The mail page under System tries SMTP, PHP mail() and both sendmail
modes one by one or all at once, and saves the chosen way to .env
without ever showing the password. IONOS answers everything under
/.well-known/ itself with 403, so the address and HTTPS checks never
reached the installation; the probe now lives at /kantsites-origin
(ADR 122).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- System > This installation > Address has a field and a link to the other
spelling (with or without www), like the WordPress address. It writes
SITE_ORIGIN to .env through Environment::write and takes effect on the
next request. With SITE_ORIGIN from the server environment there is no
field, and a POST is refused.
- Before saving, OriginCheck requests /.well-known/kantsites-origin under the
new address; it has to return an HMAC of APP_SECRET that only this
installation knows. Switching to www without DNS or certificate would
otherwise send every page, the administration included, nowhere. "Save
anyway" appears only after a refusal. The probe also answers during
maintenance.
- The message says when the administration changes host and needs a new
sign-in, since the session cookie belongs to one spelling.
Tests: 584 PHPUnit on PHP 8.2 and 8.4, 35 node, test:editor and
test:browser green (test:browser reports only the known editor colour
contrast on /grundlagen).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kantarciandClaude Opus 5.5