# 
# 
# add_file "tests/t_case_insensitive__MTN.at"
#  content [fdf26c339c41687a9102200aa7087d3a8b209e48]
# 
# patch "ChangeLog"
#  from [c25536fb7068b7acb11dc76c45393e9b5724808a]
#    to [663c7d404c8db3a4c00289d1ac3248c5a383e0cc]
# 
# patch "testsuite.at"
#  from [452e8fb6a61f93c811af62863cd201f36d3dc39c]
#    to [3b0beb18b493ab5aac53fdec0411f8fdbec273cd]
# 
============================================================
--- tests/t_case_insensitive__MTN.at	fdf26c339c41687a9102200aa7087d3a8b209e48
+++ tests/t_case_insensitive__MTN.at	fdf26c339c41687a9102200aa7087d3a8b209e48
@@ -0,0 +1,157 @@
+AT_SETUP([_MTN case-folding security patch])
+MTN_SETUP
+NEED_UNGZB64
+
+# The patch for this security issue is to treat all case-folded
+# versions of _MTN as being bookkeeping files (and thus illegal
+# file_paths).  Make sure it's working.
+
+# bookkeeping files are an error for add
+AT_CHECK(touch _mtn _mtN _mTn _Mtn _MTn _MtN _mTN _MTN)
+AT_CHECK(MTN add _mtn, [1], [ignore], [ignore])
+AT_CHECK(MTN add _mtN, [1], [ignore], [ignore])
+AT_CHECK(MTN add _mTn, [1], [ignore], [ignore])
+AT_CHECK(MTN add _Mtn, [1], [ignore], [ignore])
+AT_CHECK(MTN add _MTn, [1], [ignore], [ignore])
+AT_CHECK(MTN add _MtN, [1], [ignore], [ignore])
+AT_CHECK(MTN add _mTN, [1], [ignore], [ignore])
+AT_CHECK(MTN add _MTN, [1], [ignore], [ignore])
+AT_CHECK(MTN ls known, [], [], [])
+AT_CHECK(rm -rf _mtn _mtN _mTn _Mtn _MTn _MtN _mTN _MTN)
+
+# run setup again, because we've removed our bookkeeping dir.
+AT_CHECK(MTN --branch=testbranch setup .)
+
+# files in bookkeeping dirs are also ignored by add
+# (mkdir -p used because the directories already exist on case-folding FSes)
+AT_CHECK(mkdir -p _mtn _mtN _mTn _Mtn _MTn _MtN _mTN _MTN)
+AT_CHECK(touch _mtn/foo _mtN/foo _mTn/foo _Mtn/foo _MTn/foo _MtN/foo _mTN/foo _MTN/foo)
+AT_CHECK(MTN add _mtn, [1], [ignore], [ignore])
+AT_CHECK(MTN add _mtN, [1], [ignore], [ignore])
+AT_CHECK(MTN add _mTn, [1], [ignore], [ignore])
+AT_CHECK(MTN add _Mtn, [1], [ignore], [ignore])
+AT_CHECK(MTN add _MTn, [1], [ignore], [ignore])
+AT_CHECK(MTN add _MtN, [1], [ignore], [ignore])
+AT_CHECK(MTN add _mTN, [1], [ignore], [ignore])
+AT_CHECK(MTN add _MTN, [1], [ignore], [ignore])
+AT_CHECK(MTN ls known, [], [], [])
+AT_CHECK(rm -rf _mtn _mtN _mTn _Mtn _MTn _MtN _mTN _MTN)
+
+# assert trips if we have a db that already has a file with this sort
+# of name in it.
