1 file changed, 14 insertions, 11 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index 3d426e9..aef7190 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -64,7 +64,8 @@ local groups_filename = "/etc/cgit-auth/groups"
 -- Per-repository access lives one per line as reponame:group1,group2 and so
 -- on. A repository named here is protected and one that is not named is
 -- public. The repository name has to match exactly, while group and user names
--- match regardless of case.
+-- match regardless of case. While this file cannot be read every repository
+-- is refused, since nothing then tells the protected ones apart.
 local repos_filename = "/etc/cgit-auth/repos"
 
 -- Where the cookie-signing secret is stored, created on first use. It must be
@@ -142,18 +143,20 @@ function repo_userset(repo)
 		return nil
 	end
 	local groups = nil
-	local repos_file = io.open(repos_filename, "r")
-	if repos_file ~= nil then
-		for line in repos_file:lines() do
-			local name, list = string.match(line, "(.-):(.+)")
-			if name ~= nil and trim(name) == repo then
-				groups = {}
-				add_names(list, groups)
-				break
-			end
+	local repos_file, err = io.open(repos_filename, "r")
+	if repos_file == nil then
+		io.stderr:write("[cgit] Unable to read the auth repos file: " .. err .. "\n")
+		return {}
+	end
+	for line in repos_file:lines() do
+		local name, list = string.match(line, "(.-):(.*)")
+		if name ~= nil and trim(name) == repo then
+			groups = {}
+			add_names(list, groups)
+			break
 		end
-		repos_file:close()
 	end
+	repos_file:close()
 	if groups == nil then
 		return nil
 	end