1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
|
test_description='Check the shipped auth extensions'
CGIT_TEST_NO_CREATE_REPOS=YesPlease
. ./setup.sh
. "$TEST_OUTPUT_DIRECTORY/extensions/lib.sh"
for lua in $interpreters
do
for variant in inline file
do
test_expect_success "auth-$variant checks under $lua" "
'$lua' '$EXT_TEST_DIRECTORY/test-auth.lua' '$EXTENSIONS_DIRECTORY/auth-$variant.lua' $variant
"
done
done
test_expect_success 'create a repository with one commit' '
test_create_repo repos/authy &&
(
cd repos/authy &&
echo content >file &&
git add file &&
git commit -m "guarded commit"
)
'
if test "$CGIT_HAS_LUA" -eq 1 &&
! cgit_lua_probe "$PWD/repos/authy/.git" openssl.rand openssl.hmac posix.sys.stat posix.unistd
then
test_set_prereq CGIT_LUA_NOAUTH
say 'cgit lua lacks luaossl or luaposix, expecting protected pages refused'
fi
test_expect_success CGIT_LUA 'point cgit at the unedited auth filter' '
cat >cgitrc <<-EOF
virtual-root=/
cache-size=0
auth-filter=lua:$EXTENSIONS_DIRECTORY/auth-inline.lua
repo.url=authy
repo.path=$PWD/repos/authy/.git
EOF
'
test_expect_success CGIT_LUA 'an unedited copy protects nothing' '
cgit_url "authy/log/" >tmp &&
grep ">guarded commit</a>" tmp
'
test_expect_success CGIT_LUA_NOAUTH 'without the modules a protected repository stays closed' '
cat >protect.awk <<-\EOF &&
{ print }
/^local protected_repos = [{]$/ { print "\t[\"authy\"] = { alice = true }," }
EOF
awk -f protect.awk "$EXTENSIONS_DIRECTORY/auth-inline.lua" >guarded.lua &&
grep "\"authy\"" guarded.lua &&
cat >guardedrc <<-EOF &&
virtual-root=/
cache-size=0
auth-filter=lua:$PWD/guarded.lua
repo.url=authy
repo.path=$PWD/repos/authy/.git
EOF
cgit_rc guardedrc "url=authy/log/" >tmp &&
! grep "guarded commit" tmp &&
grep "Unable to complete the request" tmp
'
test_expect_success 'the login page keeps the repository to itself' '
write_script deny.sh <<-\EOF &&
test "$1" = body && echo "<p>sign in</p>"
exit 0
EOF
cat >denyrc <<-EOF &&
virtual-root=/
cache-size=0
root-desc=the whole site
auth-filter=exec:$PWD/deny.sh
repo.url=authy
repo.path=$PWD/repos/authy/.git
repo.desc=the secret plan
repo.owner=Mallory Owner
repo.hide=1
EOF
cgit_rc denyrc "url=authy/log/" >tmp &&
grep "<p>sign in</p>" tmp &&
grep "<p class=.sub desc.>the whole site</p>" tmp &&
grep "<meta name=.description. content=.the whole site.>" tmp &&
! grep "secret plan" tmp &&
! grep "Mallory" tmp
'
test_expect_success 'the login page asks not to be indexed' '
cgit_rc denyrc "url=authy/log/" >tmp &&
grep "^Status: 200" tmp &&
grep "<meta name=.robots. content=.noindex, nofollow.>" tmp &&
{
echo "robots=" &&
cat denyrc
} >norobotsrc &&
cgit_rc norobotsrc "url=authy/log/" >tmp &&
grep "<meta name=.robots. content=.noindex, nofollow.>" tmp
'
test_done
|
