1 file changed, 12 insertions, 1 deletion
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index 295cb92..ac849c6 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -92,12 +92,18 @@ load_script()
 local session_name = "__Host-cgitauth"
 
 -- crypt is watched through the module the script requires, so a check can
--- see whether a login spent it and on which hash.
+-- see whether a login spent it and on which hash. With crypt_unchecked set
+-- it answers nil, as crypt(3) does for a kind of hash the system does not
+-- check.
 local unistd = require("posix.unistd")
 local real_crypt = unistd.crypt
 local crypt_settings = {}
+local crypt_unchecked = false
 unistd.crypt = function(trypass, setting)
 	crypt_settings[#crypt_settings + 1] = setting
+	if crypt_unchecked then
+		return nil
+	end
 	return real_crypt(trypass, setting)
 end
 
@@ -557,6 +563,11 @@ local wrong_password = out
 h.contains("a bad password redirects the same way", out, "Status: 302")
 h.contains("back to the page with the failure flagged", out, "Location: /repo/?login=failed\n")
 h.contains("but clears the session cookie", out, "Set-Cookie: " .. session_name .. "=; ")
+crypt_unchecked = true
+local answered, answer = pcall(login, "Alice", password, way_back)
+crypt_unchecked = false
+h.check("a hash the system cannot check turns a login down without an error", answered, tostring(answer))
+h.equals("as a wrong password does", answer, wrong_password)
 h.contains("and is logged with the name and the page", h.error_log(),
 	"[cgit] Failed login as Alice for /repo/\n")
 h.excludes("but never with the password", h.error_log(), "wrong")