3 files changed, 21 insertions, 0 deletions

diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.luaindex 790c1fd..81c5710 100644--- a/custom/extensions/auth-file.lua+++ b/custom/extensions/auth-file.lua@@ -489,6 +489,13 @@ function authenticate_post() 		end 	end +	-- A failed login is logged with the name, stripped of control characters+	-- that could forge a line of their own, but never with the password.+	if session == "" then+		local name = (username or ""):gsub("%c", "")+		io.stderr:write("[cgit] Failed login as " .. name .. " for " .. redirect .. "\n")+	end+ 	-- A failed login answers with an empty session, which clears the cookie. 	redirect_to(session == "" and flag_failure(redirect) or redirect) 	set_cookie(session_cookie, session)
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index 790c1fd..81c5710 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -489,6 +489,13 @@ function authenticate_post()
 		end
 	end
 
+	-- A failed login is logged with the name, stripped of control characters
+	-- that could forge a line of their own, but never with the password.
+	if session == "" then
+		local name = (username or ""):gsub("%c", "")
+		io.stderr:write("[cgit] Failed login as " .. name .. " for " .. redirect .. "\n")
+	end
+
 	-- A failed login answers with an empty session, which clears the cookie.
 	redirect_to(session == "" and flag_failure(redirect) or redirect)
 	set_cookie(session_cookie, session)
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.luaindex 99e33d2..cb9802c 100644--- a/custom/extensions/auth-inline.lua+++ b/custom/extensions/auth-inline.lua@@ -452,6 +452,13 @@ function authenticate_post() 		end 	end +	-- A failed login is logged with the name, stripped of control characters+	-- that could forge a line of their own, but never with the password.+	if session == "" then+		local name = (username or ""):gsub("%c", "")+		io.stderr:write("[cgit] Failed login as " .. name .. " for " .. redirect .. "\n")+	end+ 	-- A failed login answers with an empty session, which clears the cookie. 	redirect_to(session == "" and flag_failure(redirect) or redirect) 	set_cookie(session_cookie, session)
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index 99e33d2..cb9802c 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -452,6 +452,13 @@ function authenticate_post()
 		end
 	end
 
+	-- A failed login is logged with the name, stripped of control characters
+	-- that could forge a line of their own, but never with the password.
+	if session == "" then
+		local name = (username or ""):gsub("%c", "")
+		io.stderr:write("[cgit] Failed login as " .. name .. " for " .. redirect .. "\n")
+	end
+
 	-- A failed login answers with an empty session, which clears the cookie.
 	redirect_to(session == "" and flag_failure(redirect) or redirect)
 	set_cookie(session_cookie, session)
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.luaindex 73843ab..1fb9c21 100644--- a/tests/extensions/test-auth.lua+++ b/tests/extensions/test-auth.lua@@ -337,11 +337,18 @@ h.contains("a good login redirects back", out, "Status: 302") h.contains("to where the form said", out, "Location: /repo/\n") local granted = out:match("Set%-Cookie: __Host%-cgitauth=([^;]*);") h.equals("and grants a session that verifies", granted and validate_value("username", granted, account_hash), "Alice")+h.equals("and logs nothing", h.error_log(), "")  out = login("Alice", "wrong", way_back) h.contains("a bad password redirects the same way", out, "Status: 302") h.contains("back to the page with the failure flagged", out, "Location: /repo/?login=failed\n") h.contains("but clears the session cookie", out, "Set-Cookie: " .. session_name .. "=; ")+h.contains("and is logged with the name and the page", h.error_log(),+	"[cgit] Failed login as Alice for /repo/\n")+h.excludes("but never with the password", h.error_log(), "wrong")+login("eve\r\n[cgit] Forged", "x", way_back)+h.contains("a name cannot forge a log line of its own", h.error_log(),+	"[cgit] Failed login as eve[cgit] Forged for /repo/\n")  -- A failed login for a name with no account spends crypt on a configured -- hash, the same work a real check costs, so timing tells nothing.
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index 73843ab..1fb9c21 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -337,11 +337,18 @@ h.contains("a good login redirects back", out, "Status: 302")
 h.contains("to where the form said", out, "Location: /repo/\n")
 local granted = out:match("Set%-Cookie: __Host%-cgitauth=([^;]*);")
 h.equals("and grants a session that verifies", granted and validate_value("username", granted, account_hash), "Alice")
+h.equals("and logs nothing", h.error_log(), "")
 
 out = login("Alice", "wrong", way_back)
 h.contains("a bad password redirects the same way", out, "Status: 302")
 h.contains("back to the page with the failure flagged", out, "Location: /repo/?login=failed\n")
 h.contains("but clears the session cookie", out, "Set-Cookie: " .. session_name .. "=; ")
+h.contains("and is logged with the name and the page", h.error_log(),
+	"[cgit] Failed login as Alice for /repo/\n")
+h.excludes("but never with the password", h.error_log(), "wrong")
+login("eve\r\n[cgit] Forged", "x", way_back)
+h.contains("a name cannot forge a log line of its own", h.error_log(),
+	"[cgit] Failed login as eve[cgit] Forged for /repo/\n")
 
 -- A failed login for a name with no account spends crypt on a configured
 -- hash, the same work a real check costs, so timing tells nothing.