aboutsummaryrefslogtreecommitdiff
path: root/t
Commit message (Collapse)AuthorAge
* git-cgi.t: Add a failing test for a blog with a non-ASCII rootpageSimon McVittie2019-01-31
| | | | | | | | This is one of several possible bug reports on "doc/bugs/About %2F problem" (I'm not sure what the actual bug being reported is). Signed-off-by: Simon McVittie <smcv@debian.org>
* git-cgi.t: Add a simple test for blog posts from a root pageSimon McVittie2019-01-31
| | | | | | This is the working base case for "doc/bugs/About %2F problem". Signed-off-by: Simon McVittie <smcv@debian.org>
* git-cgi.t: Print query string as a TAP diagnosticSimon McVittie2019-01-31
| | | | Signed-off-by: Simon McVittie <smcv@debian.org>
* po: Improve test coverageSimon McVittie2018-12-01
| | | | Signed-off-by: Simon McVittie <smcv@debian.org>
* po: Add failing test for Debian bug #911356Simon McVittie2018-12-01
| | | | Signed-off-by: Simon McVittie <smcv@debian.org>
* meta test: Assert that malformed dates are rejectedSimon McVittie2018-03-21
| | | | Signed-off-by: Simon McVittie <smcv@debian.org>
* meta test: Use syntactically valid datesSimon McVittie2018-03-21
| | | | | | I'm about to make invalid dates like 12345 be an error. Signed-off-by: Simon McVittie <smcv@debian.org>
* not-truncated.t: Work correctly as an installed-testSimon McVittie2018-03-09
| | | | Signed-off-by: Simon McVittie <smcv@debian.org>
* Add a test asserting that no plugin is an empty fileSimon McVittie2018-03-09
| | | | | | | | | I'm still not completely sure how it happened, and I can't reproduce it myself, but in the Debian build of ikiwiki 3.20180105, wikitext.pm ended up empty. The build fixes in commits 3aacac3b, efcbeaa0, b32480f0 hopefully fixed this. Signed-off-by: Simon McVittie <smcv@debian.org>
* mdwn: Automatically detect which libdiscount flags to useSimon McVittie2018-03-08
| | | | | | | | | | Unconditionally passing arbitrary numbers as flags turns out to be a bad idea, because some of the "unused" values have historically had side-effects internal to libdiscount. Detect whether the known flags work by rendering short Markdown snippets the first time we htmlize, checking whether each known flag is both necessary and sufficient. Signed-off-by: Simon McVittie <smcv@debian.org>
* rst test: Probe for docutils Python 3 module, not Python 2http://thm.id.fedoraproject.org/2018-03-04
|
* img test: Exercise a format that is uncommon on the web (BMP)Simon McVittie2018-02-28
| | | | Signed-off-by: Simon McVittie <smcv@debian.org>
* img test: Don't rely on using an empty ImageMagick coder nameSimon McVittie2018-02-28
| | | | | | | | | This used to work, but has been interpreted as a literal part of the filename since ImageMagick 6.9.8-3. In newer versions, there does not seem to be any way to indicate that a filename containing ':' is to be taken literally without first knowing the decoder to use. Signed-off-by: Simon McVittie <smcv@debian.org>
* t/wellformed: Rebuild the docwiki, not everythingSimon McVittie2018-01-29
|
* t: Accept optional file:// prefix on W3m-controlSimon McVittie2018-01-29
|
* Don't send relative redirect URLs when behind a reverse proxySimon McVittie2018-01-08
|
* t/relativity.t: Add tests for IkiWiki::redirect behaviourSimon McVittie2018-01-08
| | | | This reproduces [[bugs/cgi_redirecting_to_non-https_URL]].
* Remove openid provider icons from login selectorJoey Hess2018-01-05
| | | | | | | | | Remove openid provider icons from login selector, since openid providers are increasingly not working. Verisign retired theirs, and aol and yahoo/flickr are not commonly used for openid. Any users who still clicked those icons to login will need to instead enter their openid url. This commit was sponsored by andrea rota.
* t/git-untrusted.t: Fix redundant declarationSimon McVittie2017-10-01
| | | | Signed-off-by: Simon McVittie <smcv@debian.org>
* t/git-untrusted.t: New test case for untrusted pushesSimon McVittie2017-10-01
| | | | | | | | | This also exercises the typical centralized git repository workflow, where changes flow from a non-bare clone (for example on a laptop) to a centralized bare repository, then from the centralized bare repository to a non-bare clone that is ikiwiki's srcdir. Signed-off-by: Simon McVittie <smcv@debian.org>
* t/img.t: test determinism of PNG resizing.intrigeri2017-09-01
|
* t/img.t: Give better diagnostics if we can't load an imageSimon McVittie2017-06-22
|
* color, toc: Fix `make test`Simon McVittie2017-05-16
|
* color: Use markup for the preserved CSS, not character dataSimon McVittie2017-05-16
| | | | | | This still smuggles it past the sanitize step, but avoids having other plugins that want to capture text content without markup (notably toc) see the CSS as if it was text content.
