bloginfo for pingback_url doesn't respect SSL

[technosailor]

Attached patch moves from using get_option(), which is not SSL aware, to using site_url() which is.

[nacin]

Existing issue, not major.

[technosailor]

Kind of a security issue, so I'd say it's major.

[nacin]

Replying to technosailor:

Kind of a security issue, so I'd say it's major.

I could see how this could be a problem, sure. Can anyone make a case that this could (or would not) break something?

[technosailor]

Replying to nacin:

I could see how this could be a problem, sure. Can anyone make a case that this could (or would not) break something?

All you need is a CSRF attack, now or in the future, to corrupt pingback_url and then encrypted traffic would leak. Theoretically.

[technosailor]

Replying to nacin:

I could see how this could be a problem, sure. Can anyone make a case that this could (or would not) break something?

As for breaking things, we're not changing bloginfo()/get_bloginfo() and site_url() already wraps, intelligently, around the siteurl option so... I can't foresee how this would possibly break anything. Eating our own dogfood and whatnot. If site_url() broke something, we'd already see it elsewhere... Plus, we have time for this to be baked in during the beta period

[jeremyfelt]

Related: #9008

[nacin]

All other references to xmlrpc.php use an SSL-aware URL. #9008 also proposes an SSL URL for the pingback URL in the description, but that is its only mention. This may be because that ticket was focused on home_url(), while xmlrpc.php should be using site_url(). I also see no mention in #7001.

[technosailor]

Here's a broader patch that ensures we eat our dogfood throughout core, but I don't feel as strongly about it and would be okay pushing to 3.8 for the second patch. Still think original patch needs to be in 3.7

[nacin]

Each instance in siteurl2.diff​ needs to be reviewed to make sure the current protocol's page is proper for that result. I see a few that could cause problems, a few that are unnecessary, and a few that are definitely correct.

[nacin]

In 25671:

Ensure that get_bloginfo( 'pingback_url' ) uses site_url(), for SSL awareness.

props technosailor.
fixes #25418.

[nacin]

In 25672:

Use site_url() in theme-compat.

props technosailor.
see #25418.