Take redirects off the Host header.

Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.

publish/login.php

@@ -1,8 +1,6 @@
 <?php
-if ( ! isset($_SERVER['HTTPS'])) {
-   header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
-   exit;
-}
+require_once('../config.lib.php');
+require_https();
 require_once("../session.lib.php");
 $denied = NULL;
 $wait_minutes = 0;
@@ -10,7 +8,7 @@ $captcha_failed = FALSE;
 $is_admin = NULL;
 if (isset($_SESSION['editor'])) {
   session_write_close();
-  header("Location: https://xxx.org.za/publish/edit");
+  header("Location: /publish/edit");
   return;
 } else if (isset($_POST['login']) && !csrf_valid()) {
   $denied = TRUE;
@@ -51,19 +49,14 @@ if (isset($_SESSION['editor'])) {
     if (isset($_POST['remember'])) {
       create_persistent_login($username);
     }
-    if (isset($_SESSION['referrer'])) {
-      $url  = $_SERVER['HTTPS'] ? "https://" : "http://";
-      $url .= $_SERVER['HTTP_HOST'];
-      $url .= $_SESSION['referrer'];
-      unset($_SESSION['referrer']);
-      session_write_close();
-      header("Location: $url");
-      return;
-    } else {
-      session_write_close();
-      header("Location: https://xxx.org.za/publish/edit");
-      return;
-    }
+    $referrer = (string)($_SESSION['referrer'] ?? '');
+    unset($_SESSION['referrer']);
+    session_write_close();
+    if (is_local_path($referrer))
+      header('Location: ' . $referrer);
+    else
+      header("Location: /publish/edit");
+    return;
   }
 } 
 
@@ -100,7 +93,7 @@ else if ($denied)
   echo "<p><strong>Access denied. Please try again.</strong></p>\n";
 ?>
 
-<form action="<?php echo form_value("https://xxx.org.za".$_SERVER['REQUEST_URI']); ?>" method="post">
+<form action="" method="post">
   <?= csrf_field() ?>
   <div class="grid">