2 files changed, 38 insertions, 12 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index ba05875..3814a1f 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -91,10 +91,11 @@ local groups_filename = "/etc/cgit-auth/groups"
 -- protected ones apart.
 local repos_filename = "/etc/cgit-auth/repos"
 
--- Where the cookie-signing secret is stored, created on first use. It must be
--- persistent and writable by cgit, and it is worth keeping outside the cache
--- root, because pruning the cache would delete a secret kept inside it and
--- invalidate every live session. This file should not be world-readable.
+-- Where the cookie-signing secret is stored, created on first use in a
+-- directory that has to exist already. It must be persistent and writable by
+-- cgit, and it is worth keeping outside the cache root, because pruning the
+-- cache would delete a secret kept inside it and invalidate every live
+-- session. This file should not be world-readable.
 local secret_filename = "/var/lib/cgit/auth-secret"
 
 -- How long a login stays valid, in seconds. The default is one week.
@@ -295,7 +296,9 @@ function get_secret()
 		local temporary_file = io.open(temporary_filename, "w")
 		if temporary_file == nil then
 			sysstat.umask(old_umask)
-			error("cgit auth: cannot create secret file " .. secret_filename)
+			local directory = secret_filename:match("^(.*)/") or "."
+			error("cgit auth: cannot create secret file " .. secret_filename ..
+				", as " .. directory .. " is missing or not writable by cgit")
 		end
 		local wrote = temporary_file:write(tohex(rand.bytes(32)))
 		local closed = temporary_file:close()
@@ -520,6 +523,16 @@ function body()
 	end
 
 	html("<h2>Authentication Required</h2>")
+	-- The token is signed before any of the form is written, since an error
+	-- raised part way through would land inside its markup. A missing
+	-- library or a secret that cannot be made leaves a page saying logins
+	-- are unavailable instead, with the reason in the error log.
+	local signed, token = pcall(secure_value, "redirect", target, 0)
+	if not signed then
+		io.stderr:write("[cgit] " .. tostring(token):match("[^\n]*") .. "\n")
+		html("<p class='login-error' role='alert'>Logins are unavailable. The server's error log says why.</p>")
+		return 0
+	end
 	if failed then
 		html("<p class='login-error' role='alert'>Wrong username or password.</p>")
 	end
@@ -527,7 +540,7 @@ function body()
 	html_attr(cgit["login"])
 	html("'>")
 	html("<input type='hidden' name='redirect' value='")
-	html_attr(secure_value("redirect", target, 0))
+	html_attr(token)
 	html("'>")
 	html("<table>")
 	html("<tr><td><label for='username'>Username:</label></td><td>")
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index 971d662..e7f12cd 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -92,10 +92,11 @@ local users = {
 	-- bob   = "$6$rounds=300000$REPLACE_THIS_SALT$REPLACE_THIS_HASH",
 }
 
--- Where the cookie-signing secret is stored, created on first use. It must be
--- persistent and writable by cgit, and it is worth keeping outside the cache
--- root, because pruning the cache would delete a secret kept inside it and
--- invalidate every live session. This file should not be world-readable.
+-- Where the cookie-signing secret is stored, created on first use in a
+-- directory that has to exist already. It must be persistent and writable by
+-- cgit, and it is worth keeping outside the cache root, because pruning the
+-- cache would delete a secret kept inside it and invalidate every live
+-- session. This file should not be world-readable.
 local secret_filename = "/var/lib/cgit/auth-secret"
 
 -- How long a login stays valid, in seconds. The default is one week.
@@ -258,7 +259,9 @@ function get_secret()
 		local temporary_file = io.open(temporary_filename, "w")
 		if temporary_file == nil then
 			sysstat.umask(old_umask)
-			error("cgit auth: cannot create secret file " .. secret_filename)
+			local directory = secret_filename:match("^(.*)/") or "."
+			error("cgit auth: cannot create secret file " .. secret_filename ..
+				", as " .. directory .. " is missing or not writable by cgit")
 		end
 		local wrote = temporary_file:write(tohex(rand.bytes(32)))
 		local closed = temporary_file:close()
@@ -483,6 +486,16 @@ function body()
 	end
 
 	html("<h2>Authentication Required</h2>")
+	-- The token is signed before any of the form is written, since an error
+	-- raised part way through would land inside its markup. A missing
+	-- library or a secret that cannot be made leaves a page saying logins
+	-- are unavailable instead, with the reason in the error log.
+	local signed, token = pcall(secure_value, "redirect", target, 0)
+	if not signed then
+		io.stderr:write("[cgit] " .. tostring(token):match("[^\n]*") .. "\n")
+		html("<p class='login-error' role='alert'>Logins are unavailable. The server's error log says why.</p>")
+		return 0
+	end
 	if failed then
 		html("<p class='login-error' role='alert'>Wrong username or password.</p>")
 	end
@@ -490,7 +503,7 @@ function body()
 	html_attr(cgit["login"])
 	html("'>")
 	html("<input type='hidden' name='redirect' value='")
-	html_attr(secure_value("redirect", target, 0))
+	html_attr(token)
 	html("'>")
 	html("<table>")
 	html("<tr><td><label for='username'>Username:</label></td><td>")
-rw-r--r--	custom/extensions/auth-file.lua	25
-rw-r--r--	custom/extensions/auth-inline.lua	25