tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Take redirects off the Host header.

Browse Source 
Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent 4657088d23
commit be814a3ba5
16 changed files with 149 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config.lib.php
+19
View File
@@ -40,6 +40,25 @@ function config($key, $default = NULL) {
return array_key_exists($key, $values) ? $values[$key] : $default;
}
/*
* Send a plain HTTP request to the same page over HTTPS, and stop. The
* host comes from SITE_URL, because the browser controls the Host header.
* Without SITE_URL, the page refuses plain HTTP.
*/
function require_https() {
if (isset($_SERVER['HTTPS']))
return;
$site = parse_url((string)config('SITE_URL', ''));
if (empty($site['host'])) {
http_response_code(403);
echo "This page needs HTTPS.\n";
} else {
$port = isset($site['port']) ? ':' . $site['port'] : '';
header('Location: https://' . $site['host'] . $port . $_SERVER['REQUEST_URI']);
}
exit;
}
// Always log PHP errors; show them only if DISPLAY_ERRORS is set (for development)
ini_set('log_errors', '1');
ini_set('display_errors', (string)config('DISPLAY_ERRORS', '0'));