fix(oauth): Error on auth sources with spaces#37327
Merged
wxiaoguang merged 6 commits intogo-gitea:mainfrom Apr 21, 2026
Merged
fix(oauth): Error on auth sources with spaces#37327wxiaoguang merged 6 commits intogo-gitea:mainfrom
wxiaoguang merged 6 commits intogo-gitea:mainfrom
Conversation
In pull request go-gitea#36901, a change is made so that the link to authentication sources is now escaped with the QueryEscape filter. https://github.com/go-gitea/gitea/pull/36901/changes#diff-34c39c9736a8b62e293c0c0b24c4b5b8c1c792790018c5809f9ff2cbc12b16b1R4 The problem is that QueryEscape replace spaces with the `+` character, and this is not unescaped when a user tries to login with an authentication source that contains a space, which throws an error at routers/web/auth/oauth.go:42 saying that the "oauth2 source not found" This commit fixes that by unescaping the provider name in the URL. Signed-off-by: prettysunflower <me@prettysunflower.moe>
wxiaoguang
reviewed
Apr 21, 2026
wxiaoguang
approved these changes
Apr 21, 2026
Member
|
A test would be nice. |
…ontaining spaces redirects to the authorization URL Signed-off-by: prettysunflower <me@prettysunflower.moe>
Contributor
Author
Ah, yes, forgot about that, sorry >~<. I added one... |
silverwind
approved these changes
Apr 21, 2026
silverwind
added a commit
that referenced
this pull request
Apr 21, 2026
Backport #37327 by @prettysunflower Nyallo~ In pull request #36901, a change is made so that the link to authentication sources is now escaped with the QueryEscape filter. https://github.com/go-gitea/gitea/pull/36901/changes#diff-34c39c9736a8b62e293c0c0b24c4b5b8c1c792790018c5809f9ff2cbc12b16b1R4 The problem is that [QueryEscape replace spaces with the `+` character](https://cs.opensource.google/go/go/+/refs/tags/go1.26.2:src/net/url/url.go;l=234;drc=917949cc1d16c652cb09ba369718f45e5d814d8f), and this is not unescaped when a user tries to log in with an authentication source that contains a space, which throws an error. This commit fixes that by unescaping the provider name in the URL. --- Example of the error, on my instance, when I try to log in with `prettysunflower's auth` ``` 2026/04/21 00:11:41 routers/web/auth/oauth.go:42:SignInOAuth() [E] SignIn: oauth2 source not found, name: "prettysunflower's+auth" /go/src/code.gitea.io/gitea/routers/web/auth/oauth.go:42 (0x2cfa5c5) /usr/local/go/src/reflect/value.go:586 (0x51e245) /usr/local/go/src/reflect/value.go:369 (0x51d0f8) /go/src/code.gitea.io/gitea/modules/web/handler.go:181 (0x1a6aaf6) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/src/code.gitea.io/gitea/modules/web/handler.go:188 (0x1a6ab65) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/src/code.gitea.io/gitea/modules/web/handler.go:188 (0x1a6ab65) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/src/code.gitea.io/gitea/modules/web/handler.go:188 (0x1a6ab65) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/src/code.gitea.io/gitea/services/context/context.go:217 (0x2df1b23) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/pkg/mod/gitea.com/go-chi/session@v0.0.0-20251124165456-68e0254e989e/session.go:258 (0x197eb82) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/chain.go:31 (0x1a61d05) /go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:479 (0x1a64fae) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:73 (0x1a628c2) /go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:321 (0x1a6421a) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/chain.go:31 (0x1a61d05) /go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:479 (0x1a64fae) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/middleware/get_head.go:37 (0x2c33a67) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:73 (0x1a628c2) /go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:321 (0x1a6421a) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/src/code.gitea.io/gitea/routers/common/maintenancemode.go:50 (0x2b752da) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/chain.go:31 (0x1a61d05) /go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:479 (0x1a64fae) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/src/code.gitea.io/gitea/modules/web/routing/logger_manager.go:124 (0x127d1ec) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/pkg/mod/github.com/chi-middleware/proxy@v1.1.1/middleware.go:37 (0x2b76acf) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/src/code.gitea.io/gitea/routers/common/middleware.go:89 (0x2b78cd6) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/src/code.gitea.io/gitea/routers/common/middleware.go:104 (0x2b7890f) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/src/code.gitea.io/gitea/modules/web/handler.go:145 (0x1a6afb5) /usr/local/go/src/net/http/server.go:2286 (0x94dc88) /go/pkg/mod/github.com/go-chi/chi/v5@v5.2.5/mux.go:90 (0x1a62881) /go/src/code.gitea.io/gitea/modules/web/router.go:286 (0x1a6d2a2) /go/src/code.gitea.io/gitea/modules/web/router.go:221 (0x1a6cbc6) /usr/local/go/src/net/http/server.go:3311 (0x96e36d) /usr/local/go/src/net/http/server.go:2073 (0x94bd6f) /usr/local/go/src/runtime/asm_amd64.s:1771 (0x49af20) ``` Signed-off-by: prettysunflower <me@prettysunflower.moe> Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: prettysunflower <me@prettysunflower.moe> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io>
silverwind
added a commit
to 6543-forks/gitea
that referenced
this pull request
Apr 21, 2026
…n-better * origin/main: (645 commits) When the requested arch rpm is missing fall back to noarch (go-gitea#37236) Fix `relative-time` error and improve global error handler (go-gitea#37241) Enhance styling in actions page (go-gitea#37323) fix(oauth): Error on auth sources with spaces (go-gitea#37327) Fix actions concurrency groups cross-branch leak (go-gitea#37311) Fix bug when accessing user badges (go-gitea#37321) Fix AppFullLink (go-gitea#37325) Update go js dependencies (go-gitea#37312) Update GitHub Actions to latest major versions (go-gitea#37313) Revert "Add WebKit to e2e test matrix (go-gitea#37298)" (go-gitea#37315) Add `form-fetch-action` to some forms, fix "fetch action" resp bug (go-gitea#37305) Move heatmap to first-party code (go-gitea#37262) Use updated yaml fields for snapcraft (go-gitea#37318) Remove dead code identified by `deadcode` tool (go-gitea#37271) Enable strict TypeScript, add `errorMessage` helper (go-gitea#37292) Fix vite manifest update masking build errors (go-gitea#37279) bump snapcraft base (go-gitea#37301) Add WebKit to e2e test matrix (go-gitea#37298) Don't add useless labels which will bother changelog generation (go-gitea#37267) Fix Repository transferring page (go-gitea#37277) ... # Conflicts: # options/locale/locale_en-US.ini # templates/package/content/debian.tmpl
wxiaoguang
added a commit
that referenced
this pull request
Apr 21, 2026
Follow up #37327. See the comments. * Root problem: the design of OAuth2 providers is a mess, the display name is used as provider's name and used in the URL directly * The regressions: * When trying to fix #36409 , it introduced inconsistent URL escaping for the "path" part. * This fix: always use "path escaping" for the path part, add more tests to cover all escaping cases. Now, frontend "pathEscape" and "pathEscapeSegments" generate exactly the same result as backend.
zjjhot
added a commit
to zjjhot/gitea
that referenced
this pull request
Apr 22, 2026
* main: (25 commits) Add URL to `Learn more about blocking a user` (go-gitea#37355) fix: use TriggerEvent instead of Event in workflow runs API response for scheduled runs (go-gitea#37288) Add event.schedule context for schedule actions task (go-gitea#37320) Fix typos (go-gitea#37346) Fix an issue where changing an organization’s visibility caused problems when users had forked its repositories. (go-gitea#37324) Fail vite build on rolldown warnings via NODE_ENV=test (go-gitea#37270) Use modern "git update-index --cacheinfo" syntax to support more file names (go-gitea#37338) Fix URL related escaping for oauth2 (go-gitea#37334) When the requested arch rpm is missing fall back to noarch (go-gitea#37236) Fix `relative-time` error and improve global error handler (go-gitea#37241) Enhance styling in actions page (go-gitea#37323) fix(oauth): Error on auth sources with spaces (go-gitea#37327) Fix actions concurrency groups cross-branch leak (go-gitea#37311) Fix bug when accessing user badges (go-gitea#37321) Fix AppFullLink (go-gitea#37325) Update go js dependencies (go-gitea#37312) Update GitHub Actions to latest major versions (go-gitea#37313) Revert "Add WebKit to e2e test matrix (go-gitea#37298)" (go-gitea#37315) Add `form-fetch-action` to some forms, fix "fetch action" resp bug (go-gitea#37305) Move heatmap to first-party code (go-gitea#37262) ...
