The new editor only shows "Check permission" with an endless loading spinner.
This is caused by two issues.
- These endpoints initially return HTTP 500:
/rest/v1/version-info
/rest/v1/user-permissions
The .htaccess rewrite does not determine the correct base path.
Add:
RewriteCond %{REQUEST_URI}::$1 ^(.?/)(.)::\2$
RewriteRule ^(.*)$ - [E=BASE:%1]
and replace:
RewriteRule . index.php
with:
RewriteRule ^ %{ENV:BASE}index.php
See: https://stackoverflow.com/questions/21062290/set-rewritebase-to-the-current-folder-path-dynamically
This fixes /rest/v1/version-info.
- Authenticated REST endpoints return 401
After fixing the rewrite, /rest/v1/user-permissions and other authenticated endpoints return HTTP 401.
The browser sends the Bearer header, but on IONOS it is available in PHP as:
$_SERVER['REDIRECT_HTTP_AUTHORIZATION']
Add this fallback to getAuthBearerToken() in:
/limesurvey/application/libraries/Api/Rest/Endpoint/EndpointFactory.php
if (
!isset($headers['authorization'])
&& isset($_SERVER['REDIRECT_HTTP_AUTHORIZATION'])
) {
$headers['authorization'] =
$_SERVER['REDIRECT_HTTP_AUTHORIZATION'];
}
Apache seems to add the REDIRECT_ prefix during rewrites.
Related issue:
https://github.com/martialblog/docker-limesurvey/issues/302
WordPress also checks REDIRECT_HTTP_AUTHORIZATION as a fallback:
https://developer.wordpress.org/reference/classes/wp_rest_server/get_headers/ | 
