From 6a7d84bf763e03ddf63b343e633bbe51251332ee Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 16 Oct 2026 06:28:39 -1000 Subject: Refuse every repository when auth-file loses repos A repos file the filter could not open read as listing nothing, so a permission slip or a mistyped path made every protected repository public. A line naming a repository with no groups was skipped the same way, where auth-inline's empty list denies everyone. --- tests/extensions/test-auth.lua | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'tests') diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index e9fed78..0025a81 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -36,6 +36,7 @@ if variant == "file" then local repos_file = io.open("auth-repos", "w") repos_file:write("secret-repo:devs\n") repos_file:write("empty-repo:ghosts\n") + repos_file:write("bare-repo:\n") repos_file:close() h.redirect_file("/etc/cgit-auth/users", "auth-users") h.redirect_file("/etc/cgit-auth/groups", "auth-groups") @@ -53,6 +54,7 @@ if variant == "inline" then local access = { ["secret-repo"] = { alice = true, bob = true }, ["empty-repo"] = {}, + ["bare-repo"] = {}, } function account_hash(user) if user == nil then @@ -83,11 +85,22 @@ h.equals("the repository name matches case exactly", repo_userset("Secret-Repo") local empty = repo_userset("empty-repo") h.check("a protected repository with no members denies as an empty set", empty ~= nil and next(empty) == nil) +local bare = repo_userset("bare-repo") +h.check("a protected repository with no groups at all denies too", + bare ~= nil and next(bare) == nil) if variant == "file" then h.redirect_file("/etc/cgit-auth/users", "auth-users-missing") h.equals("a missing users file turns every login down", account_hash("alice"), nil) h.redirect_file("/etc/cgit-auth/users", "auth-users") + -- Without the repos file nothing tells a protected repository from a + -- public one, so every repository is refused while the index stays up. + h.redirect_file("/etc/cgit-auth/repos", "auth-repos-missing") + local refused = repo_userset("unlisted") + h.check("a missing repos file refuses every repository", + refused ~= nil and next(refused) == nil) + h.equals("the index stays public all the same", repo_userset(nil), nil) + h.redirect_file("/etc/cgit-auth/repos", "auth-repos") end -- The url and cookie helpers. -- cgit