1 file changed, 16 insertions, 0 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index ce2b5da..3df2cee 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -115,6 +115,22 @@ test_expect_success 'non-markdown readme keeps its line structure' '
 	grep "pre class=.plaintext." tmp
 '
 
+# root-readme is the site's own file rather than repository content, so it
+# goes out as written, on an about page of its own.
+test_expect_success 'root-readme without a filter is its own page, as written' '
+	echo "<b>site</b>" >root.html &&
+	{
+		echo "virtual-root=/" &&
+		echo "cache-size=0" &&
+		echo "root-readme=$PWD/root.html"
+	} >secrootrc &&
+	CGIT_CONFIG="$PWD/secrootrc" QUERY_STRING="url=" cgit >tmp &&
+	grep "<li><a title=.About this site. href=./?p=about.>about</a>" tmp &&
+	! grep "<b>site</b>" tmp &&
+	CGIT_CONFIG="$PWD/secrootrc" QUERY_STRING="p=about" cgit >tmp &&
+	grep "^<b>site</b>$" tmp
+'
+
 # A Content-Security-Policy without unsafe-inline stops an inline onchange
 # handler from ever running, so the option form submits through a plain
 # button and its selects carry no handlers at all.