Take redirects off the Host header.

Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.
2026-09-26 15:27:51 +02:00
parent 4657088d23
commit be814a3ba5
16 changed files with 149 additions and 73 deletions
@@ -16,7 +16,7 @@ class SubmitTest extends PageTestCase {
  }

  public function testPlainHttpIsSentToHttps(): void {
-    $this->assertRedirect('https://xxx.org.za/publish', $this->get('/publish', array('X-Test-Plain' => '1')));
+    $this->assertRedirect('https://site.test/publish', $this->get('/publish', array('X-Test-Plain' => '1')));
  }

  public function testTheFormHasATokenAndTheCaptcha(): void {