+AT_DATA(files.db.dump.gz.b64, [H4sIACkRKkQCA+1YW2+bxxF9ln7FB7/IBhh375fkJU4qtAYcB4idIEBRELszsxZTiVRJyon/
+fc+SIkXz4shpgL6UsglR3Mvczpkz3zeXf3v5erj8+dtXP755+dPlV+ff/nD54u3l8PbFN68u
+hzovU7oay+2MrhbnZ0/Pz67K4mqYzpbD9O76eribTv59J6Nh8/rii2G1YNaGudyUyXQyfTe0
+iVzzYljIbZmXpfBQPwxPvnxyfrY+/dRpOOuX2WS6GH6dLK9w3PvJYjKbjknmy8Xz9+X6Ts7P
+VoY9HLD3wgm4gWc3w5X89oVMaca4fcLnZ8/2/OQ6fl/mi/PNzqfb37AbbmyvGG1PXtDsVrqj
+5fb2ekJlCeNWHwectN0+LTeyv3m1HYuGf8mH7cKVQwcr7xeuvd0sXYfp6dqy0eqKZ9sv9z1r
+k2sZs1wvyzp/Ez7my3I+Q6I2qet7BppNlzJdYlctiz3LPk5NX754joNn893rnvdAr379aDP2
+0uzmdi6LBZIx50lrw3LWr4MVd7Qc6G4+x8VDmyNx/e7zs3uPJzxa/eHZYQJXNmwcvJ1Pbsr8
+Q4/v6DEOctmxcROTHSM3K9fp7ZtXBrx8/ebyh7fDy9dvv1/fP/z04tWPl2+eXnCxuVgRL6G6
+qtga72uTln1QOmVVGicVVb4Y/XyhW6oqqZ1Xa8qqg9fFvss3ZTppsliuEfFJcH4eLA9L5Bgg
+N9dvMr81Zyf7x6t/ddLstsC4nphuC13NFjLtFtwtZH5+dhwNuxvr9ayenyHDt2UyP4abHVNv
+7yoQOsbitVmLybtpWd7N92/Arh/evPjLm7+/0MPDGgTtyT+6J19P+EsY9s8n24Lsfx0NvSxX
+Bo+Ge3tGD9uP1OpepE7A8mjhFqR1eSUDqnE+QcGBmcr2vGNIPYiF4E0esvWJ5B1C955S/yTI
+bgvoBGz/SAAOkbwP5tGw6QMfo/rhjH07p/LbcjyfLZYyH0+xczy9u6m9SGF1/7xr926dTq8/
+4G1t6odu6PJqshiWpV6jUOR9P2GPRE7ctKWVdMABO5X95xLAYS7Wp3QfJwyXJtg9P8Atvj6V
+AiDr3tyh33ezOHB/x5kHJpXkqo+evbhovLPZSi0uMwn+O645CTvDF6OL6S+Lr29ndfbbc2S7
+M6tVSWcGlbIKKpuSgksptIjPevXjQas2afCv6mtTVAbvWqmaxTQfbMFdORVtIzUnypcgKePN
+NMlKtNY4i5O4TCqQL0UyhZawjCXmaHJVPhSDr6sqtURdY8MNLliVSyF846pt+JyqboZCrYEr
+KaO1tSGRqBxI6YbzVLJV4Uea9xwpOh+tU56cNcpWakGpYLNxMRO5mmrytrlWhGyhCgOda8qY
+7HB7MJxtaA3uJtGVPSmLKOtApYpoHIsIGQXnDqptq8Eg2wCV+YdVzSGbHfsHVHpEvK2Jha4m
+18dUyMkN91yyvmg0rPY/OyifA+u2RYTi4JaRsqrIJuWaLS2mrItX0ii7hFSU6hmVcNrn/02X
+/TgQ/++n8om8rzK0TXoLNjEVgBog9pGA3xiskOaoWQOT2jWC1vqc4hhdrEeWzi7RBYAQ7yaa
+oIMEQPYYC3mvXACiqUgoXlMEvQgHosC+GR+Cc7GYKC7gV1YM+hGqWRGQnm1JTif2FdC1YByr
+a6gMPsiNSCgEFUUF7AHltEQ24EhjEphERdzgVI4SG+mSlXUGFFCc1lIjGcMgt5p19Fhcaq0M
