From 3358d99b1fc8dcb6d147349f9171231eb0032119 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Mon, 2 Nov 2026 20:22:52 -1000 Subject: Log failed logins The login posts outside any repository, so the log line names the repository by the page its signed way back leads to. --- custom/extensions/auth-inline.lua | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'custom/extensions/auth-inline.lua') diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua index 99e33d2..cb9802c 100644 --- a/custom/extensions/auth-inline.lua +++ b/custom/extensions/auth-inline.lua @@ -452,6 +452,13 @@ function authenticate_post() end end + -- A failed login is logged with the name, stripped of control characters + -- that could forge a line of their own, but never with the password. + if session == "" then + local name = (username or ""):gsub("%c", "") + io.stderr:write("[cgit] Failed login as " .. name .. " for " .. redirect .. "\n") + end + -- A failed login answers with an empty session, which clears the cookie. redirect_to(session == "" and flag_failure(redirect) or redirect) set_cookie(session_cookie, session) -- cgit 2.12.1