In `wp_get_attachment_url()`, convert to HTTPS when possible.
`wp_get_attachment_url()`, via `wp_upload_dir()`, uses 'siteurl' to generate attachment URLs. When a site is SSL-optional on the front end - ie, 'siteurl' is non-HTTPS, but SSL is available - a number of situations can arise where non-HTTPS attachment URLs cause browser mixed-content warnings: a) SSL is forced in the admin and `wp_get_attachment_url()` is used to generate the `<img>` tag for an inserted image. In these cases, the post content will contain non-HTTPS. Viewing/editing this post in the Dashboard will result in non-HTTPS images being served in an SSL environment. b) `wp_get_attachment_url()` is used in a theme to generate an `<img>` `src` attribute on a public page. When viewing that page over SSL, the images will have HTTP URLs. This changeset switches attachment URLs to HTTPS when it's determined that the host supports SSL. This happens when 'siteurl' is non-SSL, but the current page request *is* over SSL, and the host of the current request matches the host of the URL being generated. Props joemcgill, boonebgorges. Fixes #15928. git-svn-id: https://develop.svn.wordpress.org/trunk@31614 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Boone Gorges
parent
bd69086dcb
commit
1ee4d99972
|
|
@ -4980,6 +4980,14 @@ function wp_get_attachment_url( $post_id = 0 ) {
|
|||
$url = get_the_guid( $post->ID );
|
||||
}
|
||||
|
||||
/*
|
||||
* If currently on SSL, prefer HTTPS URLs when we know they're supported by the domain
|
||||
* (which is to say, when they share the domain name of the current SSL page).
|
||||
*/
|
||||
if ( is_ssl() && 'https' !== substr( $url, 0, 5 ) && parse_url( $url, PHP_URL_HOST ) === $_SERVER['HTTP_HOST'] ) {
|
||||
$url = set_url_scheme( $url, 'https' );
|
||||
}
|
||||
|
||||
/**
|
||||
* Filter the attachment URL.
|
||||
*
|
||||
|
|
|
|||
|
|
@ -278,4 +278,165 @@ class Tests_Post_Attachments extends WP_UnitTestCase {
|
|||
$this->assertEquals( $attachment->post_parent, $post_id );
|
||||
}
|
||||
|
||||
/**
|
||||
* @ticket 15928
|
||||
*/
|
||||
public function test_wp_get_attachment_url_should_not_force_https_when_current_page_is_non_ssl_and_siteurl_is_non_ssl() {
|
||||
$siteurl = get_option( 'siteurl' );
|
||||
update_option( 'siteurl', set_url_scheme( $siteurl, 'http' ) );
|
||||
|
||||
$filename = DIR_TESTDATA . '/images/test-image.jpg';
|
||||
$contents = file_get_contents( $filename );
|
||||
|
||||
$upload = wp_upload_bits( basename( $filename ), null, $contents );
|
||||
$this->assertTrue( empty( $upload['error'] ) );
|
||||
|
||||
// Set attachment ID.
|
||||
$attachment_id = $this->_make_attachment( $upload );
|
||||
|
||||
// Save server data for cleanup.
|
||||
$is_ssl = is_ssl();
|
||||
$_SERVER['HTTPS'] = 'off';
|
||||
|
||||
$url = wp_get_attachment_url( $attachment_id );
|
||||
$this->assertSame( set_url_scheme( $url, 'http' ), $url );
|
||||
|
||||
// Cleanup.
|
||||
$_SERVER['HTTPS'] = $is_ssl ? 'on' : 'off';
|
||||
}
|
||||
|
||||
/**
|
||||
* @ticket 15928
|
||||
*
|
||||
* This situation (current request is non-SSL but siteurl is https) should never arise.
|
||||
*/
|
||||
public function test_wp_get_attachment_url_should_not_force_https_when_current_page_is_non_ssl_and_siteurl_is_ssl() {
|
||||
$siteurl = get_option( 'siteurl' );
|
||||
update_option( 'siteurl', set_url_scheme( $siteurl, 'https' ) );
|
||||
|
||||
$filename = DIR_TESTDATA . '/images/test-image.jpg';
|
||||
$contents = file_get_contents( $filename );
|
||||
|
||||
$upload = wp_upload_bits( basename( $filename ), null, $contents );
|
||||
$this->assertTrue( empty( $upload['error'] ) );
|
||||
|
||||
// Set attachment ID.
|
||||
$attachment_id = $this->_make_attachment( $upload );
|
||||
|
||||
// Save server data for cleanup.
|
||||
$is_ssl = is_ssl();
|
||||
$_SERVER['HTTPS'] = 'off';
|
||||
|
||||
$url = wp_get_attachment_url( $attachment_id );
|
||||
$this->assertSame( set_url_scheme( $url, 'http' ), $url );
|
||||
|
||||
// Cleanup.
|
||||
$_SERVER['HTTPS'] = $is_ssl ? 'on' : 'off';
|
||||
}
|
||||
|
||||
/**
|
||||
* @ticket 15928
|
||||
*
|
||||
* Canonical siteurl is non-SSL, but SSL support is available/optional.
