1 file changed, 19 insertions, 3 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index 1a5ee44..d9ec265 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -115,6 +115,22 @@ test_expect_success 'non-markdown readme keeps its line structure' '
 	grep "pre class=.plaintext." tmp
 '
 
+# root-readme is the site's own file rather than repository content, so it
+# goes out as written, on an about page of its own.
+test_expect_success 'root-readme without a filter is its own page, as written' '
+	echo "<b>site</b>" >root.html &&
+	{
+		echo "virtual-root=/" &&
+		echo "cache-size=0" &&
+		echo "root-readme=$PWD/root.html"
+	} >secrootrc &&
+	CGIT_CONFIG="$PWD/secrootrc" QUERY_STRING="url=" cgit >tmp &&
+	grep "<li><a title=.About this site. href=./?p=about.>about</a>" tmp &&
+	! grep "<b>site</b>" tmp &&
+	CGIT_CONFIG="$PWD/secrootrc" QUERY_STRING="p=about" cgit >tmp &&
+	grep "^<b>site</b>$" tmp
+'
+
 # A Content-Security-Policy without unsafe-inline stops an inline onchange
 # handler from ever running, so the option form submits through a plain
 # button and its selects carry no handlers at all.
@@ -436,16 +452,16 @@ test_expect_success 'a posted length past any buffer is clamped' '
 
 test_expect_success 'the dumb transport refuses a path that climbs out' '
 	cveq "url=cve/objects/../config" >tmp &&
-	grep "^Status: 400" tmp &&
+	grep "^Status: 404" tmp &&
 	! grep "repositoryformatversion" tmp &&
 	cveq "url=cve/objects/info/../../config" >tmp &&
-	grep "^Status: 400" tmp &&
+	grep "^Status: 404" tmp &&
 	! grep "repositoryformatversion" tmp
 '
 
 test_expect_success 'the about page serves nothing above the readme directory' '
 	cveq "url=cve/about/../cverc" >tmp &&
-	grep "^Status: 200" tmp &&
+	grep "^Status: 404" tmp &&
 	! grep "virtual-root" tmp &&
 	cveq "url=cve/about/" >tmp &&
 	grep "readme text" tmp