Diff options
Diffstat (limited to 'tests/t0301-security.sh')
| -rwxr-xr-x | tests/t0301-security.sh | 46 |
1 file changed, 40 insertions, 6 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh index 5a7f5fb..951cf1e 100755 --- a/tests/t0301-security.sh +++ b/tests/t0301-security.sh @@ -430,12 +430,46 @@ test_expect_success 'the dumb transport serves nothing but objects and packs' ' test_grep "^Content-Type: application/octet-stream$" tmp ' -test_expect_success 'the about page serves nothing above the readme directory' ' - cgit_rc cverc "url=cve/about/../cverc" >tmp && - expect_status 404 tmp && - ! grep "virtual-root" tmp && - cgit_rc cverc "url=cve/about/" >tmp && - grep "readme text" tmp +# The about page shows the readme alone and its links lead into the tree, so +# a path below it names nothing. It once served the files beside the readme, +# from the tree or the disk, so each kind of readme is asked for a file it +# could have handed over, the site's own readme among them. +test_expect_success 'a path below the about page answers 404 for every kind of readme' ' + mkrepo repos/about 1 && + ( + cd repos/about && + echo "readme in the tree" >README && + echo "beside the readme" >notes.txt && + git add README notes.txt && + git update-index --add --cacheinfo 160000,$(git rev-parse HEAD),sub && + git commit -q -m readme + ) && + echo "readme in the repository" >repos/about/.git/README && + mkdir ondisk && + echo "readme on the disk" >ondisk/README && + cgitrc_site aboutrc mimetype.png=image/png "root-readme=$PWD/ondisk/README" \ + repo.url=disk "repo.path=$PWD/repos/about/.git" "repo.readme=$PWD/ondisk/README" \ + repo.url=gitdir "repo.path=$PWD/repos/about/.git" repo.readme=README \ + repo.url=branch "repo.path=$PWD/repos/about/.git" repo.readme=master:README \ + repo.url=head "repo.path=$PWD/repos/about/.git" repo.readme=:README && + while read about path readme + do + cgit_ok aboutrc "$about" >tmp && + test_grep "$readme" tmp && + cgit_rc aboutrc "$about$path" >tmp 2>err && + expect_status 404 tmp && + test_grep "^Content-Type: text/html" tmp && + test_grep ! -e virtual-root -e repositoryformatversion -e "beside the readme" tmp && + test_must_be_empty err || return 1 + done <<-\EOF + url=disk/about/ ../aboutrc readme on the disk + url=gitdir/about/ config readme in the repository + url=branch/about/ notes.txt readme in the tree + url=branch/about/ sub readme in the tree + url=branch/about/ missing.png readme in the tree + url=head/about/ notes.txt readme in the tree + p=about&path= ../aboutrc readme on the disk + EOF ' test_expect_success 'a commit with an empty author renders everywhere' ' |