3 files changed, 19 insertions, 0 deletions

diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.luaindex 3814a1f..f05a59e 100644--- a/custom/extensions/auth-file.lua+++ b/custom/extensions/auth-file.lua@@ -533,6 +533,12 @@ function body() 		html("<p class='login-error' role='alert'>Logins are unavailable. The server's error log says why.</p>") 		return 0 	end+	-- cgit asks for the form only once the cookie has been turned down, so+	-- a session that still verifies belongs to someone not let in here.+	local cookie = get_cookie(http["cookie"], session_cookie)+	if validate_value("username", cookie, account_hash) then+		html("<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>")+	end 	if failed then 		html("<p class='login-error' role='alert'>Wrong username or password.</p>") 	end
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index 3814a1f..f05a59e 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -533,6 +533,12 @@ function body()
 		html("<p class='login-error' role='alert'>Logins are unavailable. The server's error log says why.</p>")
 		return 0
 	end
+	-- cgit asks for the form only once the cookie has been turned down, so
+	-- a session that still verifies belongs to someone not let in here.
+	local cookie = get_cookie(http["cookie"], session_cookie)
+	if validate_value("username", cookie, account_hash) then
+		html("<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>")
+	end
 	if failed then
 		html("<p class='login-error' role='alert'>Wrong username or password.</p>")
 	end
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.luaindex e7f12cd..878d55e 100644--- a/custom/extensions/auth-inline.lua+++ b/custom/extensions/auth-inline.lua@@ -496,6 +496,12 @@ function body() 		html("<p class='login-error' role='alert'>Logins are unavailable. The server's error log says why.</p>") 		return 0 	end+	-- cgit asks for the form only once the cookie has been turned down, so+	-- a session that still verifies belongs to someone not let in here.+	local cookie = get_cookie(http["cookie"], session_cookie)+	if validate_value("username", cookie, account_hash) then+		html("<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>")+	end 	if failed then 		html("<p class='login-error' role='alert'>Wrong username or password.</p>") 	end
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index e7f12cd..878d55e 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -496,6 +496,12 @@ function body()
 		html("<p class='login-error' role='alert'>Logins are unavailable. The server's error log says why.</p>")
 		return 0
 	end
+	-- cgit asks for the form only once the cookie has been turned down, so
+	-- a session that still verifies belongs to someone not let in here.
+	local cookie = get_cookie(http["cookie"], session_cookie)
+	if validate_value("username", cookie, account_hash) then
+		html("<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>")
+	end
 	if failed then
 		html("<p class='login-error' role='alert'>Wrong username or password.</p>")
 	end
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.luaindex 3a4fabf..db97bb3 100644--- a/tests/extensions/test-auth.lua+++ b/tests/extensions/test-auth.lua@@ -293,6 +293,13 @@ h.contains("the login form posts to the login url", out, "<form class='login' me h.equals("a first visit says nothing failed", out:find("login-error", 1, true), nil) h.equals("the form carries a signed way back", way_back_in(out), "/repo/log/?q=x") +out = run_action("body", { cookie = session_name .. "=" .. outsider })+h.contains("a visitor signed in without access is told so", out,+	"<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>")+h.check("and can still sign in as someone else", way_back_in(out) ~= nil)+out = run_action("body", { cookie = session_name .. "=" .. forged })+h.excludes("a forged session is not taken for a signed-in visitor", out, "signed in")+ out = run_action("body", { url = "//evil.example/x" }) h.equals("an unsafe destination is swapped for the login page", way_back_in(out), "/?p=login") h.equals("and is not taken for a failed login", out:find("login-error", 1, true), nil)
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index 3a4fabf..db97bb3 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -293,6 +293,13 @@ h.contains("the login form posts to the login url", out, "<form class='login' me
 h.equals("a first visit says nothing failed", out:find("login-error", 1, true), nil)
 h.equals("the form carries a signed way back", way_back_in(out), "/repo/log/?q=x")
 
+out = run_action("body", { cookie = session_name .. "=" .. outsider })
+h.contains("a visitor signed in without access is told so", out,
+	"<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>")
+h.check("and can still sign in as someone else", way_back_in(out) ~= nil)
+out = run_action("body", { cookie = session_name .. "=" .. forged })
+h.excludes("a forged session is not taken for a signed-in visitor", out, "signed in")
+
 out = run_action("body", { url = "//evil.example/x" })
 h.equals("an unsafe destination is swapped for the login page", way_back_in(out), "/?p=login")
 h.equals("and is not taken for a failed login", out:find("login-error", 1, true), nil)