urosm
/
ikiwiki
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

httpauth: If REMOTE_USER is empty, behave as though it was unset 

A frequently cut-and-pasted HTTP basic authentication configuration
for nginx sets it to the empty string when not authenticated, which
is not useful.
master
Simon McVittie 2017-05-14 14:44:43 +01:00
parent 59daf36cb2
commit 31c89db246
3 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
IkiWiki/Plugin/httpauth.pm
View File

@ -66,7 +66,7 @@ sub auth ($$) {
my $cgi=shift; my $cgi=shift;
my $session=shift; my $session=shift;
if (defined $cgi->remote_user()) { if (length $cgi->remote_user()) {
$session->param("name", $cgi->remote_user()); $session->param("name", $cgi->remote_user());
} }
} }
@ -80,7 +80,7 @@ sub formbuilder_setup (@) {
my $buttons=$params{buttons}; my $buttons=$params{buttons};
if ($form->title eq "signin" && if ($form->title eq "signin" &&
! defined $cgi->remote_user() && defined $config{cgiauthurl}) { ! length $cgi->remote_user() && defined $config{cgiauthurl}) {
my $button_text="Login with HTTP auth"; my $button_text="Login with HTTP auth";
push @$buttons, $button_text; push @$buttons, $button_text;
@ -97,7 +97,7 @@ sub canedit ($$$) {
my $cgi=shift; my $cgi=shift;
my $session=shift; my $session=shift;
if (! defined $cgi->remote_user() && if (! length $cgi->remote_user() &&
(! defined $session->param("name") || (! defined $session->param("name") ||
! IkiWiki::userinfo_get($session->param("name"), "regdate")) && ! IkiWiki::userinfo_get($session->param("name"), "regdate")) &&
defined $config{httpauth_pagespec} && defined $config{httpauth_pagespec} &&

3
debian/changelog vendored
View File

@ -3,6 +3,9 @@ ikiwiki (3.20170112) UNRELEASED; urgency=medium
* t/git-cgi.t: Wait 1 second before doing a revert that should work. * t/git-cgi.t: Wait 1 second before doing a revert that should work.
This hopefully fixes a race condition in which the test failed This hopefully fixes a race condition in which the test failed
around 6% of the time. (Closes: 862494) around 6% of the time. (Closes: 862494)
* Guard against set-but-empty REMOTE_USER CGI variable on
misconfigured nginx servers, and in general treat sessions with
a set-but-empty name as if they were not signed in.
-- Simon McVittie <smcv@debian.org> Sun, 14 May 2017 15:34:52 +0100 -- Simon McVittie <smcv@debian.org> Sun, 14 May 2017 15:34:52 +0100

4
doc/bugs/Anon_edit_caused_lock_out_on_entire_site_.mdwn
View File

@ -81,6 +81,10 @@ It seems I can't log out from nowhere. I've rebuild the wiki from the command li
> with one of a limited set of authorized usernames. > with one of a limited set of authorized usernames.
> >
> --[[smcv]] > --[[smcv]]
>
>> If my theory is correct, ikiwiki git master now works around this, and the
>> [[plugins/httpauth]] documentation now recommends a more correct configuration.
>> --[[smcv]]
--- ---