2 files changed, 14 insertions, 0 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index 790c1fd..81c5710 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -489,6 +489,13 @@ function authenticate_post()
 		end
 	end
 
+	-- A failed login is logged with the name, stripped of control characters
+	-- that could forge a line of their own, but never with the password.
+	if session == "" then
+		local name = (username or ""):gsub("%c", "")
+		io.stderr:write("[cgit] Failed login as " .. name .. " for " .. redirect .. "\n")
+	end
+
 	-- A failed login answers with an empty session, which clears the cookie.
 	redirect_to(session == "" and flag_failure(redirect) or redirect)
 	set_cookie(session_cookie, session)
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index 99e33d2..cb9802c 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -452,6 +452,13 @@ function authenticate_post()
 		end
 	end
 
+	-- A failed login is logged with the name, stripped of control characters
+	-- that could forge a line of their own, but never with the password.
+	if session == "" then
+		local name = (username or ""):gsub("%c", "")
+		io.stderr:write("[cgit] Failed login as " .. name .. " for " .. redirect .. "\n")
+	end
+
 	-- A failed login answers with an empty session, which clears the cookie.
 	redirect_to(session == "" and flag_failure(redirect) or redirect)
 	set_cookie(session_cookie, session)
-rw-r--r--	custom/extensions/auth-file.lua	7
-rw-r--r--	custom/extensions/auth-inline.lua	7