MAIN_SECURITY_FORCERP - HTTP_REFERER

[atm-irvine]

Bug

Because of the MAIN_SECURITY_FORCERP set by default on strict-origin, in v19, it's impossible to keep the list filter in the URL when you clic on "return list" from an object.
Because of this, HTTP_REFERER is equal to the domain name only and not the page you was from.
In v18, MAIN_SECURITY_FORCERP is set on same-origin and the filters are kept when you clic on "Return list" from an object.
HTTP_REFERER works fine.
I would like to know the reasons of this modification.
Normally, it should be the same problem for all users v19.
Will this have any impact on safety ?

Dolibarr Version

19.0

Environment PHP

No response

Environment Database

No response

Steps to reproduce the behavior and expected behavior

No response

Attached files

No response

[ksar-ksar]

https://www.dolibarr.fr/forum/t/memoire-filtre-de-recherche/46100

[frederic34]

#29698