Fix URL related escaping for oauth2 (#37334)
Follow up #37327. See the comments. * Root problem: the design of OAuth2 providers is a mess, the display name is used as provider's name and used in the URL directly * The regressions: * When trying to fix https://github.com/go-gitea/gitea/issues/36409 , it introduced inconsistent URL escaping for the "path" part. * This fix: always use "path escaping" for the path part, add more tests to cover all escaping cases. Now, frontend "pathEscape" and "pathEscapeSegments" generate exactly the same result as backend.
This commit is contained in:
@@ -1,7 +1,6 @@
|
||||
<div id="external-login-navigator" class="tw-py-1 tw-flex tw-flex-col tw-gap-3">
|
||||
{{range $provider := .OAuth2Providers}}
|
||||
{{/* use QueryEscape for consistent with frontend urlQueryEscape, it is right for a path component */}}
|
||||
<a class="ui button external-login-link tw-gap-3" data-require-appurl-check="true" rel="nofollow" href="{{AppSubUrl}}/user/oauth2/{{$provider.DisplayName | QueryEscape}}">
|
||||
<a class="ui button external-login-link tw-gap-3" data-require-appurl-check="true" rel="nofollow" href="{{AppSubUrl}}/user/oauth2/{{$provider.DisplayName | PathEscape}}">
|
||||
{{$provider.IconHTML 24}} {{ctx.Locale.Tr "sign_in_with_provider" $provider.DisplayName}}
|
||||
</a>
|
||||
{{end}}
|
||||
|
||||
@@ -9,7 +9,7 @@
|
||||
<div class="menu">
|
||||
{{range $key := .OrderedOAuth2Names}}
|
||||
{{$provider := index $.OAuth2Providers $key}}
|
||||
<a class="item" href="{{AppSubUrl}}/user/oauth2/{{$key}}">
|
||||
<a class="item" href="{{AppSubUrl}}/user/oauth2/{{$key | PathEscape}}">
|
||||
{{$provider.IconHTML 20}}
|
||||
{{$provider.DisplayName}}
|
||||
</a>
|
||||
|
||||
Reference in New Issue
Block a user