From f7cfac3eb955307701556c4603e50a922c0c873a Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sun, 1 Nov 2026 22:24:48 -1000 Subject: Say the auth filters match a repository's url A list keyed on the name the index shows matched nothing, so the repository it meant to protect stayed public. --- MANUAL.txt | 4 +++- custom/cgitrc | 9 +++++---- custom/extensions/auth-file.lua | 14 +++++++++----- custom/extensions/auth-inline.lua | 12 ++++++++---- 4 files changed, 25 insertions(+), 14 deletions(-) diff --git a/MANUAL.txt b/MANUAL.txt index b4d5eaf..5aa4ebf 100644 --- a/MANUAL.txt +++ b/MANUAL.txt @@ -825,7 +825,9 @@ auth filter:: - http path - http host - http https flag - - cgit repo + - cgit repo, the url of the repository asked for, such as + team/tools.git where section-from-path lists it as tools.git, or + empty when there is none - cgit page - cgit url - cgit login url diff --git a/custom/cgitrc b/custom/cgitrc index 1e2dbaa..85bd531 100644 --- a/custom/cgitrc +++ b/custom/cgitrc @@ -301,10 +301,11 @@ trust-scan-config=0 # Filter command invoked to authenticate access, gating repositories behind a # login. See custom/extensions/auth-inline.lua and -# custom/extensions/auth-file.lua. make install overwrites the copies it puts -# in /usr/local/lib/cgit/filters, so edit a copy kept elsewhere, readable only -# by root and the web server's group, and point this at it. Value is a -# command. Default is none. +# custom/extensions/auth-file.lua, which name each protected repository by its +# url, such as team/tools.git where section-from-path shows tools.git. +# make install overwrites the copies it puts in /usr/local/lib/cgit/filters, so +# edit a copy kept elsewhere, readable only by root and the web server's group, +# and point this at it. Value is a command. Default is none. #auth-filter=lua:/etc/cgit/auth-inline.lua # Number of items to display in atom feeds. Value is an integer. Default is 10. diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua index 8a3a771..ba05875 100644 --- a/custom/extensions/auth-file.lua +++ b/custom/extensions/auth-file.lua @@ -80,11 +80,15 @@ local users_filename = "/etc/cgit-auth/users" -- on. local groups_filename = "/etc/cgit-auth/groups" --- Per-repository access lives one per line as reponame:group1,group2 and so --- on. A repository named here is protected and one that is not named is --- public. The repository name has to match exactly, while group and user names --- match regardless of case. While this file cannot be read every page, the --- index too, is refused, since nothing then tells the protected ones apart. +-- Per-repository access lives one per line as url:group1,group2 and so on, +-- keyed by the repository's url rather than the name the index shows, which +-- repo.name or section-from-path can make differ. With section-from-path=1, a +-- repository that scan-path finds at team/tools.git shows as tools.git but +-- keeps team/tools.git as its url. A repository named here is protected and +-- one that is not named is public. The url has to match exactly, while group +-- and user names match regardless of case. While this file cannot be read +-- every page, the index too, is refused, since nothing then tells the +-- protected ones apart. local repos_filename = "/etc/cgit-auth/repos" -- Where the cookie-signing secret is stored, created on first use. It must be diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua index 014caa9..971d662 100644 --- a/custom/extensions/auth-inline.lua +++ b/custom/extensions/auth-inline.lua @@ -62,9 +62,13 @@ -- Protected repositories and the users allowed into each. A repository named --- here is protected and one that is not named is public. The repository key --- has to match exactly, while user names match regardless of case. The --- examples are commented out, so an unedited copy protects nothing. +-- here is protected and one that is not named is public. The key is the +-- repository's url, not the name the index shows, which repo.name or +-- section-from-path can make differ. With section-from-path=1, a repository +-- that scan-path finds at team/tools.git shows as tools.git but keeps +-- team/tools.git as its url. The url has to match exactly, while user names +-- match regardless of case. The examples are commented out, so an unedited +-- copy protects nothing. local protected_repos = { -- ["secret-repo"] = { alice = true, bob = true }, -- ["another"] = { alice = true }, @@ -134,7 +138,7 @@ local action, http, cgit, post -- The configured tables are folded to lowercased user names once, so that a -- lookup matches whatever case the login form was filled in with, the way --- auth-file.lua does. Repository names keep their case. +-- auth-file.lua does. Repository urls keep their case. do local folded_users = {} for name, hash in pairs(users) do -- cgit 2.12.1