(url)
 	html("Location: " .. strip_controls(url) .. "\n")
 end
 
+-- A failed login lands back on the page it came from with this flag, which
+-- the form reads to say so and leaves out of the way back it signs.
+local failed_flag = "login=failed"
+
+local function flag_failure(url)
+	return url .. (url:find("?", 1, true) and "&" or "?") .. failed_flag
+end
+
+local function drop_failure_flag(url)
+	return (url:gsub("[?&]" .. failed_flag .. "$", ""))
+end
+
 function not_found()
 	html("Status: 404 Not Found\n")
 	html("Cache-Control: no-cache, no-store\n\n")
@@ -484,9 +496,8 @@ end
 -- The three actions cgit can ask for follow, and they are the same in both
 -- variants, so a change to one belongs in the other.
 
--- The redirect goes out before the password is checked, so a wrong password
--- and a right one answer with the same status and location and differ only in
--- the cookie.
+-- A wrong password and an unknown user answer alike, so the flag on the way
+-- back says only that the login failed.
 function authenticate_post()
 	local redirect = validate_value("redirect", post["redirect"])
 
@@ -495,8 +506,6 @@ function authenticate_post()
 		return 0
 	end
 
-	redirect_to(redirect)
-
 	local username = post["username"]
 	local password = post["password"]
 	local session = ""
@@ -514,6 +523,7 @@ function authenticate_post()
 	end
 
 	-- A failed login answers with an empty session, which clears the cookie.
+	redirect_to(session == "" and flag_failure(redirect) or redirect)
 	set_cookie(session_cookie, session)
 
 	html("\n")
@@ -541,13 +551,17 @@ end
 -- The form carries a signed redirect token, so the browser lands back on the
 -- page that was asked for.
 function body()
-	local target = cgit["url"]
+	local target = drop_failure_flag(cgit["url"])
+	local failed = target ~= cgit["url"]
 	if not is_safe_redirect(target) then
 		target = cgit["login"]
 	end
 
 	html("<h2>Authentication Required</h2>")
-	html("<form method='post' action='")
+	if failed then
+		html("<p class='login-error' role='alert'>Wrong username or password.</p>")
+	end
+	html("<form class='login' method='post' action='")
 	html_attr(cgit["login"])
 	html("'>")
 	html("<input type='hidden' name='redirect' value='")
@@ -560,7 +574,7 @@ function body()
 	html("<tr><td><label for='password'>Password:</label></td><td>")
 	html("<input id='password' name='password' type='password'")
 	html(" autocomplete='current-password'></td></tr>")
-	html("<tr><td colspan='2'>")
+	html("<tr><td></td><td>")
 	html("<input value='Login' type='submit'></td></tr>")
 	html("</table></form>")