Create repo on push allows invalid names with slashes

[jimparis]

• Gitea version (or commit ref): 1.11.0+rc2-17-g0129e76ef
• Git version: 2.20.1
• Operating system: Debian
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No ("Push to create is not enabled for users." and "Push to create is not enabled for organizations.")
  • Not relevant
• Log gist:

Description

With ENABLE_PUSH_CREATE_USER, all of this works fine from the command line:

git init test
cd test
echo hi > README.md
git add README.md
git commit -m 'Initial commit'
git remote add origin git@git.example.com:jim/foo/bar/test.git
git push --set-upstream origin master     # this works
git pull     # this works
cd ..
git clone git@git.example.com:jim/foo/bar/test.git test2     # this works

And things look OK at first glance in the UI...

or

But clicking on the repo pops up a browser auth prompt:

followed by a page saying just "invalid credentials".

I don't even know how to delete this repo now. Related to #9175 I assume.

[jimparis]

Removing the repo from disk and the single corresponding row in the repositories table seems to have gotten rid of it cleanly.