From a91964efa2a5de00fbe0b4a3d8a51df07d26420a Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sun, 1 Nov 2026 21:49:28 -1000 Subject: Say where an edited auth filter belongs make install copies every filter into the filters directory with mode 0644, so an edited auth-inline.lua there lost its lists on the next install, which turned every protected repository public, and until then showed its password hashes to every local user. --- custom/extensions/auth-inline.lua | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'custom/extensions/auth-inline.lua') diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua index e795717..014caa9 100644 --- a/custom/extensions/auth-inline.lua +++ b/custom/extensions/auth-inline.lua @@ -6,6 +6,13 @@ -- lists in two tables inside the script, which suits a small fixed set of -- users. The companion auth-file.lua behaves identically but reads the same -- lists from files on disk. +-- +-- make install puts this script in /usr/local/lib/cgit/filters and overwrites +-- it there on every run, which would wipe the lists below and leave every +-- repository public. Edit a copy kept where make install never writes, such +-- as /etc/cgit/auth-inline.lua, and point auth-filter at it. The copy holds +-- password hashes, so make it readable only by root and the web server's +-- group, for example root:www-data with mode 0640. -- The script runs on Lua 5.1 through 5.5 and LuaJIT, and the runtime has to be -- the same Lua that cgit was built against. On 5.5 it needs luaossl 20260910 -- cgit 2.12.1