From ec561c92806da08dd6592c7bf1493d34223e3c36 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sun, 1 Nov 2026 18:55:53 -1000
Subject: Keep a protected repository's header to itself

The login page stands in for any page of the repository, so it named
the description and owner of one the visitor may not see, including
one hidden from the index. The site's own description fills the
line, as on the index, so the header keeps its height.
---
 source/ui-shared.c  | 10 +++++++---
 tests/t0505-auth.sh | 28 ++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/source/ui-shared.c b/source/ui-shared.c
index 268de57..5e4aec2 100644
--- a/source/ui-shared.c
+++ b/source/ui-shared.c
@@ -446,7 +446,10 @@ static void print_header(void)
 		html("</form>\n");
 	}
 
-	if (ctx.repo) {
+	// Until the auth filter lets a visitor in, the repository keeps its
+	// description and owner to itself, and the site's description fills
+	// the line instead.
+	if (ctx.repo && ctx.env.authenticated) {
 		html("<p class='sub desc'>");
 		html_txt(ctx.repo->desc);
 		html("</p>\n");
@@ -1470,8 +1473,9 @@ static void print_docstart(void)
 		html_txtf(" @ %.*s", SHORT_HASH_LEN, oid_to_hex(pinned));
 	html("</title>\n");
 	// The placeholder a scanned repository carries instead of a description
-	// is left out, since it describes nothing.
-	desc = ctx.repo ? ctx.repo->desc : ctx.cfg.root_desc;
+	// is left out, since it describes nothing. Until the auth filter lets
+	// the visitor in, the site's description stands in, as in the header.
+	desc = ctx.repo && ctx.env.authenticated ? ctx.repo->desc : ctx.cfg.root_desc;
 	if (desc && *desc && desc != cgit_default_repo_desc) {
 		html("<meta name='description' content='");
 		html_attr(desc);
diff --git a/tests/t0505-auth.sh b/tests/t0505-auth.sh
index 7dd4a36..f7096ca 100755
--- a/tests/t0505-auth.sh
+++ b/tests/t0505-auth.sh
@@ -74,4 +74,32 @@ test_expect_success CGIT_LUA_NOAUTH 'without the modules a protected repository
 	grep "Unable to complete the request" tmp
 '
 
+# A filter of the test's own turns every visitor away, which needs no Lua.
+# Until a visitor is let in, the header of a protected repository shows the
+# site's description in place of its own and no owner, even for a
+# repository hidden from the index.
+test_expect_success 'the login page keeps the repository to itself' '
+	write_script deny.sh <<-\EOF &&
+	test "$1" = body && echo "<p>sign in</p>"
+	exit 0
+	EOF
+	cat >denyrc <<-EOF &&
+	virtual-root=/
+	cache-size=0
+	root-desc=the whole site
+	auth-filter=exec:$PWD/deny.sh
+	repo.url=authy
+	repo.path=$PWD/repos/authy/.git
+	repo.desc=the secret plan
+	repo.owner=Mallory Owner
+	repo.hide=1
+	EOF
+	cgit_rc denyrc "url=authy/log/" >tmp &&
+	grep "<p>sign in</p>" tmp &&
+	grep "<p class=.sub desc.>the whole site</p>" tmp &&
+	grep "<meta name=.description. content=.the whole site.>" tmp &&
+	! grep "secret plan" tmp &&
+	! grep "Mallory" tmp
+'
+
 test_done
-- 
cgit 2.12.1