|
||||
*/
|
||||
public function test_wp_get_attachment_url_should_force_https_with_https_on_same_host_when_siteurl_is_non_ssl_but_ssl_is_available() {
|
||||
$siteurl = get_option( 'siteurl' );
|
||||
update_option( 'siteurl', set_url_scheme( $siteurl, 'http' ) );
|
||||
|
||||
$filename = ( DIR_TESTDATA . '/images/test-image.jpg' );
|
||||
$contents = file_get_contents( $filename );
|
||||
|
||||
$upload = wp_upload_bits( basename( $filename ), null, $contents );
|
||||
$this->assertTrue( empty( $upload['error'] ) );
|
||||
|
||||
// Set attachment ID
|
||||
$attachment_id = $this->_make_attachment( $upload );
|
||||
|
||||
// Save server data for cleanup
|
||||
$is_ssl = is_ssl();
|
||||
$http_host = $_SERVER['HTTP_HOST'];
|
||||
|
||||
$_SERVER['HTTPS'] = 'on';
|
||||
|
||||
// Verify that server host matches the host of wp_upload_dir().
|
||||
$upload_dir = wp_upload_dir();
|
||||
$_SERVER['HTTP_HOST'] = parse_url( $upload_dir['baseurl'], PHP_URL_HOST );
|
||||
|
||||
// Test that wp_get_attachemt_url returns with https scheme.
|
||||
$url = wp_get_attachment_url( $attachment_id );
|
||||
$this->assertSame( set_url_scheme( $url, 'https' ), $url );
|
||||
|
||||
// Cleanup.
|
||||
$_SERVER['HTTPS'] = $is_ssl ? 'on' : 'off';
|
||||
$_SERVER['HTTP_HOST'] = $http_host;
|
||||
}
|
||||
|
||||
/**
|
||||
* @ticket 15928
|
||||
*/
|
||||
public function test_wp_get_attachment_url_with_https_on_same_host_when_siteurl_is_https() {
|
||||
$siteurl = get_option( 'siteurl' );
|
||||
update_option( 'siteurl', set_url_scheme( $siteurl, 'https' ) );
|
||||
|
||||
$filename = ( DIR_TESTDATA . '/images/test-image.jpg' );
|
||||
$contents = file_get_contents( $filename );
|
||||
|
||||
$upload = wp_upload_bits( basename( $filename ), null, $contents );
|
||||
$this->assertTrue( empty( $upload['error'] ) );
|
||||
|
||||
// Set attachment ID.
|
||||
$attachment_id = $this->_make_attachment( $upload );
|
||||
|
||||
// Save server data for cleanup.
|
||||
$is_ssl = is_ssl();
|
||||
$http_host = $_SERVER['HTTP_HOST'];
|
||||
|
||||
$_SERVER['HTTPS'] = 'on';
|
||||
|
||||
// Verify that server host matches the host of wp_upload_dir().
|
||||
$upload_dir = wp_upload_dir();
|
||||
$_SERVER['HTTP_HOST'] = parse_url( $upload_dir['baseurl'], PHP_URL_HOST );
|
||||
|
||||
// Test that wp_get_attachemt_url returns with https scheme.
|
||||
$url = wp_get_attachment_url( $attachment_id );
|
||||
$this->assertSame( set_url_scheme( $url, 'https' ), $url );
|
||||
|
||||
// Cleanup.
|
||||
$_SERVER['HTTPS'] = $is_ssl ? 'on' : 'off';
|
||||
$_SERVER['HTTP_HOST'] = $http_host;
|
||||
}
|
||||
|
||||
/**
|
||||
* @ticket 15928
|
||||
*/
|
||||
public function test_wp_get_attachment_url_should_not_force_https_when_https_is_on_but_url_has_a_different_domain() {
|
||||
$siteurl = get_option( 'siteurl' );
|
||||
update_option( 'siteurl', set_url_scheme( $siteurl, 'https' ) );
|
||||
|
||||
$filename = ( DIR_TESTDATA . '/images/test-image.jpg' );
|
||||
$contents = file_get_contents( $filename );
|
||||
|
||||
$upload = wp_upload_bits( basename( $filename ), null, $contents );
|
||||
$this->assertTrue( empty( $upload['error'] ) );
|
||||
|
||||
// Set attachment ID
|
||||
$attachment_id = $this->_make_attachment( $upload );
|
||||
|
||||
// Save server data for cleanup.
|
||||
$is_ssl = is_ssl();
|
||||
$http_host = $_SERVER['HTTP_HOST'];
|
||||
|
||||
$_SERVER['HTTPS'] = 'on';
|
||||
|
||||
// Set server host to something random.
|
||||
$_SERVER['HTTP_HOST'] = 'some.otherhostname.com';
|
||||
|
||||
$url = wp_get_attachment_url( $attachment_id );
|
||||
$this->assertSame( set_url_scheme( $url, 'http' ), $url );
|
||||
|
||||
// Cleanup.
|
||||
$_SERVER['HTTPS'] = $is_ssl ? 'on' : 'off';
|
||||
$_SERVER['HTTP_HOST'] = $http_host;
|
||||
}
|
||||
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue