Skip to content

fix(oauth): Error on auth sources with spaces#37327

Merged
wxiaoguang merged 6 commits into
go-gitea:mainfrom
prettysunflower:main
Apr 21, 2026
Merged

fix(oauth): Error on auth sources with spaces#37327
wxiaoguang merged 6 commits into
go-gitea:mainfrom
prettysunflower:main

Conversation

@prettysunflower
Copy link
Copy Markdown
Contributor

@prettysunflower prettysunflower commented Apr 21, 2026

Nyallo~

In pull request #36901, a change is made so that the link to authentication sources is now escaped with the QueryEscape filter. https://github.com/go-gitea/gitea/pull/36901/changes#diff-34c39c9736a8b62e293c0c0b24c4b5b8c1c792790018c5809f9ff2cbc12b16b1R4

The problem is that QueryEscape replace spaces with the + character, and this is not unescaped when a user tries to log in with an authentication source that contains a space, which throws an error.

This commit fixes that by unescaping the provider name in the URL.

Example of the error, on my instance, when I try to log in with prettysunflower's auth

2026/04/21 00:11:41 routers/web/auth/oauth.go:42:SignInOAuth() [E] SignIn: oauth2 source not found, name: "prettysunflower's+auth"
	/go/src/code.gitea.io/gitea/routers/web/auth/oauth.go:42 (0x2cfa5c5)
	/usr/local/go/src/reflect/value.go:586 (0x51e245)
	/usr/local/go/src/reflect/value.go:369 (0x51d0f8)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:181 (0x1a6aaf6)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:188 (0x1a6ab65)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:188 (0x1a6ab65)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:188 (0x1a6ab65)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/services/context/context.go:217 (0x2df1b23)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/pkg/mod/gitea.com/go-chi/session@v0.0.0-20251124165456-68e0254e989e/session.go:258 (0x197eb82)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/chain.go:31 (0x1a61d05)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:479 (0x1a64fae)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:73 (0x1a628c2)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:321 (0x1a6421a)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/chain.go:31 (0x1a61d05)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:479 (0x1a64fae)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/middleware/get_head.go:37 (0x2c33a67)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:73 (0x1a628c2)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:321 (0x1a6421a)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/routers/common/maintenancemode.go:50 (0x2b752da)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/chain.go:31 (0x1a61d05)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:479 (0x1a64fae)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/routing/logger_manager.go:124 (0x127d1ec)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/pkg/mod/github.com/chi-middleware/proxy@v1.1.1/middleware.go:37 (0x2b76acf)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/routers/common/middleware.go:89 (0x2b78cd6)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/routers/common/middleware.go:104 (0x2b7890f)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:90 (0x1a62881)
	/go/src/code.gitea.io/gitea/modules/web/router.go:286 (0x1a6d2a2)
	/go/src/code.gitea.io/gitea/modules/web/router.go:221 (0x1a6cbc6)
	/usr/local/go/src/net/http/server.go:3311 (0x96e36d)
	/usr/local/go/src/net/http/server.go:2073 (0x94bd6f)
	/usr/local/go/src/runtime/asm_amd64.s:1771 (0x49af20)

@prettysunflower
fix(oauth): Error on auth sources with spaces
5b0fc52 
In pull request go-gitea#36901, a change is made so that the link to authentication sources is now escaped with the QueryEscape filter.
https://github.com/go-gitea/gitea/pull/36901/changes#diff-34c39c9736a8b62e293c0c0b24c4b5b8c1c792790018c5809f9ff2cbc12b16b1R4

The problem is that QueryEscape replace spaces with the `+` character, and this is not unescaped when a user tries to login
with an authentication source that contains a space, which throws an error at routers/web/auth/oauth.go:42 saying that the
"oauth2 source not found"

This commit fixes that by unescaping the provider name in the URL.

Signed-off-by: prettysunflower <me@prettysunflower.moe>
@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Apr 21, 2026
wxiaoguang
wxiaoguang reviewed Apr 21, 2026
View reviewed changes
Comment thread routers/web/auth/oauth.go Outdated
@wxiaoguang
fix
59d8ecf 
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Apr 21, 2026
@wxiaoguang wxiaoguang added backport/v1.26 This PR should be backported to Gitea 1.26 type/bug labels Apr 21, 2026
@silverwind
Copy link
Copy Markdown
Member

silverwind commented Apr 21, 2026

A test would be nice.

