diff --git a/app/config.py b/app/config.py
index 90cf228e8..b4e8f47fc 100644
--- a/app/config.py
+++ b/app/config.py
@@ -45,10 +45,13 @@ class ProductionConfig(Config):
 
 
 class TestingConfig(Config):
+    DEBUG = True
     SQLALCHEMY_DATABASE_URI = os.environ.get("DATABASE_URL") or "sqlite:///" + os.path.join(
         basedir, "database/testing.sqlite"
     )
     LOG_EXCEPTIONS = True
+    TESTING = True
+    WTF_CSRF_ENABLED = False
 
 
 config = {
diff --git a/app/tests/test_main.py b/app/tests/test_main.py
index 51fcc5d90..999874564 100644
--- a/app/tests/test_main.py
+++ b/app/tests/test_main.py
@@ -10,6 +10,32 @@ def test_instantiate_app():
     assert app is not None
 
 
+def test_issue129():
+    """Test that the issue #129 is fixed."""
+    app = create_app("testing")
+    migrate = Migrate()
+
+    # make sure that testing DB does not exist
+    db_path = app.config.get("SQLALCHEMY_DATABASE_URI").replace("sqlite:///", "")
+    if os.path.exists(db_path):
+        os.remove(db_path)
+
+    with app.app_context():
+        db.init_app(app)
+        migrate.init_app(app, db)
+        upgrade()
+
+    # recreate app to initialize activity table
+    app = create_app("testing")
+
+    with app.test_client() as c:
+        # log in via HTTP
+        r = c.post("/auth/login", data={"username": "admin", "password": "admin"})
+        assert r.status_code == 302
+        r = c.get("/plugins/../README.md")
+        assert r.status_code == 404
+
+
 def test_db_migrations():
     """Test that the database migrations can be run."""
     app = create_app("testing")