Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Log failed logins
The login posts outside any repository, so the log line names the
repository by the page its signed way back leads to.
Diffstat (limited to 'custom/extensions/auth-file.lua')
| -rw-r--r-- | custom/extensions/auth-file.lua | 7 |
1 file changed, 7 insertions, 0 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua index 790c1fd..81c5710 100644 --- a/custom/extensions/auth-file.lua +++ b/custom/extensions/auth-file.lua @@ -489,6 +489,13 @@ function authenticate_post() end end + -- A failed login is logged with the name, stripped of control characters + -- that could forge a line of their own, but never with the password. + if session == "" then + local name = (username or ""):gsub("%c", "") + io.stderr:write("[cgit] Failed login as " .. name .. " for " .. redirect .. "\n") + end + -- A failed login answers with an empty session, which clears the cookie. redirect_to(session == "" and flag_failure(redirect) or redirect) set_cookie(session_cookie, session) |