Mail Collector: dropdownAuthorization.php AJAX call missing "/glpi" subfolder path when GLPI installed in a subdirectory

[RHmais-IM]

Code of Conduct

• I agree to follow this project's Code of Conduct

Is there an existing issue for this?

• I have searched the existing issues

GLPI Version

11.0.8

Plugin version

1.5.3

Bug description

When configuring a Mail Collector (Receiver) using an OAuth IMAP connection option,
selecting the OAuth authorization in the "Connection options" dropdown triggers an
AJAX POST request to dropdownAuthorization.php. On installations where GLPI runs
in a subdirectory (not domain root), this request is built with an incomplete/incorrect
path, resulting in a 404.

As a consequence, the "Login" field (email account associated with the OAuth
authorization) is never populated/displayed in the Mail Collector form, making it
impossible to properly configure the receiver.

Relevant log output

Page URL

No response

Steps To reproduce

1. Install and configure OAuth IMAP plugin with a valid Azure/Entra ID application
2. Create an OAuth authorization successfully (confirmed working — can browse mailbox,
   see message count via plugin diagnostics)
3. Go to Setup > Receivers > Add new
4. In "Connection options", select the OAuth authorization created in step 2
5. Open browser dev tools (Network/Console tab)

Your GLPI setup information

• GLPI version: 11.0.8
• Plugin version: OAuth IMAP 1.5.3
• Installation path: https://[domain]/glpi/ (GLPI installed in a subdirectory, not domain root)
• Hosting: shared hosting (cPanel), no SSH access
• PHP: 8.3

Anything else?

The "Login" field should be automatically populated with the email address associated
with the selected OAuth authorization (as shown in the plugin's own documentation
screenshots).

• Browser console shows a failed POST request:
  https://[domain]/plugins/oauthimap/ajax/dropdownAuthorization.php
  404 (Not Found)

• Note the URL is missing the GLPI subdirectory (/glpi/) — actual GLPI installation
  is at https://[domain]/glpi/, so the correct path would be
  https://[domain]/glpi/plugins/oauthimap/ajax/dropdownAuthorization.php

• Also note: the physical file exists under marketplace/oauthimap/ajax/dropdownAuthorization.php
  (not plugins/oauthimap/), consistent with GLPI's renamed plugin directory in recent versions.

• As a workaround test, I added an Apache rewrite rule at document root to redirect
  /plugins/oauthimap/(.*) to /glpi/marketplace/oauthimap/$1. This changed the error
  from 404 to 500 (Internal Server Error), suggesting the script itself has additional
  path-dependent assumptions that break when not accessed through its "natural" route/context.

• Because this AJAX call never succeeds, the "Login" field never appears in the Receiver
  form, blocking the Mail Collector configuration entirely.

Additional context

This appears to be a known/recurring issue — similar reports found in the GLPI forum
describing the exact same missing /glpi segment in AJAX calls generated by this plugin,
also on GLPI 11.x installations in a subdirectory. I could not find a resolved fix in
the latest available plugin version (1.5.3).

Happy to provide further logs/screenshots if useful.

[RHmais-IM]

Update: Root cause found + fix

I dug into the plugin code and found the exact source of the problem.

File: inc/mailcollectorfeature.class.php

The JavaScript generated by the plugin for the AJAX call uses a hardcoded absolute path:

'/plugins/oauthimap/ajax/dropdownAuthorization.php'

This assumes GLPI is installed at the domain root. On installations where GLPI lives
in a subdirectory (in my case /glpi/public), this results in a 404, since the request
is sent to https://[domain]/plugins/oauthimap/ajax/dropdownAuthorization.php instead
of the actual path https://[domain]/glpi/public/plugins/oauthimap/ajax/dropdownAuthorization.php.

Confirmed along the way:

• Plugin correctly installed via Marketplace
• OAuth authorization itself working (successful auth test, mailbox browsing works)
• dropdownAuthorization.php exists and is reachable when called with the correct path
• CFG_GLPI['root_doc'] is correctly set to /glpi/public

Fix applied

In inc/mailcollectorfeature.class.php, replaced:

'/plugins/oauthimap/ajax/dropdownAuthorization.php'

with:

CFG_GLPI['root_doc'] + '/plugins/oauthimap/ajax/dropdownAuthorization.php'

(Using GLPI's own root_doc config value instead of a hardcoded absolute path.)

Result

The AJAX call now correctly targets /glpi/public/plugins/oauthimap/ajax/dropdownAuthorization.php,
the OAuth authorization dropdown loads properly, and the Receiver (Mail Collector) is fully functional.

Environment for reference

• GLPI 11.0.8
• OAuth IMAP plugin 1.5.3
• GLPI installed in a subdirectory (/glpi/public), not domain root
• Shared hosting (cPanel)

This confirms the plugin assumes a domain-root installation and doesn't account for
subdirectory installs when generating this specific AJAX URL. Hope this helps anyone
else hitting the same issue, and hopefully useful for a permanent fix upstream — happy
to open a PR if that's preferred over a plain code suggestion here.

[stonebuzz]

Hello,

Thank you for your feedback.

Of course! You are more than welcome to submit a pull request. We are always happy to receive contributions from the community and greatly appreciate your help.

We would be delighted to review your PR and provide feedback.

Kind regards,