+writefile("test.setup", "t/tmp", <<EOF
+# IkiWiki::Setup::Yaml - YAML formatted setup file
+wikiname: this is the name of my wiki
+srcdir: t/tmp/in
+destdir: t/tmp/out
+templatedir: templates
+url: "http://example.com/wiki/"
+cgiurl: "https://example.com/cgi-bin/ikiwiki.cgi"
+cgi_wrapper: t/tmp/ikiwiki.cgi
+cgi_wrappermode: 0754
+html5: 1
+# make it easier to test previewing
+add_plugins:
+- anonok
+anonok_pagespec: "*"
+ENV: { 'PERL5LIB': '$PERL5LIB' }
+EOF
+);
+
+ok(unlink("t/tmp/ikiwiki.cgi"));
+ok(! system("./ikiwiki.out --setup t/tmp/test.setup --rebuild --wrappers"));
+
+# CGI wrapper should be exactly the requested mode
+(undef, undef, $mode, undef, undef,
+ undef, undef, undef, undef, undef,
+ undef, undef, undef) = stat("t/tmp/ikiwiki.cgi");
+is($mode & 07777, 0754);
+
+ok(-e "t/tmp/out/a/b/c/index.html");
+$content = readfile("t/tmp/out/a/b/c/index.html");
+# no <base> on static HTML
+unlike($content, qr{<base\W});
+# url and cgiurl are on the same host but different schemes
+like($content, qr{<a[^>]+href="https://example.com/cgi-bin/ikiwiki.cgi\?do=prefs"});
+# cross-links between static pages are relative
+like($content, qr{<li>A: <a href="../../">a</a></li>});
+like($content, qr{<li>B: <a href="../">b</a></li>});
+like($content, qr{<li>E: <a href="../../d/e/">e</a></li>});
+
+# when accessed via HTTPS, links are secure (to avoid mixed-content)
+run(["./t/tmp/ikiwiki.cgi"], \undef, \$content, init => sub {
+ $ENV{REQUEST_METHOD} = 'GET';
+ $ENV{SERVER_PORT} = '443';
+ $ENV{SCRIPT_NAME} = '/cgi-bin/ikiwiki.cgi';
+ $ENV{QUERY_STRING} = 'do=prefs';
+ $ENV{HTTP_HOST} = 'example.com';
+ $ENV{HTTPS} = 'on';
+});
+%bits = parse_cgi_content($content);
+is($bits{basehref}, "/wiki/");
+is($bits{stylehref}, "/wiki/style.css");
+is($bits{tophref}, "/wiki/");
+like($bits{cgihref}, qr{^(?:(?:https:)?//example.com)?/cgi-bin/ikiwiki.cgi$});
+
+# when not accessed via HTTPS, ???
+run(["./t/tmp/ikiwiki.cgi"], \undef, \$content, init => sub {
+ $ENV{REQUEST_METHOD} = 'GET';
+ $ENV{SERVER_PORT} = '80';
+ $ENV{SCRIPT_NAME} = '/cgi-bin/ikiwiki.cgi';
+ $ENV{QUERY_STRING} = 'do=prefs';
+ $ENV{HTTP_HOST} = 'example.com';
+});
+%bits = parse_cgi_content($content);
+like($bits{basehref}, qr{^(?:https?://example.com)?/wiki/$});
+like($bits{stylehref}, qr{^(?:(?:https?:)?//example.com)?/wiki/style.css$});
+like($bits{tophref}, qr{^(?:(?:https?://example.com)?/wiki|\.)/$});
+like($bits{cgihref}, qr{^(?:(?:https:)?//example.com)?/cgi-bin/ikiwiki.cgi$});
+
+# when accessed via a different hostname, links stay on that host
+run(["./t/tmp/ikiwiki.cgi"], \undef, \$content, init => sub {
+ $ENV{REQUEST_METHOD} = 'GET';
+ $ENV{SERVER_PORT} = '443';
+ $ENV{SCRIPT_NAME} = '/cgi-bin/ikiwiki.cgi';
+ $ENV{QUERY_STRING} = 'do=prefs';
+ $ENV{HTTP_HOST} = 'staging.example.net';
+ $ENV{HTTPS} = 'on';
+});
+%bits = parse_cgi_content($content);
+# because the static and dynamic stuff is on the same server, we assume that
+# both are also on the staging server
+is($bits{basehref}, "/wiki/");
+is($bits{stylehref}, "/wiki/style.css");
+like($bits{tophref}, qr{^(?:/wiki|\.)/$});
+like($bits{cgihref}, qr{^(?:(?:https:)?//(?:example\.com|staging\.example\.net))?/cgi-bin/ikiwiki.cgi$});
+TODO: {
+local $TODO = "this should really point back to itself but currently points to example.com";
+like($bits{cgihref}, qr{^(?:(?:https:)?//staging.example.net)?/cgi-bin/ikiwiki.cgi$});
+}
+
+# previewing a page
+$in = 'do=edit&page=a/b/c&Preview';
+run(["./t/tmp/ikiwiki.cgi"], \$in, \$content, init => sub {
+ $ENV{REQUEST_METHOD} = 'POST';
+ $ENV{SERVER_PORT} = '443';
+ $ENV{SCRIPT_NAME} = '/cgi-bin/ikiwiki.cgi';
+ $ENV{HTTP_HOST} = 'example.com';
+ $ENV{CONTENT_LENGTH} = length $in;
+ $ENV{HTTPS} = 'on';
+});
+%bits = parse_cgi_content($content);
+is($bits{basehref}, "/wiki/a/b/c/");
+is($bits{stylehref}, "/wiki/style.css");
+like($bits{tophref}, qr{^(?:/wiki|\.\./\.\./\.\.)/$});
+like($bits{cgihref}, qr{^(?:(?:https:)?//example.com)?/cgi-bin/ikiwiki.cgi$});
+