--- a/tests/test-pull-http.t	Tue Nov 22 18:16:59 2011 +0100
+++ b/tests/test-pull-http.t	Tue Nov 22 17:34:22 2011 -0600
@@ -13,13 +13,30 @@
   $ echo a >> a
   $ hg ci -mb
 
+Cloning with a password in the URL should not save the password in .hg/hgrc:
+
+  $ hg serve -p $HGPORT -d --pid-file=hg.pid -E errors.log
+  $ cat hg.pid >> $DAEMON_PIDS
+  $ hg clone http://foo:xyzzy@localhost:$HGPORT/ test3
+  requesting all changes
+  adding changesets
+  adding manifests
+  adding file changes
+  added 2 changesets with 2 changes to 1 files
+  updating to branch default
+  1 files updated, 0 files merged, 0 files removed, 0 files unresolved
+  $ cat test3/.hg/hgrc
+  [paths]
+  default = http://foo@localhost:$HGPORT/
+  $ "$TESTDIR/killdaemons.py"
+
 expect error, cloning not allowed
 
   $ echo '[web]' > .hg/hgrc
   $ echo 'allowpull = false' >> .hg/hgrc
   $ hg serve -p $HGPORT -d --pid-file=hg.pid -E errors.log
   $ cat hg.pid >> $DAEMON_PIDS
-  $ hg clone http://localhost:$HGPORT/ test3
+  $ hg clone http://localhost:$HGPORT/ test4
   requesting all changes
   abort: authorization failed
   [255]