Diff options
Diffstat (limited to 'custom/extensions/auth-file.lua')
| -rw-r--r-- | custom/extensions/auth-file.lua | 7 |
1 file changed, 7 insertions, 0 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua index 790c1fd..81c5710 100644 --- a/custom/extensions/auth-file.lua +++ b/custom/extensions/auth-file.lua @@ -489,6 +489,13 @@ function authenticate_post() end end + -- A failed login is logged with the name, stripped of control characters + -- that could forge a line of their own, but never with the password. + if session == "" then + local name = (username or ""):gsub("%c", "") + io.stderr:write("[cgit] Failed login as " .. name .. " for " .. redirect .. "\n") + end + -- A failed login answers with an empty session, which clears the cookie. redirect_to(session == "" and flag_failure(redirect) or redirect) set_cookie(session_cookie, session) |