Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Check that an auth filter is handed the url
Both shipped filters key their access lists by a repository's url, and
MANUAL says cgit hands that over, but nothing read the argument. Every
auth test served a repository whose url and name were the same, so a
cgit that passed repo.name, under which a url-keyed list matches
nothing and every protected repository goes public, passed.
| -rwxr-xr-x | tests/t0505-auth.sh | 35 |
1 file changed, 35 insertions, 0 deletions
diff --git a/tests/t0505-auth.sh b/tests/t0505-auth.sh index 7562e49..35bd591 100755 --- a/tests/t0505-auth.sh +++ b/tests/t0505-auth.sh @@ -77,6 +77,41 @@ test_expect_success CGIT_LUA_NOAUTH 'without the modules a protected repository grep "^\[cgit\] " err ' +# The access lists are keyed by a repository's url, which repo.name and +# section-from-path can make differ from the name the index shows, so a +# filter handed the name would leave a protected repository public. +test_expect_success 'an auth filter is handed the repository url' ' + write_script seen.sh <<-\EOF && + test "$1" = authenticate-cookie && printf "%s\n" "$9" >seen + exit 1 + EOF + cgitrc_repo seenrc team/tools.git "auth-filter=exec:$PWD/seen.sh" \ + "repo.path=$PWD/repos/authy/.git" "repo.name=tools.git" && + echo team/tools.git >expect && + cgit_ok seenrc "url=team/tools.git/log/" >tmp && + grep ">guarded commit</a>" tmp && + test_cmp expect seen && + rm seen && + cgit_ok seenrc "r=team/tools.git&p=log" >tmp && + grep ">guarded commit</a>" tmp && + test_cmp expect seen && + mkdir -p scan/team && + git clone -q --bare repos/authy scan/team/tools.git && + cat >scanrc <<-EOF && + virtual-root=/ + cache-size=0 + auth-filter=exec:$PWD/seen.sh + section-from-path=1 + scan-path=$PWD/scan + EOF + cgit_ok scanrc "" >tmp && + grep ">tools.git</a>" tmp && + rm seen && + cgit_ok scanrc "url=team/tools.git/log/" >tmp && + grep ">guarded commit</a>" tmp && + test_cmp expect seen +' + # A filter of the test's own turns every visitor away, which needs no Lua. # Until a visitor is let in, the header of a protected repository shows the # site's description in place of its own and no owner, even for a |