silverwind
added a commit
to silverwind/gitea
that referenced
this pull request
Apr 23, 2026
* origin/main: (32 commits) fix: commit status reporting (go-gitea#37372) Support for Custom URI Schemes in OAuth2 Redirect URIs (go-gitea#37356) Fix cmd tests by mocking builtin paths (go-gitea#37369) chore: upgrade Go version in devcontainer image to 1.26 (go-gitea#37374) Fix button layout shift when collapsing file tree in editor (go-gitea#37363) Update `Block a user` form (go-gitea#37359) Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (go-gitea#37364) Add URL to `Learn more about blocking a user` (go-gitea#37355) fix: use TriggerEvent instead of Event in workflow runs API response for scheduled runs (go-gitea#37288) Add event.schedule context for schedule actions task (go-gitea#37320) Fix typos (go-gitea#37346) Fix an issue where changing an organization’s visibility caused problems when users had forked its repositories. (go-gitea#37324) Fail vite build on rolldown warnings via NODE_ENV=test (go-gitea#37270) Use modern "git update-index --cacheinfo" syntax to support more file names (go-gitea#37338) Fix URL related escaping for oauth2 (go-gitea#37334) When the requested arch rpm is missing fall back to noarch (go-gitea#37236) Fix `relative-time` error and improve global error handler (go-gitea#37241) Enhance styling in actions page (go-gitea#37323) fix(oauth): Error on auth sources with spaces (go-gitea#37327) Fix actions concurrency groups cross-branch leak (go-gitea#37311) ... # Conflicts: # services/actions/commit_status.go
silverwind
added a commit
to silverwind/gitea
that referenced
this pull request
Apr 23, 2026
* origin/main: (204 commits) fix: commit status reporting (go-gitea#37372) Support for Custom URI Schemes in OAuth2 Redirect URIs (go-gitea#37356) Fix cmd tests by mocking builtin paths (go-gitea#37369) chore: upgrade Go version in devcontainer image to 1.26 (go-gitea#37374) Fix button layout shift when collapsing file tree in editor (go-gitea#37363) Update `Block a user` form (go-gitea#37359) Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (go-gitea#37364) Add URL to `Learn more about blocking a user` (go-gitea#37355) fix: use TriggerEvent instead of Event in workflow runs API response for scheduled runs (go-gitea#37288) Add event.schedule context for schedule actions task (go-gitea#37320) Fix typos (go-gitea#37346) Fix an issue where changing an organization’s visibility caused problems when users had forked its repositories. (go-gitea#37324) Fail vite build on rolldown warnings via NODE_ENV=test (go-gitea#37270) Use modern "git update-index --cacheinfo" syntax to support more file names (go-gitea#37338) Fix URL related escaping for oauth2 (go-gitea#37334) When the requested arch rpm is missing fall back to noarch (go-gitea#37236) Fix `relative-time` error and improve global error handler (go-gitea#37241) Enhance styling in actions page (go-gitea#37323) fix(oauth): Error on auth sources with spaces (go-gitea#37327) Fix actions concurrency groups cross-branch leak (go-gitea#37311) ... # Conflicts: # web_src/js/index-domready.ts # web_src/js/markup/content.ts # web_src/js/markup/refissue.ts
silverwind
added a commit
to silverwind/gitea
that referenced
this pull request
Apr 23, 2026
* origin/main: (204 commits) fix: commit status reporting (go-gitea#37372) Support for Custom URI Schemes in OAuth2 Redirect URIs (go-gitea#37356) Fix cmd tests by mocking builtin paths (go-gitea#37369) chore: upgrade Go version in devcontainer image to 1.26 (go-gitea#37374) Fix button layout shift when collapsing file tree in editor (go-gitea#37363) Update `Block a user` form (go-gitea#37359) Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (go-gitea#37364) Add URL to `Learn more about blocking a user` (go-gitea#37355) fix: use TriggerEvent instead of Event in workflow runs API response for scheduled runs (go-gitea#37288) Add event.schedule context for schedule actions task (go-gitea#37320) Fix typos (go-gitea#37346) Fix an issue where changing an organization’s visibility caused problems when users had forked its repositories. (go-gitea#37324) Fail vite build on rolldown warnings via NODE_ENV=test (go-gitea#37270) Use modern "git update-index --cacheinfo" syntax to support more file names (go-gitea#37338) Fix URL related escaping for oauth2 (go-gitea#37334) When the requested arch rpm is missing fall back to noarch (go-gitea#37236) Fix `relative-time` error and improve global error handler (go-gitea#37241) Enhance styling in actions page (go-gitea#37323) fix(oauth): Error on auth sources with spaces (go-gitea#37327) Fix actions concurrency groups cross-branch leak (go-gitea#37311) ... Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com> # Conflicts: # web_src/js/index-domready.ts # web_src/js/markup/content.ts # web_src/js/markup/refissue.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Nyallo~
In pull request #36901, a change is made so that the link to authentication sources is now escaped with the QueryEscape filter. https://github.com/go-gitea/gitea/pull/36901/changes#diff-34c39c9736a8b62e293c0c0b24c4b5b8c1c792790018c5809f9ff2cbc12b16b1R4
The problem is that QueryEscape replace spaces with the
+character, and this is not unescaped when a user tries to log in with an authentication source that contains a space, which throws an error.This commit fixes that by unescaping the provider name in the URL.
Example of the error, on my instance, when I try to log in with
prettysunflower's auth