+oQpHs4kgv9BqACcWi2uYyRu4H7XEELLVpungQFExVEohNYGL+A28pBRFq7wxKkbbBOyb88Xj
+0iUNp7UcUnaxhZhryE0bg+iQGGMNGNj7KP7z0oVmJKtWgOjhB9yHd4t3YzOaCYJiC/73d2/j
+sfSZFsQJ4a5iPEXvotZYDqoN3qCkCCYj5BXdBOYYcKdvNuqss4NBrjBZrSgZp9lUpIjBwri4
+TwLSuGQcEFXRmBPgAIjaaKQhVO8T0oRQiG8ihDaCRte6W66SQ7nFjCvQHlSWktiggApXT8U1
+38DkaB/oVSajhZgkxalouFWk3PVylF74USQYl7wh5WNMJSVLzmRb0ZC0hGYyZbGPTF9sMdvI
+sQMNPZmakhirI6dqNLagiTnUXa2fl75yt7yazXsagK/SW15UoQWUZ0ymI66Fo50/AXAoSDai
+fUAjRDIA+lirNy0JuVJsRDsO6KrVMAcpJRpJCqkOjJpDSzQhIwbSomNUIlp7T4IDEABAJXAT
+giGI2BgbEMAlOrG21YTqV0UiYqlrQyoBMfRtJCVH5BSBSapq0EAHmwMlQF0kHZtHDnRNOSO7
+ARoC6iMAsYAASo0hPSR7FIkJwraD1NvCWqvodAVB5MAuo/YQ0AgmCI9MmhVmGyEXjMYEagp0
+AISBL76gekARLXKtUASflzS6KtN3cj17t8obnAntWI5KFoWxWMTkzE5BMVWBaxZUpw2Qrn3n
+IE6ptczIB3ReLYins6kGwCgKMOxaTrEim3ADL0cci089qKZxTaY55bqX0Gb4jj0QzD4VaCiL
+zwGHo8YZBUIMYBWTIZMitwLYkangBAhGHzj7CryDrQ3SCogCjAHYC0U1UB2DV8DvkIbNoMYJ
+rK2IM07DpF+9raZkNkTZ2BoQxZBAb/a00lhPACupgb+Nj6nxT4mE+wFiR198Yg5cL97M8Pdb
+d4bAU4W0Xvkg0x9fHsqVWKB3vYAPGzpdgLAHLbfgGWLVdlQ6XehkfD49L3ax8XSJQWotw9Zb
+nv03k+HmkJPBWPyBMBx/7lM4K4dmTpD1WjkPUhU0fkraoMmjGGNIPnIGaaM1WpsAXMUYMIwX
+sA2aiI4AioC3iDy4pIF6epMndC0wYIhoR1ZHV9CBUIqSs6FmNSufWyowUrOPIQNo2mHmYB1U
+/xPYBhMCoBcFtR4wXGABwyKBOKngQBCzZ4wUFtNR7YORZkIeU0WygWytsNMQqLYEQzp5dB8A
+DJJBNQGAG0aQDB+rRasEA0IggaBV1s4pjRHMkEu6saIuoAzoEr0KlA5ixURnIaJyKCDUPili
+0PPFJpfFuwZp1irnCOJmkLo5+hzto6I//TDm6OOI/ihiA9ejD1/+KO6OPnz5c5+/3JtwGk2/
+6/FRTD0OVrvH7MNqbdcWVI8mjBOgYg/FpZMka6FPV6BCbyOUl0ItZaUJJQ0x7vHPQOZyCtCE
+ynoX0JiardGrWCAOdDUpx5hD6GhrkAwN2IH0cl0eWvQjsHy1IABfCFDX2avmtUs1W4+5w2bC
+gI/uEDVaCCrWovQrVD9pKPSkCGihrGKFsIEchwnEBU0KvakotmiPEBxQIPDdM+YaqDPqwiLE
+oL0zwFIyKw9KYwh3TPoWE4J3AsEg1XbF6oFMCJviSSqhOUFrVIJk8yHCy65UIJvE9bCh3dVc
+exNOLUCxRsQaI4duEY0x1Ca2Accuc0KfRYfDhFIB7uowDpicnHBG41PoqiErwwgKE6RzQ2NO
