Diff options
| -rw-r--r-- | custom/extensions/auth-file.lua | 25 | |
| -rw-r--r-- | tests/extensions/test-auth.lua | 13 |
2 files changed, 27 insertions, 11 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua index 3d426e9..aef7190 100644 --- a/custom/extensions/auth-file.lua +++ b/custom/extensions/auth-file.lua @@ -64,7 +64,8 @@ local groups_filename = "/etc/cgit-auth/groups" -- Per-repository access lives one per line as reponame:group1,group2 and so -- on. A repository named here is protected and one that is not named is -- public. The repository name has to match exactly, while group and user names --- match regardless of case. +-- match regardless of case. While this file cannot be read every repository +-- is refused, since nothing then tells the protected ones apart. local repos_filename = "/etc/cgit-auth/repos" -- Where the cookie-signing secret is stored, created on first use. It must be @@ -142,18 +143,20 @@ function repo_userset(repo) return nil end local groups = nil - local repos_file = io.open(repos_filename, "r") - if repos_file ~= nil then - for line in repos_file:lines() do - local name, list = string.match(line, "(.-):(.+)") - if name ~= nil and trim(name) == repo then - groups = {} - add_names(list, groups) - break - end + local repos_file, err = io.open(repos_filename, "r") + if repos_file == nil then + io.stderr:write("[cgit] Unable to read the auth repos file: " .. err .. "\n") + return {} + end + for line in repos_file:lines() do + local name, list = string.match(line, "(.-):(.*)") + if name ~= nil and trim(name) == repo then + groups = {} + add_names(list, groups) + break end - repos_file:close() end + repos_file:close() if groups == nil then return nil end diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index e9fed78..0025a81 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -36,6 +36,7 @@ if variant == "file" then local repos_file = io.open("auth-repos", "w") repos_file:write("secret-repo:devs\n") repos_file:write("empty-repo:ghosts\n") + repos_file:write("bare-repo:\n") repos_file:close() h.redirect_file("/etc/cgit-auth/users", "auth-users") h.redirect_file("/etc/cgit-auth/groups", "auth-groups") @@ -53,6 +54,7 @@ if variant == "inline" then local access = { ["secret-repo"] = { alice = true, bob = true }, ["empty-repo"] = {}, + ["bare-repo"] = {}, } function account_hash(user) if user == nil then @@ -83,11 +85,22 @@ h.equals("the repository name matches case exactly", repo_userset("Secret-Repo") local empty = repo_userset("empty-repo") h.check("a protected repository with no members denies as an empty set", empty ~= nil and next(empty) == nil) +local bare = repo_userset("bare-repo") +h.check("a protected repository with no groups at all denies too", + bare ~= nil and next(bare) == nil) if variant == "file" then h.redirect_file("/etc/cgit-auth/users", "auth-users-missing") h.equals("a missing users file turns every login down", account_hash("alice"), nil) h.redirect_file("/etc/cgit-auth/users", "auth-users") + -- Without the repos file nothing tells a protected repository from a + -- public one, so every repository is refused while the index stays up. + h.redirect_file("/etc/cgit-auth/repos", "auth-repos-missing") + local refused = repo_userset("unlisted") + h.check("a missing repos file refuses every repository", + refused ~= nil and next(refused) == nil) + h.equals("the index stays public all the same", repo_userset(nil), nil) + h.redirect_file("/etc/cgit-auth/repos", "auth-repos") end -- The url and cookie helpers. |