@prettysunflower
tests(oauth): Added a test to check that OAuth providers with names c…
af9a44c 
…ontaining spaces redirects to the authorization URL

Signed-off-by: prettysunflower <me@prettysunflower.moe>
@prettysunflower
Copy link
Copy Markdown
Contributor Author

prettysunflower commented Apr 21, 2026

A test would be nice.

Ah, yes, forgot about that, sorry >~<. I added one...

@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Apr 21, 2026
@wxiaoguang wxiaoguang marked this pull request as draft April 21, 2026 02:04
@wxiaoguang wxiaoguang marked this pull request as ready for review April 21, 2026 02:13
@wxiaoguang wxiaoguang enabled auto-merge (squash) April 21, 2026 02:14
@lunny lunny added the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Apr 21, 2026
@wxiaoguang wxiaoguang merged commit 63db597 into go-gitea:main Apr 21, 2026
27 of 32 checks passed
@GiteaBot GiteaBot added this to the 1.27.0 milestone Apr 21, 2026
@GiteaBot GiteaBot removed the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Apr 21, 2026
@GiteaBot GiteaBot mentioned this pull request Apr 21, 2026
Merged
@GiteaBot GiteaBot added the backport/done All backports for this PR have been created label Apr 21, 2026
@wxiaoguang wxiaoguang mentioned this pull request Apr 21, 2026
Merged
silverwind added a commit that referenced this pull request Apr 21, 2026
@GiteaBot @prettysunflower
@wxiaoguang @silverwind
fix(oauth): Error on auth sources with spaces (#37327) (#37332)
ef096b0 
Backport #37327 by @prettysunflower

Nyallo~

In pull request #36901, a change is made so that the link to
authentication sources is now escaped with the QueryEscape filter.
https://github.com/go-gitea/gitea/pull/36901/changes#diff-34c39c9736a8b62e293c0c0b24c4b5b8c1c792790018c5809f9ff2cbc12b16b1R4

The problem is that [QueryEscape replace spaces with the `+`
character](https://cs.opensource.google/go/go/+/refs/tags/go1.26.2:src/net/url/url.go;l=234;drc=917949cc1d16c652cb09ba369718f45e5d814d8f),
and this is not unescaped when a user tries to log in with an
authentication source that contains a space, which throws an error.

This commit fixes that by unescaping the provider name in the URL.

---

Example of the error, on my instance, when I try to log in with
`prettysunflower's auth`
```
2026/04/21 00:11:41 routers/web/auth/oauth.go:42:SignInOAuth() [E] SignIn: oauth2 source not found, name: "prettysunflower's+auth"
	/go/src/code.gitea.io/gitea/routers/web/auth/oauth.go:42 (0x2cfa5c5)
	/usr/local/go/src/reflect/value.go:586 (0x51e245)
	/usr/local/go/src/reflect/value.go:369 (0x51d0f8)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:181 (0x1a6aaf6)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:188 (0x1a6ab65)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:188 (0x1a6ab65)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:188 (0x1a6ab65)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/services/context/context.go:217 (0x2df1b23)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/pkg/mod/gitea.com/go-chi/session@v0.0.0-20251124165456-68e0254e989e/session.go:258 (0x197eb82)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/chain.go:31 (0x1a61d05)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:479 (0x1a64fae)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:73 (0x1a628c2)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:321 (0x1a6421a)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/chain.go:31 (0x1a61d05)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:479 (0x1a64fae)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/middleware/get_head.go:37 (0x2c33a67)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:73 (0x1a628c2)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:321 (0x1a6421a)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/routers/common/maintenancemode.go:50 (0x2b752da)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/chain.go:31 (0x1a61d05)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:479 (0x1a64fae)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/routing/logger_manager.go:124 (0x127d1ec)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/pkg/mod/github.com/chi-middleware/proxy@v1.1.1/middleware.go:37 (0x2b76acf)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/routers/common/middleware.go:89 (0x2b78cd6)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/routers/common/middleware.go:104 (0x2b7890f)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5)
	/usr/local/go/src/net/http/server.go:2286 (0x94dc88)
	/go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:90 (0x1a62881)
	/go/src/code.gitea.io/gitea/modules/web/router.go:286 (0x1a6d2a2)
	/go/src/code.gitea.io/gitea/modules/web/router.go:221 (0x1a6cbc6)
	/usr/local/go/src/net/http/server.go:3311 (0x96e36d)
	/usr/local/go/src/net/http/server.go:2073 (0x94bd6f)
	/usr/local/go/src/runtime/asm_amd64.s:1771 (0x49af20)
```

