Log failed logins

The login posts outside any repository, so the log line names the
repository by the page its signed way back leads to.

1 file changed, 7 insertions, 0 deletions

diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.luaindex 73843ab..1fb9c21 100644--- a/tests/extensions/test-auth.lua+++ b/tests/extensions/test-auth.lua@@ -337,11 +337,18 @@ h.contains("a good login redirects back", out, "Status: 302") h.contains("to where the form said", out, "Location: /repo/\n") local granted = out:match("Set%-Cookie: __Host%-cgitauth=([^;]*);") h.equals("and grants a session that verifies", granted and validate_value("username", granted, account_hash), "Alice")+h.equals("and logs nothing", h.error_log(), "")  out = login("Alice", "wrong", way_back) h.contains("a bad password redirects the same way", out, "Status: 302") h.contains("back to the page with the failure flagged", out, "Location: /repo/?login=failed\n") h.contains("but clears the session cookie", out, "Set-Cookie: " .. session_name .. "=; ")+h.contains("and is logged with the name and the page", h.error_log(),+	"[cgit] Failed login as Alice for /repo/\n")+h.excludes("but never with the password", h.error_log(), "wrong")+login("eve\r\n[cgit] Forged", "x", way_back)+h.contains("a name cannot forge a log line of its own", h.error_log(),+	"[cgit] Failed login as eve[cgit] Forged for /repo/\n")  -- A failed login for a name with no account spends crypt on a configured -- hash, the same work a real check costs, so timing tells nothing.
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index 73843ab..1fb9c21 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -337,11 +337,18 @@ h.contains("a good login redirects back", out, "Status: 302")
 h.contains("to where the form said", out, "Location: /repo/\n")
 local granted = out:match("Set%-Cookie: __Host%-cgitauth=([^;]*);")
 h.equals("and grants a session that verifies", granted and validate_value("username", granted, account_hash), "Alice")
+h.equals("and logs nothing", h.error_log(), "")
 
 out = login("Alice", "wrong", way_back)
 h.contains("a bad password redirects the same way", out, "Status: 302")
 h.contains("back to the page with the failure flagged", out, "Location: /repo/?login=failed\n")
 h.contains("but clears the session cookie", out, "Set-Cookie: " .. session_name .. "=; ")
+h.contains("and is logged with the name and the page", h.error_log(),
+	"[cgit] Failed login as Alice for /repo/\n")
+h.excludes("but never with the password", h.error_log(), "wrong")
+login("eve\r\n[cgit] Forged", "x", way_back)
+h.contains("a name cannot forge a log line of its own", h.error_log(),
+	"[cgit] Failed login as eve[cgit] Forged for /repo/\n")
 
 -- A failed login for a name with no account spends crypt on a configured
 -- hash, the same work a real check costs, so timing tells nothing.