OAuth2 Application redirect URL with https, but it becomes contains some 'redirect' query params in url.

[mei-rune]

Description

my request url is http://127.0.0.1/xxxxx/oauth/login_callback?redirect=http%3a%2f%2f127.0.0.1%2flogin

my validate url in gitea is "http://127.0.0.1/xxxxx/oauth/login_callback"

I fix it with :

diff --git a/models/auth/oauth2.go b/models/auth/oauth2.go
index 01ec23a5a..8976bbc3d 100644
--- a/models/auth/oauth2.go
+++ b/models/auth/oauth2.go
@@ -54,6 +54,10 @@ func (app *OAuth2Application) TableName() string {
 // ContainsRedirectURI checks if redirectURI is allowed for app
 func (app *OAuth2Application) ContainsRedirectURI(redirectURI string) bool {
        contains := func(s string) bool {
+               if idx := strings.Index(s, "?"); idx > 0 {
+                       s = s[:idx]
+               }
+
                s = strings.TrimSuffix(strings.ToLower(s), "/")
                for _, u := range app.RedirectURIs {
                        if strings.TrimSuffix(strings.ToLower(u), "/") == s {

Gitea Version

1.20.0

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

Git Version

No response

Operating System

No response

How are you running Gitea?

run it as service in the windows

Database

SQLite

[OctopusET]

Try <your-hostname>/user/oauth2/<name-of-client>/callback instead

[mei-rune]

Try <your-hostname>/user/oauth2/<name-of-client>/callback instead

I know it, but i hope pass a argument 'redirect'

[lunny]

Please send a PR.

[mei-rune]

I send a PR.