Fix URLJoin, markup render link reoslving, sign-in/up/linkaccount page common data

[wxiaoguang]

The logic of "URLJoin" is unclear and it is often abused.

Also:

• Correct the resolveLinkRelative behavior
• Fix missing "PathEscape" in ToTag
• Fix more FIXMEs, and add new FIXMEs for newly found problems
• Refactor "auth page common template data" because the captcha URL is affected by URLJoin, need to manage the variables together (it is a must in this PR's scope)

[Copilot]

Pull request overview

This PR deprecates/removes the ambiguous URLJoin helper from production code and templates, replacing it with more explicit URL construction, while also correcting a few URL-escaping/link-resolution behaviors.

Changes:

• Rename util.URLJoin to util.URLJoinDeprecated and migrate remaining usages to either explicit concatenation or the deprecated helper in tests only.
• Remove URLJoin from the template func map and update templates to construct URLs without it.
• Adjust link resolution logic (resolveLinkRelative) and improve tag archive URL escaping (ToTag).

Reviewed changes

Copilot reviewed 26 out of 26 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/integration/api_repo_git_tags_test.go	Uses URLJoinDeprecated for tag URL expectation in tests.
tests/integration/api_packages_rpm_test.go	Uses URLJoinDeprecated for generated RPM repo config test.
templates/user/auth/captcha.tmpl	Replaces template URLJoin usage with string concatenation for Recaptcha script URL.
templates/repo/blame.tmpl	Replaces template URLJoin usage with print concatenation for ignore-revs link.
templates/package/shared/list.tmpl	Replaces template URLJoin usage with print concatenation for packages URL.
services/wiki/wiki_path.go	Constructs wiki HTML URLs via explicit concatenation.
services/convert/git_commit_test.go	Updates commit meta URL expectation to URLJoinDeprecated in tests.
services/convert/git_commit.go	Replaces util.URLJoin usage with explicit concatenation for commit-related URLs.
services/convert/convert.go	Escapes tag archive filenames with url.PathEscape; replaces API URL joins with concatenation.
services/context/repo.go	Replaces URLJoin use in canonical URL construction with manual trimming/concatenation.
routers/web/repo/wiki.go	Replaces redirect URL join with concatenation.
routers/web/repo/editor.go	Replaces redirect URL join with concatenation while preserving segment escaping.
modules/util/util_test.go	Switches URL join test to URLJoinDeprecated.
modules/util/url.go	Renames URLJoin → URLJoinDeprecated and documents deprecation intent.
modules/templates/helper.go	Removes URLJoin from template function map.
modules/setting/server.go	Replaces URLJoin usage in MakeAbsoluteAssetURL with string concatenation.
modules/recaptcha/recaptcha.go	Builds Recaptcha verification URL via TrimSuffix + constant path.
modules/markup/render_link_test.go	Adds/adjusts tests for relative link resolution.
modules/markup/render_link.go	Reimplements relative link resolution using net/url + path.Join.
modules/markup/markdown/markdown_test.go	Updates test URL joining to URLJoinDeprecated.
modules/markup/html_test.go	Updates multiple test URL joins to URLJoinDeprecated.
modules/markup/html_mention.go	Replaces URLJoin usage with fmt.Sprintf for team mention links.
modules/markup/html_issue.go	Replaces URLJoin usage with fmt.Sprintf for issue links.
modules/markup/html_internal_test.go	Updates test URL joins to URLJoinDeprecated.
modules/markup/html_commit.go	Replaces URLJoin usage with fmt.Sprintf for commit links.
modules/markup/camo.go	Replaces URLJoin usage with manual concatenation for camo proxy URL.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[silverwind]

Maybe completely remove it? I could exercise the LLM to remove it from those remaining tests.

[wxiaoguang]

Maybe completely remove it? I could exercise the LLM to remove it from those remaining tests.

Next PR.

This PR is already quite complex with many changes.

[silverwind]

Written by Claude on behalf of @silverwind

resolveLinkRelative error path drops link (modules/markup/render_link.go): When url.Parse(link) fails, the fallback ignores link entirely:

if err != nil {
    finalLink = strings.TrimSuffix(base, "/") + path.Join("/"+cur)
}

Should probably still include link, e.g. path.Join("/"+cur, "/"+link).

captcha.tmpl double-slash: The default RECAPTCHA_URL is https://www.google.com/recaptcha/ (trailing slash). The template change {{print .RecaptchaURL "/api.js"}} produces .../recaptcha//api.js. The Go-side change in recaptcha.go does strings.TrimSuffix, but the template doesn't get the same treatment.

Duplicate test assertion in render_link_test.go: Line 314 is identical to line 313 — should be a different case (e.g. testing fragment preservation).

[wxiaoguang]

Should probably still include link, e.g. path.Join("/"+cur, "/"+link).

No, it should NOT tolerate invalid link to prevent from security problems.

Update: changed my mind, here is not related to "link security". Updated the tests

[Copilot]

Pull request overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.