id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
15928	wp_get_attachment_url does not check for HTTPS	atetlaw		"wp_get_attachment_url, via wp_upload_dir, uses get_option('siteurl') to construct attachment URLs. If you're viewing your blog via HTTPS, the attachment URLs will all use HTTP. leading to mixed secure/non-secure content problems.

the_permalink function handles this nicely, by calling get_permalink, then home_url, then  get_home_url; get_home_url does an is_ssl check and changes the scheme accordingly.

The wp_upload_dir function should probably be changed, so that instead of calling get_option('siteurl') directly, it uses something like get_home_url (or even get_site_url) which check for HTTPS.



"	defect (bug)	assigned	normal	Future Release	Permalinks	3.0.3	normal		has-patch needs-testing	pauli.price@… johnbillion@… itdoug ipstenu@… knut@… dcowgill@… tfolkman@… info@… r@…