Ticket #19023: 19023.ssl_proxy.patch

wp-admin/ssl_proxy.php

@@ +1 @@
+<?php
+/**
+ * WordPress SSL Proxy
+ *
+ * @package WordPress
+ * @subpackage Administration
+ */
+
+// Get admin libs
+require_once('./admin.php');
+
+// Make sure URL is present
+if (empty($_REQUEST['url']))
+        default_image();
+
+// Get the URL arg
+$url = base64_decode($_REQUEST['url']);
+
+// Check that base64 decoded okay
+if ( false === $url )
+        default_image();
+
+// Make sure it's a valid URL
+if ( false === parse_url($url) )
+        default_image();
+
+// Fetch it
+$req = wp_remote_get(base64_decode($_REQUEST['url']));
+
+// Look for errors
+if ( is_wp_error($req) )
+        default_image();
+
+// Look for error status codes
+if ( $req['response']['code'] < 200 || $req['response']['code'] >= 400)
+        default_image();
+
+// Okay, no errors, show the image
+if (isset($req['headers']['content-type']))
+        header('Content-type: ' . $req['headers']['content-type']);
+echo $req['body'];
+
+/**
+ * Show the default image.  This is called when an error happened.
+ */
+function default_image() {
+        header('Content-type: image/gif');
+        readfile('./images/loading.gif');
+        die();
+}

wp-admin/edit-comments.php

@@ -16 +16 @@
 
 $doaction = $wp_list_table->current_action();
 
+// Filter out any insecure content to avoid SSL warnings
+if ( is_ssl() )
+        add_filter( 'comment_text', 'proxy_insecure_content', 999 );
+
 if ( $doaction ) {
         check_admin_referer( 'bulk-comments' );
 

wp-includes/comment-template.php

@@ -615 +615 @@
 }
 
 /**
+ * Filter out any images from insecure sources 
+ * @param string $content
+ * @return string
+ */
+function proxy_insecure_content($content) {
+        if ( preg_match_all('/src=[\'"]?([^\'">]+)[\'"]?/ix', $content, $matches )) {
+                foreach ( $matches[1] as $k => $v ) {
+                        $parts = parse_url($v);
+                        if ( $parts === false )
+                                continue;
+                        
+                        // If we can just slap "https://" onto the front, go ahead
+                        if ( $parts['host'] == $_SERVER['HTTP_HOST'] ) {
+                                $url = str_replace('http://', 'https://', $v);
+
+                        // If not, it's probably an external image and needs to be proxied
+                        } else {
+                                $url = get_ssl_proxy_url($v);
+                        }
+                        
+                        // Update the content
+                        $content = str_replace($v, $url, $content);
+                }
+        }
+        return $content;
+}
+
+/**
+ * Run non-secure items through an SSL proxy
+ * Why base64 encode?  mod_security will detect it as an attack otherwise.
+ * @param string $url
+ * @return string
+ */
+function get_ssl_proxy_url($url) {
+        return get_admin_url() . 'ssl_proxy.php?url=' . base64_encode($url);
+}
+
+/**
  * Retrieve the comment time of the current comment.
  *
  * @since 1.5.0