Take redirects off the Host header.

Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.

publish/logout.php

@@ -4,13 +4,11 @@ header( 'Cache-Control: no-store, no-cache, must-revalidate' );
 header( 'Cache-Control: post-check=0, pre-check=0', false );
 header( 'Pragma: no-cache' ); 
 include_once('../session.lib.php');
-if ( ! isset($_SERVER['HTTPS'])) {
-   header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
-   exit;
-}
+require_once('../config.lib.php');
+require_https();
 // Only log out from our own logout link, which carries the CSRF token
 if (!csrf_valid($_GET['token'] ?? '')) {
-  header("Location: https://xxx.org.za/");
+  header("Location: /");
   exit;
 }
 if (isset($_SESSION['editor'])) {
@@ -30,18 +28,11 @@ if (isset($_SESSION['editor'])) {
   session_destroy();
 }
 delete_persistent_login();
-if (isset($_SESSION['referrer'])) {
-  $url  = $_SERVER['HTTPS'] ? "https://" : "http://";
-  $url .= $_SERVER['HTTP_HOST'];
-  $url .= $_SESSION['referrer'];
-  unset($_SESSION['referrer']);
-  if (preg_match("/logout(\.php)?$/i", $url)) {
-    $url = "/";
-  }
-  header("Location: $url");
-  return;
-} else {
-  header("Location: https://xxx.org.za/");
-  return;
-}
+$referrer = (string)($_SESSION['referrer'] ?? '');
+unset($_SESSION['referrer']);
+if (is_local_path($referrer) && !preg_match("/logout(\.php)?$/i", $referrer))
+  header('Location: ' . $referrer);
+else
+  header("Location: /");
+return;
 ?>