tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Take redirects off the Host header.

Browse Source 
Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent 4657088d23
commit be814a3ba5
16 changed files with 149 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/php/Pages/AddEditorTest.php
+3 -3
View File
@@ -20,13 +20,13 @@ class AddEditorTest extends PageTestCase {
public function testVisitorsAreSentToTheLogin(): void {
$this->cookies = array();
$this->assertRedirect('https://xxx.org.za/publish/login', $this->get('/publish/addeditor'));
$this->assertRedirect('https://xxx.org.za/publish/login', $this->add(array('csrf_token' => '')));
$this->assertRedirect('/publish/login', $this->get('/publish/addeditor'));
$this->assertRedirect('/publish/login', $this->add(array('csrf_token' => '')));
$this->assertCount(1, $this->tables()['editors']);
}
public function testPlainHttpIsSentToHttps(): void {
$this->assertRedirect('https://xxx.org.za/publish/addeditor', $this->get('/publish/addeditor', array('X-Test-Plain' => '1')));
$this->assertRedirect('https://site.test/publish/addeditor', $this->get('/publish/addeditor', array('X-Test-Plain' => '1')));
}
public function testTheFormHasTheToken(): void {