Age	Commit message (Collapse)	Author	Lines
35 hours	Claim and test Lua 5.5 for every extension	Bryce Kwon	-3/+3
	luaossl from release 20260910 and luaposix load under Lua 5.5, and cgit renders the same pages under it as under LuaJIT. Running the suites there already caught a write to a for loop's control variable, which 5.5 makes read-only.
35 hours	Say that a protected repository stays on the index	Bryce Kwon	-0/+4
35 hours	Name the auth cookie __Host- where it can be	Bryce Kwon	-2/+10
	Without the prefix any host under the same domain could set a cgitauth cookie of its own, signing a visitor in as someone else or out.
35 hours	End a session when its account's hash changes	Bryce Kwon	-29/+44
	A session stayed good for its whole week after the password changed or the account went away, which is when ending it matters most.
35 hours	Load auth libraries only when a request needs one	Bryce Kwon	-6/+10
	Required at the top, a missing luaossl or luaposix failed every request to the site, public pages included, and each public page paid to load both.
35 hours	Say which hash kinds each system's crypt checks	Bryce Kwon	-2/+14
	The one recipe given, SHA-512 from Debian's mkpasswd, cannot log anyone in on OpenBSD, whose crypt checks only bcrypt, or on macOS, and libxcrypt, which most Linux distributions use, recommends yescrypt instead.
35 hours	Spend a missing account's login on a real hash	Bryce Kwon	-12/+17
	The fixed SHA-512 stand-in matched only the documented setup, so a site hashing with yescrypt, other rounds or bcrypt answered for missing and real names in different times, and on OpenBSD it failed at once.
35 hours	Turn down passwords past 256 bytes unchecked	Bryce Kwon	-1/+5
	SHA-crypt hashes the password in most of its rounds, so the 4 KB that cgit's POST limit lets through cost about fifteen ordinary logins per anonymous attempt.
35 hours	Read the auth cookie in linear time	Bryce Kwon	-9/+21
	Splitting the header with patterns that backtrack over spaces cost a quarter of a second per request at the 8 KB line most web servers allow, and a second at 16 KB, without any login. auth-file's trim had the same shape and now reads the cookie as well.
36 hours	Refuse every repository when auth-file loses repos	Bryce Kwon	-11/+14
	A repos file the filter could not open read as listing nothing, so a permission slip or a mistyped path made every protected repository public. A line naming a repository with no groups was skipped the same way, where auth-inline's empty list denies everyone.
2026-09-21	Unify the docs, samples and extensions	Bryce Kwon	-1/+1
2026-09-06	Clean up the whole tree	Bryce Kwon	-22/+11
2026-09-06	Give the login inputs explicit field types	Bryce Kwon	-1/+1
2026-09-06	Trim the comments and dead code across the tree	Bryce Kwon	-44/+29
2026-08-14	Let password managers fill the login form	Bryce Kwon	-4/+4
2026-08-14	Restyle the filter extension headers and markup	Bryce Kwon	-158/+183
2026-08-05	Move the cookie-signing secret out of the cachev2.3.0	Bryce Kwon	-1/+1
2026-08-01	Trim the lua headers and fix the Scintillua notes	Bryce Kwon	-29/+2
2026-08-01	Fix cookie name escaping and stored hash trimming	Bryce Kwon	-2/+16
2026-07-25	Reorganize the tree into vendor/ and custom/	Bryce Kwon	-0/+556