1 file changed, 4 insertions, 10 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index 96c2074..c0341e5 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -79,8 +79,8 @@ local groups_filename = "/etc/cgit-auth/groups"
 -- Per-repository access lives one per line as reponame:group1,group2 and so
 -- on. A repository named here is protected and one that is not named is
 -- public. The repository name has to match exactly, while group and user names
--- match regardless of case. While this file cannot be read every repository
--- is refused, since nothing then tells the protected ones apart.
+-- match regardless of case. While this file cannot be read every page, the
+-- index too, is refused, since nothing then tells the protected ones apart.
 local repos_filename = "/etc/cgit-auth/repos"
 
 -- Where the cookie-signing secret is stored, created on first use. It must be
@@ -152,9 +152,6 @@ end
 -- a failed login can spend the same work on a hash of the same kind and
 -- cost, and its timing does not tell whether the name exists.
 function account_hash(user)
-	if user == nil then
-		return nil
-	end
 	local wanted = user:lower()
 	local users_file = io.open(users_filename, "r")
 	if users_file == nil then
@@ -180,9 +177,6 @@ end
 -- repository whose groups resolve to nobody comes back as an empty table
 -- instead, so it denies everyone rather than falling through to public.
 function repo_userset(repo)
-	if repo == nil then
-		return nil
-	end
 	local groups = nil
 	local repos_file, err = io.open(repos_filename, "r")
 	if repos_file == nil then
@@ -415,7 +409,7 @@ function set_cookie(cookie, value)
 	end
 	if value == "" then
 		attributes = attributes .. "; Max-Age=0"
-	elseif session_seconds > 0 then
+	else
 		attributes = attributes .. "; Max-Age=" .. tostring(session_seconds)
 	end
 	html("Set-Cookie: " .. cookie .. "=" .. value .. attributes .. "\n")
@@ -454,7 +448,7 @@ end
 function authenticate_post()
 	local redirect = validate_value("redirect", post["redirect"])
 
-	if redirect == nil or not is_safe_redirect(redirect) then
+	if not is_safe_redirect(redirect) then
 		not_found()
 		return 0
 	end