2 files changed, 22 insertions, 11 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index 1a5ee44..ce2b5da 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -445,7 +445,7 @@ test_expect_success 'the dumb transport refuses a path that climbs out' '
 
 test_expect_success 'the about page serves nothing above the readme directory' '
 	cveq "url=cve/about/../cverc" >tmp &&
-	grep "^Status: 200" tmp &&
+	grep "^Status: 404" tmp &&
 	! grep "virtual-root" tmp &&
 	cveq "url=cve/about/" >tmp &&
 	grep "readme text" tmp
diff --git a/tests/t0303-robustness.sh b/tests/t0303-robustness.sh
index 87a85ce..7b037bf 100755
--- a/tests/t0303-robustness.sh
+++ b/tests/t0303-robustness.sh
@@ -218,7 +218,7 @@ test_expect_success 'a submodule below the about path does not end the request'
 		echo "repo.readme=master:file-1"
 	} >aboutrc &&
 	CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="url=rob/about/sub" cgit >tmp 2>err &&
-	grep "^Status:" tmp &&
+	grep "^Status: 404" tmp &&
 	! grep "fatal" err
 '
 
@@ -525,6 +525,7 @@ test_expect_success 'a disk readme in the repository directory serves no sibling
 	CGIT_CONFIG="$PWD/diskrc" QUERY_STRING="url=rob/about/" cgit >tmp &&
 	grep "hello" tmp &&
 	CGIT_CONFIG="$PWD/diskrc" QUERY_STRING="url=rob/about/config" cgit >tmp &&
+	grep "^Status: 404" tmp &&
 	! grep "repositoryformatversion" tmp
 '
 
@@ -617,17 +618,27 @@ test_expect_success 'pages behind an auth filter are marked private' '
 	! grep "^Vary" tmp
 '
 
-# The about page redirects to its trailing-slash form so relative links
-# resolve, and the branch asked for has to survive that hop, as does the
-# hop back to the summary of a repository without a readme.
-test_expect_success 'the about redirects keep the query string' '
+# A repository without a readme sends its about page to the summary, and
+# the branch asked for has to survive that hop.
+test_expect_success 'the about redirect keeps the query string' '
 	git -C repos/rob branch other HEAD &&
-	CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="url=rob/about&h=other&x=1" cgit >tmp &&
-	grep "^Status: 301" tmp &&
-	grep "^Location: /rob/about/?h=other&x=1$" tmp &&
-	robq "url=rob/about/&h=other" >tmp &&
+	robq "url=rob/about&h=other&x=1" >tmp &&
 	grep "^Status: 302" tmp &&
-	grep "^Location: /rob/about/../?h=other$" tmp
+	grep "^Location: /rob/?h=other&x=1$" tmp &&
+	CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="url=rob/about&h=other" cgit >tmp &&
+	grep "^Status: 200" tmp
+'
+
+# The about page shows the readme alone and its links lead into the tree,
+# so a path below it names nothing, the site about page included.
+test_expect_success 'a path below the about page answers 404' '
+	for path in file-1 sub/ ../robrc
+	do
+		CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="url=rob/about/$path" cgit >tmp &&
+		grep "^Status: 404" tmp || return 1
+	done &&
+	CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="p=about&path=x" cgit >tmp &&
+	grep "^Status: 404" tmp
 '
 
 test_expect_success 'a symlink whose target is a large blob is listed without it' '