diff --git a/models/publickey.go b/models/publickey.go
index 35768b48..603ff364 100644
--- a/models/publickey.go
+++ b/models/publickey.go
@@ -161,7 +161,7 @@ func rewriteAuthorizedKeys(key *PublicKey, p, tmpP string) error {
 	}
 	defer fr.Close()
 
-	fw, err := os.Create(tmpP)
+	fw, err := os.OpenFile(tmpP, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)
 	if err != nil {
 		return err
 	}
diff --git a/modules/setting/setting.go b/modules/setting/setting.go
index 12989963..cb7734bb 100644
--- a/modules/setting/setting.go
+++ b/modules/setting/setting.go
@@ -182,6 +182,12 @@ func NewConfigContext() {
 		log.Fatal("Fail to get home directory: %v", err)
 	}
 	RepoRootPath = Cfg.MustValue("repository", "ROOT", filepath.Join(homeDir, "gogs-repositories"))
+	if !filepath.IsAbs(RepoRootPath) {
+		RepoRootPath = filepath.Join(workDir, RepoRootPath)
+	} else {
+		RepoRootPath = filepath.Clean(RepoRootPath)
+	}
+
 	if err = os.MkdirAll(RepoRootPath, os.ModePerm); err != nil {
 		log.Fatal("Fail to create repository root path(%s): %v", RepoRootPath, err)
 	}