+vgpmk9JXBIAa8lBhYRdQ6MqEu/aA+vL1Xy9/Phzwx+P1o4TvXx8Z/p+uHxOcOmOlhMa9S+7u
+XusjoOb39vVJdbyeqo/sX8+xq6/7Qd9/993Lt1+d/wegrYfzaxsAAA==
+])
+AT_DATA(dirs.db.dump.gz.b64, [H4sIACERKkQCA+1YW2+bxxF9ln7FB7/IBhh375fkJU4qtAIcG4idIEBRELM7sxZTiVRJyrH/
+fc+SIkWLpCOnAfpSCqYl8tvduZ0zZ/a7879dvBrOf/n+5U9vLn4+/+b0+x/PX7w9H96++O7l
++VDmNK2XY7mZ1cvF6cnT05NLWlwO09lymN5eXQ2308m/b2U0bF5ffTWsHpi1YS7XNJlOpu+G
+NpErXgwLuaE5LYWH8nF48vWT05P17sd2w16/zibTxfDbZHmJ7d5PFpPZdFxlvlw8f09Xt3J6
+sjLsfoMHL+yAE3h2PVzKh69kWmeM0yd8evLsgZ9cxu9pvjjdrHy6/Q2r4cb2iNF250Wd3Uh3
+lG5uriaVljBu9eeAnbbLp3QtDxevluOh4V/ycfvgyqG9J+8eXHu7eXQdpqdry0arI55tv3zo
+WZtcyZjlaknr/E34kC/L+QyJ2qSurxnqbLqU6RKrCi0eWPZpavrji+fYeDbfPe55D/Tq108W
+Y22dXd/MZbFAMuY8aW1YzvpxsOK2Lod6O5/j4KHNkbh+9unJnccTHq0+eLafwJUNGwdv5pNr
+mn/s8R09xkGmHRs3MdkxcvPkOr198cqAi1dvzn98O1y8evt6ff7w84uXP52/eXrGZDNZES+h
+uKLYGu9Lk5Z9UDplRY2TiiqfjX450y0VldTOqzVl1d7r7KHL1zSdNFks14j4LDi/DJb7JXII
+kJvjN5nfmrOT/cPVv9ppdkMwriem21IvZwuZdgtuFzI/PTmMht2F5WpWTk+Q4RuazA/hZsfU
+m9sChI7x8NqsxeTdlJa384cnYNWPb1785c3fX+jh/hkE7ck/uiffTvhrGPbPJ9uC7J+Ohl6W
+K4NHw509o/vlB2r1QaSOwPJg4RLSuryUAdU4n6DgwEy03e8QUvdiIXiT+2x9Jnn70L2j1D8J
+stsCOgLbPxKAfSQ/BPNo2PSBT1F9v8dDO6fyYTmezxZLmY+nWDme3l6XXqSwuv+9a/dunU6v
+PuJtberHbujycrIYllSuUCjyvu/wgESOnLSlFe33SGCntP9cBthPxnqX7uSE4dMEq+d7wMXX
+x3IAaN2ZO/Tzrhd7/u84c0+lklzx0bMXF413Nlsp5DJXwT/HJSdhZ/hsdDb9dfHtzazMPjxH
+uju1WpV0ZnApq6CyoRRcSqFF/K1XPx68apMGAav+bIrK4F0rVbKY5oMlnJUTaRtrc6I8BUkZ
+b6ZJVqK1xl6cxOWqQvVEkmtoCY+xxBxNLsoHMvi6KCoUdYkNJ7hgVSaq+MYV2/B3KrqZGkoJ
+XKoyWlsbUhWVQ1W6YT+VbFH4keY9xxqdj9YpX501ypbaglLBZuNirtWVVJK3zTWSaqkWGOhc
+U8Zkh9OD4WxDa3A3iS7sq7KIsg6ViojGtoiQUXBur9q2Igy6DViZf1zVHLLZwb/HpQfU25pZ
+6uXk6pAMObrgjkzWB42G1fpne+WzZ922iFAc2iXnudgg1hTJjlX3sOiCMOumayCxWkiO+/y/
+abOfBuL/DVU+k/dVhrZJ96FG9ja5hiSrDKDn4psvVmmXrauUgWcn8iXFMTpbzyydXaILACHe
