From f7cfac3eb955307701556c4603e50a922c0c873a Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sun, 1 Nov 2026 22:24:48 -1000 Subject: Say the auth filters match a repository's url A list keyed on the name the index shows matched nothing, so the repository it meant to protect stayed public. --- custom/extensions/auth-file.lua | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) (limited to 'custom/extensions/auth-file.lua') diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua index 8a3a771..ba05875 100644 --- a/custom/extensions/auth-file.lua +++ b/custom/extensions/auth-file.lua @@ -80,11 +80,15 @@ local users_filename = "/etc/cgit-auth/users" -- on. local groups_filename = "/etc/cgit-auth/groups" --- Per-repository access lives one per line as reponame:group1,group2 and so --- on. A repository named here is protected and one that is not named is --- public. The repository name has to match exactly, while group and user names --- match regardless of case. While this file cannot be read every page, the --- index too, is refused, since nothing then tells the protected ones apart. +-- Per-repository access lives one per line as url:group1,group2 and so on, +-- keyed by the repository's url rather than the name the index shows, which +-- repo.name or section-from-path can make differ. With section-from-path=1, a +-- repository that scan-path finds at team/tools.git shows as tools.git but +-- keeps team/tools.git as its url. A repository named here is protected and +-- one that is not named is public. The url has to match exactly, while group +-- and user names match regardless of case. While this file cannot be read +-- every page, the index too, is refused, since nothing then tells the +-- protected ones apart. local repos_filename = "/etc/cgit-auth/repos" -- Where the cookie-signing secret is stored, created on first use. It must be -- cgit 2.12.1