| Age | Commit message (Collapse) | Author | Lines |
|---|---|---|---|
| Load auth libraries only when a request needs one | Bryce Kwon | -6/+10 | |
| Required at the top, a missing luaossl or luaposix failed every request to the site, public pages included, and each public page paid to load both. | |||
| Say which hash kinds each system's crypt checks | Bryce Kwon | -2/+13 | |
| The one recipe given, SHA-512 from Debian's mkpasswd, cannot log anyone in on OpenBSD, whose crypt checks only bcrypt, or on macOS, and libxcrypt, which most Linux distributions use, recommends yescrypt instead. | |||
| Spend a missing account's login on a real hash | Bryce Kwon | -9/+14 | |
| The fixed SHA-512 stand-in matched only the documented setup, so a site hashing with yescrypt, other rounds or bcrypt answered for missing and real names in different times, and on OpenBSD it failed at once. | |||
| Turn down passwords past 256 bytes unchecked | Bryce Kwon | -1/+5 | |
| SHA-crypt hashes the password in most of its rounds, so the 4 KB that cgit's POST limit lets through cost about fifteen ordinary logins per anonymous attempt. | |||
| Read the auth cookie in linear time | Bryce Kwon | -5/+21 | |
| Splitting the header with patterns that backtrack over spaces cost a quarter of a second per request at the 8 KB line most web servers allow, and a second at 16 KB, without any login. auth-file's trim had the same shape and now reads the cookie as well. | |||
| Unify the docs, samples and extensions | Bryce Kwon | -1/+1 | |
| Clean up the whole tree | Bryce Kwon | -22/+11 | |
| Give the login inputs explicit field types | Bryce Kwon | -1/+1 | |
| Trim the comments and dead code across the tree | Bryce Kwon | -41/+25 | |
| Let password managers fill the login form | Bryce Kwon | -4/+4 | |
| Restyle the filter extension headers and markup | Bryce Kwon | -138/+158 | |
| Move the cookie-signing secret out of the cachev2.3.0 | Bryce Kwon | -1/+1 | |
| Trim the lua headers and fix the Scintillua notes | Bryce Kwon | -30/+3 | |
| Fix cookie name escaping and stored hash trimming | Bryce Kwon | -1/+10 | |
| Reorganize the tree into vendor/ and custom/ | Bryce Kwon | -0/+0 | |
| Harden and reorganize the auth filters | Bryce Kwon | -147/+322 | |
| Harden the auth filter headers and session cookie | Bryce Kwon | -5/+31 | |
| The filters signed the request url and later wrote it into a Location header, and the signing step re-encoded a newline that the verifying step decoded back, so a crafted url could smuggle CR and LF into the response. The cookie HMAC was also checked with a short-circuiting comparison and carried no SameSite attribute. | |||
| Prune and rename the filter extensions | Bryce Kwon | -2/+15 | |
| The gentoo LDAP filter is distro specific, the owner example only restates what cgit already renders, and the about converters are superseded by the built-in markdown rendering. The two auth filters do the same job and differ only in where their accounts live, so they become `auth-inline` for accounts kept in the script and `auth-file` for accounts kept on disk. | |||
| Reorganize into source, assets and libraries | Bryce Kwon | -0/+0 | |
| The C sources move to source/, the served files to assets/, the bundled Git submodule to libraries/git and the filter scripts to extensions/. Everything the build generates now lands in build/, so a clean is a single remove and the tree stays clean. | |||
| filters: migrate from luacrypto to luaossl | Jason A. Donenfeld | -12/+19 | |
| luaossl has no upstream anymore and doesn't support OpenSSL 1.1, whereas luaossl is quite active. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> | |||
| auth-filters: use crypt() in simple-authentication | Jason A. Donenfeld | -13/+6 | |
| There's no use in giving a silly example to folks who will just copy it, so instead try to do something slightly better. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> | |||
| auth-filters: generate secret securely | Jason A. Donenfeld | -8/+42 | |
| This is much better than having the user generate it themselves. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> | |||
| auth-filters: do not use HMAC-SHA1 | Jason A. Donenfeld | -2/+2 | |
| Though SHA1 is broken, HMAC-SHA1 is still fine. But let's not push our luck; SHA256 is more sensible anyway. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> | |||
| simple-authentication.lua: tie secure cookies to field names | Jason A. Donenfeld | -13/+21 | |
| simple-authentication: style | Jason A. Donenfeld | -1/+1 | |
| Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> | |||
| auth: document tweakables in lua script | Jason A. Donenfeld | -0/+10 | |
| Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> | |||
| auth: have cgit calculate login address | Jason A. Donenfeld | -6/+1 | |
| This way we're sure to use virtual root, or any other strangeness encountered. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> | |||
| auth: lua string comparisons are time invariant | Jason A. Donenfeld | -2/+2 | |
| By default, strings are compared by hash, so we can remove this comment. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> | |||
| authentication: use hidden form instead of referer | Jason A. Donenfeld | -79/+121 | |
| This also gives us some CSRF protection. Note that we make use of the hmac to protect the redirect value. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> | |||
| auth: add basic authentication filter framework | Jason A. Donenfeld | -0/+225 | |
| This leverages the new lua support. See filters/simple-authentication.lua for explaination of how this works. There is also additional documentation in cgitrc.5.txt. Though this is a cookie-based approach, cgit's caching mechanism is preserved for authenticated pages. Very plugable and extendable depending on user needs. The sample script uses an HMAC-SHA1 based cookie to store the currently logged in user, with an expiration date. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> | |||
index : cgit
Hyperfast and read-only web frontend for git repositories
Bryce Kwon