+TTRBBwmA7CEW6qQSHZgqRgCz+uAg8DzowPQDI4jA5SzKRq+5xta8S8pBN2ZWXTH64gHsYlQS
+oz0BrcbUZFTxWFxMMEblllgn68TBihxTMs6WYGOs2pEk+JQDiMm2qKvBedp7aYn6bzEI9iGf
+lCbjSaUCb7zOCISK0WduuRTDwVTxJSGCzrIiWwt5nExgPQYlRsYqq732YvBNqSV0wiy2Uqpn
+j0sXp1RYrG02qpQjuJB19WAlpDHEUGvB/9baL0sXmpGsWoGxoHgL7sO7xbuxGc1EWWcJ//zq
+PR5KH3KMMxojEy3HDCY11lLIWkw2iDB5x5Zt4qi0IXQERNlpz6kpxzVknyTnyKyNlwoKzjlZ
+dDOYXEoE1TI+KZli1Kaim8WqwMNoPcZxJOdS8+gzzSLQqTqqyAmRiVEFlBOan4vJIFqNg/Wh
+lVWdh2KRHkSzwhogQKEDeRRrNIzWGdG5FLqUMV55uAaQGNGuN9gmxjqnSq2aPSyrFPQj04eu
+6NHwvEFT6vWI9lxIqUgaVSCWtFS04ha/LH10u7yczXsaUNnUWx4cb8GgiSfTEdfC4c6PyGI/
+RCZbAAQ5KMACZrKcNUKmo0NjVKUBt8Frso08SUDFJkLFomXmpAJgmLVvxhLq28IHQS/uH0bl
+vE9ompHgL8Id0FxZkIyELIZsC8qXIye2DoAlABkRTyFETS5p1I1SxiefNbSFNbGRRnIZ+APM
+AX1UuUKWkFpPHQ8NB+HQEpFLU1G0WF8dyIvE2QoDIBckw79a2aGonX1k0qCbPGovOwiOkntV
+R2pUhYByF1mzQNJY+cKk1UuavpOr2btV3gJy1A4Cq0IQadaIG3CUPTemZhxqW1CaEmMrzeta
+Sur4t8H5yioWRnm12nxqDSAsolpXTdyjp40xwYIEfUvAXASaSOkeT1S3bxB8hRio6gQGIQZa
+VL6Bo0hnV6sNEJQJzJy8gJ1tYYuPNaKL6dxZWFAKJBl7NA62Pf8oqBK8t0ycC0OaeoEruhU2
+BAKwFdO+ZGo9/aiDGqlC3/kMfPhGx5XGegRYSQ18Nj6kxj8nEu4miB198ZlBcP3wZoi/W7oz
+BR4rpPWT96PJ48sDyCUkgxJymRg0hj4lYCDQu0oJTVXnVqSqo/H5/MDYxcbTJSaptQxbL3n2
+34yGm02OBmPxB8Jw+OIHhYTmkQgQ1xos02IWZ0p1aFQoXdhmdDbexxDwPaqUoQbQdqIzDtWO
+8QPqJgsquPcHTA8egkKwry+Ahm/M0PoAhqk5q4JGn2ppUCc1SwR5JQK0DBF4iwEajdEJe4Ef
+c4BIAVUWFUJynUazA+VBACgOaFEVeOhoKh276JeQMhHSQqOnYpohwQNOsDmaHRtoHoAroqcJ
+iwhb7FtcA2syY4LC5IJxxGQQKuQIN1B+10SYgSLUC6SMgWABZ2gwFWIKC5KQQtRwHji7Yqwz
+Fb4xBCBoPVpVu5iigmcxSyEAfb6J6FbsCs4DsSewD6nMruO+hcTcrQF3FF8YiwFmTESHLuE+
+Aczxm5yDdxn9HmMD9YM3N38Uswdvbv7cy5s7E44j8Xc9PojHx0Fyd5uHkFzbtQXko8nmCCDZ
+QyZC3Ff0XN2n6GgFTaOrHLKxBgzzAAoGZwzzaB6mWYhghU5RuoxGm2pcAoRxMdSn8j7IRw0t
+0DCWYMZHb0UDcRjrgTvxbCtrC2EOyGCBMQ10EbwBWEoNOufaapSCRhVSiS1ZKECHPtbvJQAw
