Say that logging in needs https

Only HTTPS=on counts, the same test cgit makes before it writes an
https link of its own.

1 file changed, 9 insertions, 2 deletions

diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.luaindex f05a59e..790c1fd 100644--- a/custom/extensions/auth-file.lua+++ b/custom/extensions/auth-file.lua@@ -18,7 +18,9 @@ -- -- The session cookie is marked Secure by default, so a browser only sends -- it back over HTTPS. On an instance served over plain HTTP login loops--- until cookie_insecure below is set.+-- until cookie_insecure below is set. The login form warns of this whenever+-- the web server does not pass HTTPS=on, so one behind a proxy that ends TLS+-- should set that by hand. -- -- Two libraries are needed. luaossl provides openssl.rand and openssl.hmac and -- lives at <https://github.com/wahern/luaossl>, and luaposix provides@@ -533,6 +535,11 @@ function body() 		html("<p class='login-error' role='alert'>Logins are unavailable. The server's error log says why.</p>") 		return 0 	end+	-- The session cookie is Secure, so over plain http the browser never+	-- sends it back and a login would only bring the form round again.+	if not cookie_insecure and http["https"] ~= "on" then+		html("<p class='login-error' role='alert'>Logging in only works over https.</p>")+	end 	-- cgit asks for the form only once the cookie has been turned down, so 	-- a session that still verifies belongs to someone not let in here. 	local cookie = get_cookie(http["cookie"], session_cookie)@@ -571,7 +578,7 @@ function filter_open(name, cookie, method, query, referer, path, host, https, 		repo, page, url, login) 	action = actions[name] 	post = {}-	http = { cookie = cookie }+	http = { cookie = cookie, https = https } 	cgit = { repo = repo, url = url, login = login } end 
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index f05a59e..790c1fd 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -18,7 +18,9 @@
 --
 -- The session cookie is marked Secure by default, so a browser only sends
 -- it back over HTTPS. On an instance served over plain HTTP login loops
--- until cookie_insecure below is set.
+-- until cookie_insecure below is set. The login form warns of this whenever
+-- the web server does not pass HTTPS=on, so one behind a proxy that ends TLS
+-- should set that by hand.
 --
 -- Two libraries are needed. luaossl provides openssl.rand and openssl.hmac and
 -- lives at <https://github.com/wahern/luaossl>, and luaposix provides
@@ -533,6 +535,11 @@ function body()
 		html("<p class='login-error' role='alert'>Logins are unavailable. The server's error log says why.</p>")
 		return 0
 	end
+	-- The session cookie is Secure, so over plain http the browser never
+	-- sends it back and a login would only bring the form round again.
+	if not cookie_insecure and http["https"] ~= "on" then
+		html("<p class='login-error' role='alert'>Logging in only works over https.</p>")
+	end
 	-- cgit asks for the form only once the cookie has been turned down, so
 	-- a session that still verifies belongs to someone not let in here.
 	local cookie = get_cookie(http["cookie"], session_cookie)
@@ -571,7 +578,7 @@ function filter_open(name, cookie, method, query, referer, path, host, https,
 		repo, page, url, login)
 	action = actions[name]
 	post = {}
-	http = { cookie = cookie }
+	http = { cookie = cookie, https = https }
 	cgit = { repo = repo, url = url, login = login }
 end