Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Log failed logins
The login posts outside any repository, so the log line names the
repository by the page its signed way back leads to.
Diffstat (limited to 'custom/extensions/auth-inline.lua')
| -rw-r--r-- | custom/extensions/auth-inline.lua | 7 |
1 file changed, 7 insertions, 0 deletions
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua index 99e33d2..cb9802c 100644 --- a/custom/extensions/auth-inline.lua +++ b/custom/extensions/auth-inline.lua @@ -452,6 +452,13 @@ function authenticate_post() end end + -- A failed login is logged with the name, stripped of control characters + -- that could forge a line of their own, but never with the password. + if session == "" then + local name = (username or ""):gsub("%c", "") + io.stderr:write("[cgit] Failed login as " .. name .. " for " .. redirect .. "\n") + end + -- A failed login answers with an empty session, which clears the cookie. redirect_to(session == "" and flag_failure(redirect) or redirect) set_cookie(session_cookie, session) |