From ee323ec8c473f30e3a6a5b5c5834a1fcfea86d9f Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 31 Oct 2026 13:29:17 -0700 Subject: Drop auth guards for input cgit never sends cgit names no repository with an empty string, never nil, so the check that the index stays up proved nothing, and auth-file in fact refuses the index too while its repos file cannot be read. A session_seconds of 0 signs a session that has expired by the time it comes back, so it needs no branch of its own in set_cookie. --- custom/extensions/auth-inline.lua | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) (limited to 'custom/extensions/auth-inline.lua') diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua index 6c0ad3b..b3ecaf9 100644 --- a/custom/extensions/auth-inline.lua +++ b/custom/extensions/auth-inline.lua @@ -141,9 +141,6 @@ end -- a failed login can spend the same work on a hash of the same kind and -- cost, and its timing does not tell whether the name exists. function account_hash(user) - if user == nil then - return nil - end local hash = users[user:lower()] if hash ~= nil then return hash @@ -155,9 +152,6 @@ end -- The users allowed into a repository come back keyed by lowercased name, and -- a repository the table does not name comes back as nil. function repo_userset(repo) - if repo == nil then - return nil - end return protected_repos[repo] end @@ -376,7 +370,7 @@ function set_cookie(cookie, value) end if value == "" then attributes = attributes .. "; Max-Age=0" - elseif session_seconds > 0 then + else attributes = attributes .. "; Max-Age=" .. tostring(session_seconds) end html("Set-Cookie: " .. cookie .. "=" .. value .. attributes .. "\n") @@ -415,7 +409,7 @@ end function authenticate_post() local redirect = validate_value("redirect", post["redirect"]) - if redirect == nil or not is_safe_redirect(redirect) then + if not is_safe_redirect(redirect) then not_found() return 0 end -- cgit