From ec561c92806da08dd6592c7bf1493d34223e3c36 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sun, 1 Nov 2026 18:55:53 -1000
Subject: Keep a protected repository's header to itself

The login page stands in for any page of the repository, so it named
the description and owner of one the visitor may not see, including
one hidden from the index. The site's own description fills the
line, as on the index, so the header keeps its height.
---
 tests/t0505-auth.sh | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

(limited to 'tests')

diff --git a/tests/t0505-auth.sh b/tests/t0505-auth.sh
index 7dd4a36..f7096ca 100755
--- a/tests/t0505-auth.sh
+++ b/tests/t0505-auth.sh
@@ -74,4 +74,32 @@ test_expect_success CGIT_LUA_NOAUTH 'without the modules a protected repository
 	grep "Unable to complete the request" tmp
 '
 
+# A filter of the test's own turns every visitor away, which needs no Lua.
+# Until a visitor is let in, the header of a protected repository shows the
+# site's description in place of its own and no owner, even for a
+# repository hidden from the index.
+test_expect_success 'the login page keeps the repository to itself' '
+	write_script deny.sh <<-\EOF &&
+	test "$1" = body && echo "<p>sign in</p>"
+	exit 0
+	EOF
+	cat >denyrc <<-EOF &&
+	virtual-root=/
+	cache-size=0
+	root-desc=the whole site
+	auth-filter=exec:$PWD/deny.sh
+	repo.url=authy
+	repo.path=$PWD/repos/authy/.git
+	repo.desc=the secret plan
+	repo.owner=Mallory Owner
+	repo.hide=1
+	EOF
+	cgit_rc denyrc "url=authy/log/" >tmp &&
+	grep "<p>sign in</p>" tmp &&
+	grep "<p class=.sub desc.>the whole site</p>" tmp &&
+	grep "<meta name=.description. content=.the whole site.>" tmp &&
+	! grep "secret plan" tmp &&
+	! grep "Mallory" tmp
+'
+
 test_done
-- 
cgit 2.12.1