Signed-off-by: prettysunflower <me@prettysunflower.moe>
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: prettysunflower <me@prettysunflower.moe>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
silverwind added a commit to 6543-forks/gitea that referenced this pull request Apr 21, 2026
@silverwind
Merge remote-tracking branch 'origin/main' into ux-package-deb-explai…
4d4ddf7 
…n-better

* origin/main: (645 commits)
  When the requested arch rpm is missing fall back to noarch (go-gitea#37236)
  Fix `relative-time` error and improve global error handler (go-gitea#37241)
  Enhance styling in actions page (go-gitea#37323)
  fix(oauth): Error on auth sources with spaces (go-gitea#37327)
  Fix actions concurrency groups cross-branch leak (go-gitea#37311)
  Fix bug when accessing user badges (go-gitea#37321)
  Fix AppFullLink (go-gitea#37325)
  Update go js dependencies (go-gitea#37312)
  Update GitHub Actions to latest major versions (go-gitea#37313)
  Revert "Add WebKit to e2e test matrix (go-gitea#37298)" (go-gitea#37315)
  Add `form-fetch-action` to some forms, fix "fetch action" resp bug (go-gitea#37305)
  Move heatmap to first-party code (go-gitea#37262)
  Use updated yaml fields for snapcraft (go-gitea#37318)
  Remove dead code identified by `deadcode` tool (go-gitea#37271)
  Enable strict TypeScript, add `errorMessage` helper (go-gitea#37292)
  Fix vite manifest update masking build errors (go-gitea#37279)
  bump snapcraft base (go-gitea#37301)
  Add WebKit to e2e test matrix (go-gitea#37298)
  Don't add useless labels which will bother changelog generation (go-gitea#37267)
  Fix Repository transferring page (go-gitea#37277)
  ...

# Conflicts:
#	options/locale/locale_en-US.ini
#	templates/package/content/debian.tmpl
wxiaoguang added a commit that referenced this pull request Apr 21, 2026
@wxiaoguang
Fix URL related escaping for oauth2 (#37334)
aee6628 
Follow up #37327. See the comments.

* Root problem: the design of OAuth2 providers is a mess, the display
name is used as provider's name and used in the URL directly
* The regressions:
* When trying to fix #36409 , it
introduced inconsistent URL escaping for the "path" part.
* This fix: always use "path escaping" for the path part, add more tests
to cover all escaping cases.