+IBDHQ4iFYtLqcgPNSkEgABfBYXzA1xAVVKAWXGktkvUEFSNwCgoU6BfIReO8gwk4CH00e1hr
+mCEPDLQc1EgAfls2/ZqkNisOkM++IrbGYwSAYBVYJ1DUHkJC+9qxjbWxUyNh6oIE0g6Ahjo1
+mBESJFC3sUEJJCQCBMmYKpKFumvWNC2YZ1SG+qfqMszrifAINsg1mRQgW01yOYEIQ+ddyAOP
+vuzRfBHWLvpEo8UbMoFALc6AXxskB6xrGlaK7952RQiuQAycQSJUA3NA9uFYCJJ+2WS6x0WV
+5DR8SYRcg2KIVztCNoEokWRolBZA29Tvaj6li4tXfz3/Zf+KYjxeX4a8fnXg+uLp+qLj2B4r
+LTfufX539VrhAbu/t67P2uP1vcCB9etJfPV13+j1Dz9cvP3m9D8MMzs+LhwAAA==
+])
+
+UNGZB64(files.db.dump.gz.b64, files.db.dump)
+AT_CHECK(MTN db load -d files.db < files.db.dump, [], [ignore], [ignore])
+AT_CHECK(MTN db migrate -d files.db, [], [ignore], [ignore])
+AT_CHECK(MTN -d files.db co -b testbranch files-co-dir, [3], [ignore], [ignore])
+
+UNGZB64(dirs.db.dump.gz.b64, dirs.db.dump)
+AT_CHECK(MTN db load -d dirs.db < dirs.db.dump, [], [ignore], [ignore])
+AT_CHECK(MTN db migrate -d dirs.db, [], [ignore], [ignore])
+AT_CHECK(MTN -d dirs.db co -b testbranch dirs-co-dir, [3], [ignore], [ignore])
+
+AT_CLEANUP
============================================================
--- ChangeLog	c25536fb7068b7acb11dc76c45393e9b5724808a
+++ ChangeLog	663c7d404c8db3a4c00289d1ac3248c5a383e0cc
@@ -1,5 +1,9 @@
 2006-03-28  Nathaniel Smith  <address@hidden>
 
+	* tests/t_case_insensitive__MTN.at, testsuite.at: New test.
+
+2006-03-28  Nathaniel Smith  <address@hidden>
+
 	* tests/t_at_sign.at: Add a missing MTN_SETUP.
 
 2006-03-28  Nathaniel Smith  <address@hidden>
============================================================
--- testsuite.at	452e8fb6a61f93c811af62863cd201f36d3dc39c
+++ testsuite.at	3b0beb18b493ab5aac53fdec0411f8fdbec273cd
@@ -863,3 +863,4 @@
 m4_include(tests/t_serve_ignores_mt_options.at)
 m4_include(tests/t_netsync_notes.at)
 m4_include(tests/t_rosterify_on_rosterified_db.at)
+m4_include(tests/t_case_insensitive__MTN.at)