kantarci/KantSites
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 81 Wiki Activity

Force HTTPS from the admin, with a probe before and after

Browse Source 
System > HTTPS and cms:https switch the redirect lines in public/.htaccess
only when the site answers over HTTPS, and take them back on a loop. HSTS
is a separate second switch. The redirect block moves before the front
controller rules, where it never reached pages, and .well-known is no
longer denied, so the origin probe works on Apache. The Git updater keeps
switched-on lines like the archive update.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
kantarciandClaude Opus 5.5 committed 2026-10-12 17:22:56 +02:00
1 parent daad5a1740
commit 8b212d5cc9
15 files changed
+614 -24
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/CmsTest.php
+4 -1
View File
@@ -1621,7 +1621,10 @@ final class CmsTest extends TestCase
$htaccess = (string) file_get_contents(__DIR__.'/../public/.htaccess');
self::assertStringContainsString('Header always unset X-Powered-By', $htaccess);
// Ohne diese Zeile schreibt IONOS index.php endlos auf sich selbst um: weißer 500er (ADR 114).
self::assertStringContainsString("RewriteBase /\nRewriteRule ^index\\.php$ - [L]\nRewriteCond %{REQUEST_FILENAME} !-f", $htaccess);
self::assertStringContainsString("RewriteRule ^index\\.php$ - [L]\nRewriteCond %{REQUEST_FILENAME} !-f", $htaccess);
// Die HTTPS-Umleitung steht davor, sonst erreicht sie keine Seite (ADR 120).
self::assertLessThan(strpos($htaccess, 'RewriteRule ^index\\.php$ - [L]'), strpos($htaccess, 'RewriteRule ^ https://'));
self::assertGreaterThan(strpos($htaccess, 'RewriteBase /'), strpos($htaccess, 'RewriteRule ^ https://'));
}
public function testABackgroundPictureShrinksForSmallScreensEvenWhenSetOnce(): void