Check a login when crypt cannot check the hash

crypt(3) answers nil for a kind of hash the system does not check, but
the stand-in never did, so a login that raised on it, or let it
through, passed.

1 file changed, 12 insertions, 1 deletion

diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.luaindex 295cb92..ac849c6 100644--- a/tests/extensions/test-auth.lua+++ b/tests/extensions/test-auth.lua@@ -92,12 +92,18 @@ load_script() local session_name = "__Host-cgitauth"  -- crypt is watched through the module the script requires, so a check can--- see whether a login spent it and on which hash.+-- see whether a login spent it and on which hash. With crypt_unchecked set+-- it answers nil, as crypt(3) does for a kind of hash the system does not+-- check. local unistd = require("posix.unistd") local real_crypt = unistd.crypt local crypt_settings = {}+local crypt_unchecked = false unistd.crypt = function(trypass, setting) 	crypt_settings[#crypt_settings + 1] = setting+	if crypt_unchecked then+		return nil+	end 	return real_crypt(trypass, setting) end @@ -557,6 +563,11 @@ local wrong_password = out h.contains("a bad password redirects the same way", out, "Status: 302") h.contains("back to the page with the failure flagged", out, "Location: /repo/?login=failed\n") h.contains("but clears the session cookie", out, "Set-Cookie: " .. session_name .. "=; ")+crypt_unchecked = true+local answered, answer = pcall(login, "Alice", password, way_back)+crypt_unchecked = false+h.check("a hash the system cannot check turns a login down without an error", answered, tostring(answer))+h.equals("as a wrong password does", answer, wrong_password) h.contains("and is logged with the name and the page", h.error_log(), 	"[cgit] Failed login as Alice for /repo/\n") h.excludes("but never with the password", h.error_log(), "wrong")
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index 295cb92..ac849c6 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -92,12 +92,18 @@ load_script()
 local session_name = "__Host-cgitauth"
 
 -- crypt is watched through the module the script requires, so a check can
--- see whether a login spent it and on which hash.
+-- see whether a login spent it and on which hash. With crypt_unchecked set
+-- it answers nil, as crypt(3) does for a kind of hash the system does not
+-- check.
 local unistd = require("posix.unistd")
 local real_crypt = unistd.crypt
 local crypt_settings = {}
+local crypt_unchecked = false
 unistd.crypt = function(trypass, setting)
 	crypt_settings[#crypt_settings + 1] = setting
+	if crypt_unchecked then
+		return nil
+	end
 	return real_crypt(trypass, setting)
 end
 
@@ -557,6 +563,11 @@ local wrong_password = out
 h.contains("a bad password redirects the same way", out, "Status: 302")
 h.contains("back to the page with the failure flagged", out, "Location: /repo/?login=failed\n")
 h.contains("but clears the session cookie", out, "Set-Cookie: " .. session_name .. "=; ")
+crypt_unchecked = true
+local answered, answer = pcall(login, "Alice", password, way_back)
+crypt_unchecked = false
+h.check("a hash the system cannot check turns a login down without an error", answered, tostring(answer))
+h.equals("as a wrong password does", answer, wrong_password)
 h.contains("and is logged with the name and the page", h.error_log(),
 	"[cgit] Failed login as Alice for /repo/\n")
 h.excludes("but never with the password", h.error_log(), "wrong")