id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
20996	wp_get_attachment_url() ignoring HTTPS	xsign.dll		"SSL is ignored in wp_get_attachment_url() so that a HTTPS website gets invalidated by unsecure content.

Steps to reproduce:

1. Add to wp-config.php: define('FORCE_SSL_ADMIN', true);
2. Use e.g. the_post_thumbnail() in a theme. This function calls wp_get_attachment_url()
3. Visit website via HTTPS => Browser error occurs



Hotfix below. Add to function.php
{{{
# Correct SSL Bug
function correct_url_ssl($url)
{
  if( function_exists('is_ssl') && is_ssl() )
  {
    return str_replace('http://', 'https://', $url);
  }
  return $url;
}
add_filter('wp_get_attachment_url', 'correct_url_ssl');
}}}

Kind regards,
F. Wolf
xsigndll.com"	defect (bug)	closed	normal		Security	3.4	normal	duplicate