Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Say what really differs between the auth filters
The lookups were never the only difference, since the configuration
and trim's place differ as well. The configuration is now set off by
blank lines, as in the other extensions, instead of a heading.
Diffstat (limited to 'custom/extensions/auth-file.lua')
| -rw-r--r-- | custom/extensions/auth-file.lua | 7 |
1 file changed, 4 insertions, 3 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua index c0341e5..8a70887 100644 --- a/custom/extensions/auth-file.lua +++ b/custom/extensions/auth-file.lua @@ -53,7 +53,6 @@ -- still lists a protected repository with its description unless cgitrc sets -- repo.hide=1 for it. --- The values that follow are the configuration and are meant to be edited. -- Accounts live one per line as username:hash, where the hash is any kind this -- system's crypt(3) checks. yescrypt ($y$) is what libxcrypt recommends, as on @@ -105,6 +104,7 @@ local cookie_insecure = false -- the password's length, and one longer than this is turned down unchecked. local max_password_bytes = 256 + -- A browser accepts a cookie named __Host- only when it is Secure, covers the -- whole host and was set by this host, so no sibling subdomain can plant a -- session in its place. Either cookie setting above can rule that out. @@ -117,8 +117,9 @@ end -- open decodes is kept here for the calls that follow. local action, http, cgit, post --- The two lookups below, account_hash and repo_userset, are the only part --- of this script that differs from auth-inline.lua. +-- Apart from the configuration, the lookups below, account_hash and +-- repo_userset with their helpers, are the only code that differs from +-- auth-inline.lua, which defines trim later, beside get_cookie. -- Lua patterns backtrack, so "^%s*(.-)%s*$" costs the square of a run of -- spaces inside the text. Finding each end directly stays linear, which |