From 7f9ad99b8eb43d2102a383dbbaa8f0c0832bd423 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 16 Oct 2026 06:33:14 -1000 Subject: Answer 404 for any path below the about page The about page served every file beside the readme as a page of its own, through the about filter, and answered 200 for directories and missing files alike. Images it passed through came from the root of the default branch whatever the readme's own directory and ref. A readme on disk exposed its whole directory this way. --- tests/t0303-robustness.sh | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-) (limited to 'tests/t0303-robustness.sh') diff --git a/tests/t0303-robustness.sh b/tests/t0303-robustness.sh index 87a85ce..7b037bf 100755 --- a/tests/t0303-robustness.sh +++ b/tests/t0303-robustness.sh @@ -218,7 +218,7 @@ test_expect_success 'a submodule below the about path does not end the request' echo "repo.readme=master:file-1" } >aboutrc && CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="url=rob/about/sub" cgit >tmp 2>err && - grep "^Status:" tmp && + grep "^Status: 404" tmp && ! grep "fatal" err ' @@ -525,6 +525,7 @@ test_expect_success 'a disk readme in the repository directory serves no sibling CGIT_CONFIG="$PWD/diskrc" QUERY_STRING="url=rob/about/" cgit >tmp && grep "hello" tmp && CGIT_CONFIG="$PWD/diskrc" QUERY_STRING="url=rob/about/config" cgit >tmp && + grep "^Status: 404" tmp && ! grep "repositoryformatversion" tmp ' @@ -617,17 +618,27 @@ test_expect_success 'pages behind an auth filter are marked private' ' ! grep "^Vary" tmp ' -# The about page redirects to its trailing-slash form so relative links -# resolve, and the branch asked for has to survive that hop, as does the -# hop back to the summary of a repository without a readme. -test_expect_success 'the about redirects keep the query string' ' +# A repository without a readme sends its about page to the summary, and +# the branch asked for has to survive that hop. +test_expect_success 'the about redirect keeps the query string' ' git -C repos/rob branch other HEAD && - CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="url=rob/about&h=other&x=1" cgit >tmp && - grep "^Status: 301" tmp && - grep "^Location: /rob/about/?h=other&x=1$" tmp && - robq "url=rob/about/&h=other" >tmp && + robq "url=rob/about&h=other&x=1" >tmp && grep "^Status: 302" tmp && - grep "^Location: /rob/about/../?h=other$" tmp + grep "^Location: /rob/?h=other&x=1$" tmp && + CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="url=rob/about&h=other" cgit >tmp && + grep "^Status: 200" tmp +' + +# The about page shows the readme alone and its links lead into the tree, +# so a path below it names nothing, the site about page included. +test_expect_success 'a path below the about page answers 404' ' + for path in file-1 sub/ ../robrc + do + CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="url=rob/about/$path" cgit >tmp && + grep "^Status: 404" tmp || return 1 + done && + CGIT_CONFIG="$PWD/aboutrc" QUERY_STRING="p=about&path=x" cgit >tmp && + grep "^Status: 404" tmp ' test_expect_success 'a symlink whose target is a large blob is listed without it' ' -- cgit