Now, frontend "pathEscape" and "pathEscapeSegments" generate exactly the
same result as backend.
@GiteaBot GiteaBot mentioned this pull request Apr 21, 2026
Merged
@wxiaoguang wxiaoguang added the skip-changelog This PR is irrelevant for the (next) changelog, for example bug fixes for unreleased features. label Apr 22, 2026
zjjhot added a commit to zjjhot/gitea that referenced this pull request Apr 22, 2026
@zjjhot
Merge branch 'main' into mainzjj
bfef37f 
* main: (25 commits)
  Add URL to `Learn more about blocking a user` (go-gitea#37355)
  fix: use TriggerEvent instead of Event in workflow runs API response for scheduled runs (go-gitea#37288)
  Add event.schedule context for schedule actions task (go-gitea#37320)
  Fix typos (go-gitea#37346)
  Fix an issue where changing an organization’s visibility caused problems when users had forked its repositories. (go-gitea#37324)
  Fail vite build on rolldown warnings via NODE_ENV=test (go-gitea#37270)
  Use modern "git update-index --cacheinfo" syntax to support more file names (go-gitea#37338)
  Fix URL related escaping for oauth2 (go-gitea#37334)
  When the requested arch rpm is missing fall back to noarch (go-gitea#37236)
  Fix `relative-time` error and improve global error handler (go-gitea#37241)
  Enhance styling in actions page (go-gitea#37323)
  fix(oauth): Error on auth sources with spaces (go-gitea#37327)
  Fix actions concurrency groups cross-branch leak (go-gitea#37311)
  Fix bug when accessing user badges (go-gitea#37321)
  Fix AppFullLink (go-gitea#37325)
  Update go js dependencies (go-gitea#37312)
  Update GitHub Actions to latest major versions (go-gitea#37313)
  Revert "Add WebKit to e2e test matrix (go-gitea#37298)" (go-gitea#37315)
  Add `form-fetch-action` to some forms, fix "fetch action" resp bug (go-gitea#37305)
  Move heatmap to first-party code (go-gitea#37262)
  ...
silverwind added a commit to silverwind/gitea that referenced this pull request Apr 23, 2026
@silverwind
Merge remote-tracking branch 'origin/main' into acticons
1f03083 
* origin/main: (32 commits)
  fix: commit status reporting (go-gitea#37372)
  Support for Custom URI Schemes in OAuth2 Redirect URIs (go-gitea#37356)
  Fix cmd tests by mocking builtin paths (go-gitea#37369)
  chore: upgrade Go version in devcontainer image to 1.26 (go-gitea#37374)
  Fix button layout shift when collapsing file tree in editor (go-gitea#37363)
  Update `Block a user` form (go-gitea#37359)
  Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (go-gitea#37364)
  Add URL to `Learn more about blocking a user` (go-gitea#37355)
  fix: use TriggerEvent instead of Event in workflow runs API response for scheduled runs (go-gitea#37288)
  Add event.schedule context for schedule actions task (go-gitea#37320)
  Fix typos (go-gitea#37346)
  Fix an issue where changing an organization’s visibility caused problems when users had forked its repositories. (go-gitea#37324)
  Fail vite build on rolldown warnings via NODE_ENV=test (go-gitea#37270)
  Use modern "git update-index --cacheinfo" syntax to support more file names (go-gitea#37338)
  Fix URL related escaping for oauth2 (go-gitea#37334)
  When the requested arch rpm is missing fall back to noarch (go-gitea#37236)
  Fix `relative-time` error and improve global error handler (go-gitea#37241)
  Enhance styling in actions page (go-gitea#37323)
  fix(oauth): Error on auth sources with spaces (go-gitea#37327)
  Fix actions concurrency groups cross-branch leak (go-gitea#37311)
  ...

# Conflicts:
#	services/actions/commit_status.go
silverwind added a commit to silverwind/gitea that referenced this pull request Apr 23, 2026
@silverwind
Merge remote-tracking branch 'origin/main' into refpop
d0e9881 
* origin/main: (204 commits)
  fix: commit status reporting (go-gitea#37372)
  Support for Custom URI Schemes in OAuth2 Redirect URIs (go-gitea#37356)
  Fix cmd tests by mocking builtin paths (go-gitea#37369)
  chore: upgrade Go version in devcontainer image to 1.26 (go-gitea#37374)
  Fix button layout shift when collapsing file tree in editor (go-gitea#37363)
  Update `Block a user` form (go-gitea#37359)
  Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (go-gitea#37364)
  Add URL to `Learn more about blocking a user` (go-gitea#37355)
  fix: use TriggerEvent instead of Event in workflow runs API response for scheduled runs (go-gitea#37288)
  Add event.schedule context for schedule actions task (go-gitea#37320)
  Fix typos (go-gitea#37346)
  Fix an issue where changing an organization’s visibility caused problems when users had forked its repositories. (go-gitea#37324)
  Fail vite build on rolldown warnings via NODE_ENV=test (go-gitea#37270)
  Use modern "git update-index --cacheinfo" syntax to support more file names (go-gitea#37338)
  Fix URL related escaping for oauth2 (go-gitea#37334)
  When the requested arch rpm is missing fall back to noarch (go-gitea#37236)
  Fix `relative-time` error and improve global error handler (go-gitea#37241)
  Enhance styling in actions page (go-gitea#37323)
  fix(oauth): Error on auth sources with spaces (go-gitea#37327)
  Fix actions concurrency groups cross-branch leak (go-gitea#37311)
  ...

