fix(maps): allow OSM tile Referer and use HTTPS tile URLs

[TDannhauer]

fix(maps): allow OSM tile Referer and use HTTPS tile URLs

Summary

• Relax the global Referrer-Policy header so browsers send a Referer on cross-origin OpenStreetMap tile requests, which OSM requires since 2024.
• Switch bundled OSM tile URLs from http:// to https://tile.openstreetmap.org/.

Problem

When inline maps use the OSM provider, tile requests to tile.openstreetmap.org fail with HTTP 403 and a message like “Referer is required”. Horde sets Referrer-Policy: same-origin on HTML responses, which suppresses the Referer header on cross-origin subresource requests (including map tile <img> loads).

The map JavaScript also still referenced http://tile.openstreetmap.org/..., which is outdated and problematic on HTTPS sites.

Solution

• Change Horde_PageOutput::header() to send Referrer-Policy: strict-origin-when-cross-origin, which is compatible with OSM’s tile usage policy and still avoids leaking full URLs on downgrade.
• Update OSM tile URLs in osm.js, owm.js, ocm.js, and the default OpenLayers.Layer.OSM URL in OpenLayers.js / OpenLayers-debug.js.

Changed files

File	Change
lib/Horde/PageOutput.php	Referrer-Policy: strict-origin-when-cross-origin
js/map/osm.js	HTTPS OSM tile URL
js/map/owm.js	HTTPS OSM tile URL (base layer)
js/map/ocm.js	HTTPS OSM tile URL
js/map/OpenLayers.js	HTTPS default OSM tile URL
js/map/OpenLayers-debug.js	HTTPS default OSM tile URL

Test plan

• Enable Horde maps with the Osm provider (Admin → General → Maps).
• Open an event with a geocoded location and switch to the Map tab.
• Confirm OSM tiles load (no 403 overlay on tiles).
• In browser devtools, verify tile requests use https://tile.openstreetmap.org/....
• Verify the response includes Referrer-Policy: strict-origin-when-cross-origin.
• Hard-refresh or disable JS caching so updated map scripts are loaded.
• Smoke-test external links from Horde still behave acceptably (origin-only referer on cross-origin navigation).

Notes

• OSM’s public tile servers are intended for light personal use; production deployments should use a dedicated tile provider or self-hosted cache.
• This does not add per-layer referrerpolicy support in OpenLayers; fixing the page-level policy is sufficient for current tile loading.

Suggested commit message

fix(maps): allow OSM tile Referer and use HTTPS tile URLs

OpenStreetMap blocks tile requests without a Referer header, but Horde
sent Referrer-Policy: same-origin, which suppresses cross-origin
Referer on map tile loads. Use strict-origin-when-cross-origin instead.

Also update bundled OSM tile URLs to https://tile.openstreetmap.org.

[TDannhauer]

@ralflang please review, esp. regarding security (policy change)

[ralflang]

Suggested change

	url: 'https://tile.openstreetmap.org/${z}/${x}/${y}.png',
	TODO: Do not hardcode the URI (or allow an override variable with fallback to hardcode)
	url: 'https://tile.openstreetmap.org/${z}/${x}/${y}.png',