2 files changed, 12 insertions, 0 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index 3814a1f..f05a59e 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -533,6 +533,12 @@ function body()
 		html("<p class='login-error' role='alert'>Logins are unavailable. The server's error log says why.</p>")
 		return 0
 	end
+	-- cgit asks for the form only once the cookie has been turned down, so
+	-- a session that still verifies belongs to someone not let in here.
+	local cookie = get_cookie(http["cookie"], session_cookie)
+	if validate_value("username", cookie, account_hash) then
+		html("<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>")
+	end
 	if failed then
 		html("<p class='login-error' role='alert'>Wrong username or password.</p>")
 	end
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index e7f12cd..878d55e 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -496,6 +496,12 @@ function body()
 		html("<p class='login-error' role='alert'>Logins are unavailable. The server's error log says why.</p>")
 		return 0
 	end
+	-- cgit asks for the form only once the cookie has been turned down, so
+	-- a session that still verifies belongs to someone not let in here.
+	local cookie = get_cookie(http["cookie"], session_cookie)
+	if validate_value("username", cookie, account_hash) then
+		html("<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>")
+	end
 	if failed then
 		html("<p class='login-error' role='alert'>Wrong username or password.</p>")
 	end
-rw-r--r--	custom/extensions/auth-file.lua	6
-rw-r--r--	custom/extensions/auth-inline.lua	6