* color: Add a unit testSimon McVittie2017-05-16
|
* Add a simple unit test for [[!toc]]Simon McVittie2017-05-16
|
* Add a test-case for Markdown optionsSimon McVittie2017-05-16
|
* t/git-cgi.t: Wait 1 second before doing a revert that should succeedSimon McVittie2017-05-14
| | | | | | | | | | | This hopefully fixes a race condition in which the test failed around 6% of the time. If we don't wait, the mtime (which is rounded down to 1 second precision in the APIs we use) will not necessarily change, so the update will not necessarily cause the page to be refreshed. Bug-Debian: https://bugs.debian.org/862494
* t/passwordauth.t: new automated test for passwordauthSimon McVittie2017-01-11
| | | | | | In particular this includes an exploit for OVE-20170111-0001. (cherry picked from commit fbe207212b1f4a395dc297fb274ef07afd7d68f3)
* git-cgi.t: when committing directly, make sure we have a valid authorSimon McVittie2017-01-09
| | | | | In the environment used on ci.debian.net, we have neither a name nor an email address.
* t/git-cgi.t: fix race conditionSimon McVittie2017-01-09
| | | | | We need the changes to take place at least 1 second after the first rebuild, so that the changed files are seen to have changed.
* git: Add test coverage for reverting attachmentsSimon McVittie2016-12-28
|
* Add automated test for using the CGI with git, including CVE-2016-10026Simon McVittie2016-12-28
|
* git_revert test: reinstate ikiwiki.setup, and make it work uninstalledSimon McVittie2016-12-28
| | | | | | | | | | | | | | Previously it was relying on running with an installed ikiwiki and being able to copy in recentchanges.mdwn and wikiicons/ from the underlay in /usr. The underlay in ./underlays/basewiki can't be used (yet) because ikiwiki doesn't allow following symlinks, even from underlays. I'd like to make ikiwiki follow symlinks whose destinations can be verified to be safe (for example making it willing to expose /usr/share/javascript to the web, but not /etc/passwd), at least from underlays, but this is security-sensitive so I'm not going to rush into it.
* Add a manual test for reverting git commitsSimon McVittie2016-12-19
| | | | Signed-off-by: Simon McVittie <smcv@debian.org>
* Exclude working directory from library path (CVE-2016-1238)Simon McVittie2016-07-28
| | | | | | | | | | | | | | | | | | | | | Current Perl versions put '.' at the end of the library search path @INC, although this will be fixed in a future Perl release. This means that when software loads an optionally-present module, it will be looked for in the current working directory before giving up. An attacker could use this to execute arbitrary Perl code from ikiwiki's current working directory. Removing '.' from the library search path in Perl is the correct fix for this vulnerability, but is not trivial to do due to backwards-compatibility concerns. Mitigate this (even if ikiwiki is run with a vulnerable Perl version) by explicitly removing '.' from the search path, and instead looking for ikiwiki's own modules relative to the absolute path of the executable when run from the source directory. In tests that specifically want to use the current working directory, use "-I".getcwd instead of "-I." so we use its absolute path, which is immune to the removal of ".".
* Wrapper: allocate new environment dynamicallySimon McVittie2016-05-11
| | | | | | | | | | | | | | Otherwise, if third-party plugins extend newenviron by more than 3 entries, we could overflow the array. It seems unlikely that any third-party plugin manipulates newenviron in practice, so this is mostly theoretical. Just in case, I have deliberately avoided using "i" as the variable name, so that any third-party plugin that was manipulating newenviron directly will now result in the wrapper failing to compile. I have not assumed that realloc(NULL, ...) works as an equivalent of malloc(...), in case there are still operating systems where that doesn't work.
* img test: exercise upper-case extensions for image filesSimon McVittie2016-05-09
|
* Fix spelling of "ratio" in test.Amitai Schlair2016-05-08
|
* img: make img_allowed_formats case-insensitiveSimon McVittie2016-05-07
|
* update test suite for svg passthrough by img directiveJoey Hess2016-05-06
| | | | | Remove build dependency libmagickcore-6.q16-2-extra which was only there for this test.
* img: check magic number before giving common formats to ImageMagickSimon McVittie2016-05-05
| | | | | This mitigates CVE-2016-3714 and similar vulnerabilities by avoiding passing obviously-wrong input to ImageMagick decoders.
* img: restrict to JPEG, PNG and GIF images by defaultSimon McVittie2016-05-05
| | | | | | This mitigates CVE-2016-3714. Wiki administrators who know that they have prevented arbitrary code execution via other formats can re-enable the other formats if desired.
* Fix CVS tests by uninverting $installed (cdfb4ab).Amitai Schlair2016-02-18
|
* Compose relative URLs in RSS feeds correctlySimon McVittie2016-01-21
| | | | | | | If the relative link from the (page generating the) RSS to the target would start with "./" or "../", just concatenating it with the URL to the directory containing the RSS is not sufficient. Go via URI::new_abs to fix this.
* Don't fail to syslog if the wiki name contains %sSimon McVittie2016-01-21
| | | | This is a corner case spotted while fixing UTF-8 syslogging.
* Force log messages to be bytestringsSimon McVittie2016-01-21
| | | | Sys::Syslog is not UTF-8-literate.
* img test: use the right filenames when testing that deletion occursSimon McVittie2016-01-19
| | | | | Also use a less misleading name for the sample SVG: it is no longer empty. Since commit 105f285a it has contained a blue square.
* img test: skip testing PDFs if unsupportedSimon McVittie2016-01-19
|
* Merge remote-tracking branch 'smcv/ready/limit'Simon McVittie2015-11-30
|\
generated by cgit v1.2.3 (git 2.45.0) at 2024-11-28 08:44:34 +0000