From a91964efa2a5de00fbe0b4a3d8a51df07d26420a Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sun, 1 Nov 2026 21:49:28 -1000 Subject: Say where an edited auth filter belongs make install copies every filter into the filters directory with mode 0644, so an edited auth-inline.lua there lost its lists on the next install, which turned every protected repository public, and until then showed its password hashes to every local user. --- custom/cgitrc | 7 +++++-- custom/extensions/auth-file.lua | 5 +++++ custom/extensions/auth-inline.lua | 7 +++++++ 3 files changed, 17 insertions(+), 2 deletions(-) (limited to 'custom') diff --git a/custom/cgitrc b/custom/cgitrc index c1a5b68..1e2dbaa 100644 --- a/custom/cgitrc +++ b/custom/cgitrc @@ -301,8 +301,11 @@ trust-scan-config=0 # Filter command invoked to authenticate access, gating repositories behind a # login. See custom/extensions/auth-inline.lua and -# custom/extensions/auth-file.lua. Value is a command. Default is none. -#auth-filter=lua:/usr/local/lib/cgit/filters/auth-inline.lua +# custom/extensions/auth-file.lua. make install overwrites the copies it puts +# in /usr/local/lib/cgit/filters, so edit a copy kept elsewhere, readable only +# by root and the web server's group, and point this at it. Value is a +# command. Default is none. +#auth-filter=lua:/etc/cgit/auth-inline.lua # Number of items to display in atom feeds. Value is an integer. Default is 10. max-atom-items=10 diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua index ab56ee1..8a3a771 100644 --- a/custom/extensions/auth-file.lua +++ b/custom/extensions/auth-file.lua @@ -6,6 +6,11 @@ -- access lists in files on disk, which suits a user set that is large or -- maintained by something else. The companion auth-inline.lua behaves -- identically but carries the same lists inside the script. +-- +-- make install puts this script in /usr/local/lib/cgit/filters and overwrites +-- it there on every run. The files it reads are left alone, but any setting +-- changed below is lost, so edit a copy kept where make install never writes, +-- such as /etc/cgit/auth-file.lua, and point auth-filter at it. -- The script runs on Lua 5.1 through 5.5 and LuaJIT, and the runtime has to be -- the same Lua that cgit was built against. On 5.5 it needs luaossl 20260910 diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua index e795717..014caa9 100644 --- a/custom/extensions/auth-inline.lua +++ b/custom/extensions/auth-inline.lua @@ -6,6 +6,13 @@ -- lists in two tables inside the script, which suits a small fixed set of -- users. The companion auth-file.lua behaves identically but reads the same -- lists from files on disk. +-- +-- make install puts this script in /usr/local/lib/cgit/filters and overwrites +-- it there on every run, which would wipe the lists below and leave every +-- repository public. Edit a copy kept where make install never writes, such +-- as /etc/cgit/auth-inline.lua, and point auth-filter at it. The copy holds +-- password hashes, so make it readable only by root and the web server's +-- group, for example root:www-data with mode 0640. -- The script runs on Lua 5.1 through 5.5 and LuaJIT, and the runtime has to be -- the same Lua that cgit was built against. On 5.5 it needs luaossl 20260910 -- cgit 2.12.1