From a3762bede10bdefbf3becf6cde82b109e974e515 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 14:34:33 -1000 Subject: Check a failure flag that follows a question mark A failed login on a page with no query of its own comes back as ?login=failed, the common case, but only the &login=failed form was tried. A drop_failure_flag that handled the ampersand alone would have lost the message and piled flags onto the way back, and passed. --- tests/extensions/test-auth.lua | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'tests/extensions') diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index d6982a4..111fbbb 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -489,6 +489,11 @@ out = run_action("body", { url = "/repo/log/?q=x&login=failed" }) h.contains("a failed login says so", out, "") h.equals("and leaves the flag out of the way back", way_back_in(out), "/repo/log/?q=x") +-- A page with no query of its own comes back flagged after a question mark. +out = run_action("body", { url = "/repo/?login=failed" }) +h.contains("a flag after a question mark says so too", out, + "") +h.equals("and leaves the flag and its mark out of the way back", way_back_in(out), "/repo/") -- The real get_secret, pointed at a directory nobody made, cannot sign the -- way back, so the page says so whole rather than breaking off in the form. -- cgit 2.12.1