Wrong OAuth2 Form target when running on modified root URL

[PeterNerlich]

• Gitea version (or commit ref): v1.9.4
• Git version: 2.22.0
• Operating system: gitea/gitea on Docker on Ubuntu 18.04.3 LTS
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No (because its root matches the server root)
  • Not relevant
• Log gist: https://gist.github.com/PeterNerlich/275d199733c38d2aee8a607b5d7bf84a

Description

I have set gitea up in docker behind a reverse proxy (Traefik). We are not given subdomains so we have to work with prefixes like /git/. When trying to integrate drone into our setup, granting authorization to it fails. I think I traced it down to the "grant or cancel" form action url leading to /login/oauth/grant instead of /git/login/oauth/grant. Manipulating the HTML and clicking the button then worked.

Screenshots

[lafriks]

Looking at code I don't see anything wrong, have you set ROOT_URL in app.ini right?

[h3kker]

I have the same problem (reported in #8466 which I closed now again). My config is

ROOT_URL = https://example.com/repo/

but the POST also goes to the base (https://example.com/login/oauth/grant)

I also noted this on the configuration page (e.g. https://example.com/repo/user/settings/applications/oauth2/1)

[ghost]

I'm also experiencing this on Drone. The URL redirect forgets the /git prefix
My config.ini file also shows:

ROOT_URL = https://git.domain.io/git

[zeripath]

The problem is here:

gitea/templates/user/auth/grant.tmpl

Line 19 in dbd9d8d

<form method="post" action="{{.AppSubUrl}}/login/oauth/grant">

If you change that line to:

gitea/templates/user/auth/grant.tmpl

Line 19 in e9ac23c

<form method="post" action="{{AppSubUrl}}/login/oauth/grant">

The problem should be fixed.

You can either wait for #8647 to be merged, or if you can't use 1.11 you should be able to make a custom version of the user/auth/grant.tmpl with this fix.