# Conflicts:
#	web_src/js/index-domready.ts
#	web_src/js/markup/content.ts
#	web_src/js/markup/refissue.ts
silverwind added a commit to silverwind/gitea that referenced this pull request Apr 23, 2026
@silverwind
Merge remote-tracking branch 'origin/main' into refpop
8944b32 
* origin/main: (204 commits)
  fix: commit status reporting (go-gitea#37372)
  Support for Custom URI Schemes in OAuth2 Redirect URIs (go-gitea#37356)
  Fix cmd tests by mocking builtin paths (go-gitea#37369)
  chore: upgrade Go version in devcontainer image to 1.26 (go-gitea#37374)
  Fix button layout shift when collapsing file tree in editor (go-gitea#37363)
  Update `Block a user` form (go-gitea#37359)
  Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (go-gitea#37364)
  Add URL to `Learn more about blocking a user` (go-gitea#37355)
  fix: use TriggerEvent instead of Event in workflow runs API response for scheduled runs (go-gitea#37288)
  Add event.schedule context for schedule actions task (go-gitea#37320)
  Fix typos (go-gitea#37346)
  Fix an issue where changing an organization’s visibility caused problems when users had forked its repositories. (go-gitea#37324)
  Fail vite build on rolldown warnings via NODE_ENV=test (go-gitea#37270)
  Use modern "git update-index --cacheinfo" syntax to support more file names (go-gitea#37338)
  Fix URL related escaping for oauth2 (go-gitea#37334)
  When the requested arch rpm is missing fall back to noarch (go-gitea#37236)
  Fix `relative-time` error and improve global error handler (go-gitea#37241)
  Enhance styling in actions page (go-gitea#37323)
  fix(oauth): Error on auth sources with spaces (go-gitea#37327)
  Fix actions concurrency groups cross-branch leak (go-gitea#37311)
  ...

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>

# Conflicts:
#	web_src/js/index-domready.ts
#	web_src/js/markup/content.ts
#	web_src/js/markup/refissue.ts
AlexMikhalev pushed a commit to terraphim/gitea that referenced this pull request May 15, 2026
@prettysunflower @wxiaoguang @AlexMikhalev
fix(oauth): Error on auth sources with spaces (go-gitea#37327)
206119f 
The link to authentication sources is now escaped with the QueryEscape.
This commit fixes that by unescaping the provider name in the URL.

---------

Signed-off-by: prettysunflower <me@prettysunflower.moe>
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
(cherry picked from commit 63db597)
AlexMikhalev pushed a commit to terraphim/gitea that referenced this pull request May 15, 2026
@wxiaoguang
Fix URL related escaping for oauth2 (go-gitea#37334)
1901bb1 
Follow up go-gitea#37327. See the comments.

* Root problem: the design of OAuth2 providers is a mess, the display
name is used as provider's name and used in the URL directly
* The regressions:
* When trying to fix go-gitea#36409 , it
introduced inconsistent URL escaping for the "path" part.
* This fix: always use "path escaping" for the path part, add more tests
to cover all escaping cases.

Now, frontend "pathEscape" and "pathEscapeSegments" generate exactly the
same result as backend.
AlexMikhalev pushed a commit to terraphim/gitea that referenced this pull request May 15, 2026
[ferrox] docs(security): V-Model artefacts for go-gitea#34 -- all pic…
c1e7cc9 
…ks already on main

Phase 1/2/5 docs proving all four upstream commits cited in go-gitea#34 are
already present on main:

| Upstream  | PR     | Fork SHA   | Status                                  |
|-----------|--------|------------|-----------------------------------------|
| f3bdcc5 | go-gitea#36797 | 000f3ab | clean cherry-pick                      |
| 6ed8615 | go-gitea#37290 | ab62efe | manual surgical adaptation             |
| 63db597 | go-gitea#37327 | 206119f | clean cherry-pick                      |
| 6826321 | go-gitea#37354 | df7bb50 | clean cherry-pick (errpage residue)    |

Direct git show diff comparisons in .docs/validation-34.md confirm
semantic equivalence in every case. No new cherry-picks required.

Refs terraphim/gitea#34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@silverwind silverwind silverwind approved these changes

@wxiaoguang wxiaoguang wxiaoguang approved these changes

Assignees

No one assigned

Labels

backport/done All backports for this PR have been created backport/v1.26 This PR should be backported to Gitea 1.26 lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. skip-changelog This PR is irrelevant for the (next) changelog, for example bug fixes for unreleased features. type/bug

Projects

None yet

Milestone

1.27.0

Development

Successfully merging this pull request may close these issues.

5 participants

@prettysunflower @silverwind @wxiaoguang @lunny @GiteaBot