1 file changed, 15 insertions, 4 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index eeff041..64129b6 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -97,12 +97,23 @@ test_expect_success 'root-readme without a filter is its own page, as written' '
 
 # A Content-Security-Policy without unsafe-inline stops an inline onchange
 # handler from ever running, so the option form submits through a plain
-# button and its selects carry no handlers at all.
+# button and its selects carry no handlers at all, and nor does any other
+# page.
 test_expect_success 'diff options submit through a button' '
 	sha=$(git -C repos/foo rev-parse HEAD) &&
-	cgit_url "foo/commit&id=$sha" >tmp &&
-	grep "type=.submit. value=.reload." tmp &&
-	! grep "onchange" tmp
+	cgit_ok_url "foo/commit&id=$sha" >tmp &&
+	test_grep "type=.submit. value=.reload." tmp &&
+	test_grep ! " on[a-z]*=" tmp
+'
+
+test_expect_success 'no page carries an inline handler' '
+	for page in repolist: summary:foo/ log:foo/log/ tree:foo/tree/ diff:foo/diff/ \
+		refs:foo/refs/
+	do
+		cgit_ok_url "${page#*:}" >tmp &&
+		test_grep "data-page=.${page%%:*}." tmp &&
+		test_grep ! " on[a-z]*=" tmp || return 1
+	done
 '
 
 # Grouping directories ahead of files is behaviour this fork adds, so nothing