Take redirects off the Host header.

Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.
2026-09-26 15:27:51 +02:00
parent 4657088d23
commit be814a3ba5
16 changed files with 149 additions and 73 deletions
@@ -7,6 +7,10 @@ DB_USER=xxx
 DB_PASS=
 DB_NAME=xxx

+# Address of the site. The pages send plain HTTP requests to this host
+# over HTTPS. If it is empty, the pages refuse plain HTTP.
+SITE_URL=https://xxx.org.za
+
 # Google reCAPTCHA v2 keys (https://www.google.com/recaptcha/admin).
 # Leave RECAPTCHA_SITE_KEY empty to turn the captcha off.
 RECAPTCHA_SITE_KEY=