2 files changed, 22 insertions, 11 deletions

diff --git a/tests/t0301-security.sh b/tests/t0301-security.shindex 1a5ee44..ce2b5da 100755--- a/tests/t0301-security.sh+++ b/tests/t0301-security.sh@@ -445,7 +445,7 @@ test_expect_success 'the dumb transport refuses a path that climbs out' '  test_expect_success 'the about page serves nothing above the readme directory' ' 	cveq "url=cve/about/../cverc" >tmp &&-	grep "^Status: 200" tmp &&+	grep "^Status: 404" tmp && 	! grep "virtual-root" tmp && 	cveq "url=cve/about/" >tmp && 	grep "readme text" tmp
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index 1a5ee44..ce2b5da 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -445,7 +445,7 @@ test_expect_success 'the dumb transport refuses a path that climbs out' '
 
 test_expect_success 'the about page serves nothing above the readme directory' '
 	cveq "url=cve/about/../cverc" >tmp &&
-	grep "^Status: 200" tmp &&
+	grep "^Status: 404" tmp &&
 	! grep "virtual-root" tmp &&
 	cveq "url=cve/about/" >tmp &&
 	grep "readme text" tmp
diff --git a/tests/t0303-robustness.sh b/tests/t0303-robustness.shindex 96c7897..d889a32 100755--- a/tests/t0303-robustness.sh+++ b/tests/t0303-robustness.sh@@ -218,7 +218,7 @@ test_expect_success 'a submodule below the about path does not end the request' 		echo "repo.readme=master:file-1" 	} >aboutrc && 	CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="url=rob/about/sub" cgit >tmp 2>err &&-	grep "^Status:" tmp &&+	grep "^Status: 404" tmp && 	! grep "fatal" err ' @@ -525,6 +525,7 @@ test_expect_success 'a disk readme in the repository directory serves no sibling 	CGIT_CONFIG="$PWD/diskrc" QUERY_STRING="url=rob/about/" cgit >tmp && 	grep "hello" tmp && 	CGIT_CONFIG="$PWD/diskrc" QUERY_STRING="url=rob/about/config" cgit >tmp &&+	grep "^Status: 404" tmp && 	! grep "repositoryformatversion" tmp ' @@ -617,17 +618,27 @@ test_expect_success 'pages behind an auth filter are marked private' ' 	! grep "^Vary" tmp ' -# The about page redirects to its trailing-slash form so relative links-# resolve, and the branch asked for has to survive that hop, as does the-# hop back to the summary of a repository without a readme.-test_expect_success 'the about redirects keep the query string' '+# A repository without a readme sends its about page to the summary, and+# the branch asked for has to survive that hop.+test_expect_success 'the about redirect keeps the query string' ' 	git -C repos/rob branch other HEAD &&-	CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="url=rob/about&h=other&x=1" cgit >tmp &&-	grep "^Status: 301" tmp &&-	grep "^Location: /rob/about/?h=other&x=1$" tmp &&-	robq "url=rob/about/&h=other" >tmp &&+	robq "url=rob/about&h=other&x=1" >tmp && 	grep "^Status: 302" tmp &&-	grep "^Location: /rob/about/../?h=other$" tmp+	grep "^Location: /rob/?h=other&x=1$" tmp &&+	CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="url=rob/about&h=other" cgit >tmp &&+	grep "^Status: 200" tmp+'++# The about page shows the readme alone and its links lead into the tree,+# so a path below it names nothing, the site about page included.+test_expect_success 'a path below the about page answers 404' '+	for path in file-1 sub/ ../robrc+	do+		CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="url=rob/about/$path" cgit >tmp &&+		grep "^Status: 404" tmp || return 1+	done &&+	CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="p=about&path=x" cgit >tmp &&+	grep "^Status: 404" tmp '  test_expect_success 'a symlink whose target is a large blob is listed without it' '
diff --git a/tests/t0303-robustness.sh b/tests/t0303-robustness.sh
index 96c7897..d889a32 100755
--- a/tests/t0303-robustness.sh
+++ b/tests/t0303-robustness.sh
@@ -218,7 +218,7 @@ test_expect_success 'a submodule below the about path does not end the request'
 		echo "repo.readme=master:file-1"
 	} >aboutrc &&
 	CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="url=rob/about/sub" cgit >tmp 2>err &&
-	grep "^Status:" tmp &&
+	grep "^Status: 404" tmp &&
 	! grep "fatal" err
 '
 
@@ -525,6 +525,7 @@ test_expect_success 'a disk readme in the repository directory serves no sibling
 	CGIT_CONFIG="$PWD/diskrc" QUERY_STRING="url=rob/about/" cgit >tmp &&
 	grep "hello" tmp &&
 	CGIT_CONFIG="$PWD/diskrc" QUERY_STRING="url=rob/about/config" cgit >tmp &&
+	grep "^Status: 404" tmp &&
 	! grep "repositoryformatversion" tmp
 '
 
@@ -617,17 +618,27 @@ test_expect_success 'pages behind an auth filter are marked private' '
 	! grep "^Vary" tmp
 '
 
-# The about page redirects to its trailing-slash form so relative links
-# resolve, and the branch asked for has to survive that hop, as does the
-# hop back to the summary of a repository without a readme.
-test_expect_success 'the about redirects keep the query string' '
+# A repository without a readme sends its about page to the summary, and
+# the branch asked for has to survive that hop.
+test_expect_success 'the about redirect keeps the query string' '
 	git -C repos/rob branch other HEAD &&
-	CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="url=rob/about&h=other&x=1" cgit >tmp &&
-	grep "^Status: 301" tmp &&
-	grep "^Location: /rob/about/?h=other&x=1$" tmp &&
-	robq "url=rob/about/&h=other" >tmp &&
+	robq "url=rob/about&h=other&x=1" >tmp &&
 	grep "^Status: 302" tmp &&
-	grep "^Location: /rob/about/../?h=other$" tmp
+	grep "^Location: /rob/?h=other&x=1$" tmp &&
+	CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="url=rob/about&h=other" cgit >tmp &&
+	grep "^Status: 200" tmp
+'
+
+# The about page shows the readme alone and its links lead into the tree,
+# so a path below it names nothing, the site about page included.
+test_expect_success 'a path below the about page answers 404' '
+	for path in file-1 sub/ ../robrc
+	do
+		CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="url=rob/about/$path" cgit >tmp &&
+		grep "^Status: 404" tmp || return 1
+	done &&
+	CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="p=about&path=x" cgit >tmp &&
+	grep "^Status: 404" tmp
 '
 
 test_expect_success 'a symlink whose target is a large blob is listed without it' '