Ticket #28521: 28521.diff

src/wp-includes/comment.php

@@ -1151 +1151 @@
          * @param int $seconds Comment cookie lifetime. Default 30000000.
          */
         $comment_cookie_lifetime = apply_filters( 'comment_cookie_lifetime', 30000000 );
-        $secure = ( 'https' === parse_url( home_url(), PHP_URL_SCHEME ) );
+        $secure = ( 'https' === parse_url( home_url(), PHP_URL_SCHEME ) ) || force_ssl();
         setcookie( 'comment_author_' . COOKIEHASH, $comment->comment_author, time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN, $secure );
         setcookie( 'comment_author_email_' . COOKIEHASH, $comment->comment_author_email, time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN, $secure );
         setcookie( 'comment_author_url_' . COOKIEHASH, esc_url($comment->comment_author_url), time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN, $secure );

src/wp-includes/default-constants.php

@@ -263 +263 @@
         if ( defined( 'FORCE_SSL_LOGIN' ) && FORCE_SSL_LOGIN ) {
                 force_ssl_admin( true );
         }
+
+        if ( ! defined( 'FORCE_SSL' ) ) {
+                define( 'FORCE_SSL', false );
+        }
 }
 
 /**

src/wp-includes/default-filters.php

@@ -399 +399 @@
 add_action( 'wp_footer', 'wp_admin_bar_render', 1000 );
 add_action( 'in_admin_header', 'wp_admin_bar_render', 0 );
 
+if ( force_ssl() ) {
+        $hooks = array( 'the_content', 'the_excerpt', 'comment_text' );
+        foreach ( $hooks as $hook ) {
+                add_filter( $hook, 'wp_ssl_urls' );
+        }
+}
+
 unset( $filter, $action );

src/wp-includes/functions.php

@@ -3672 +3672 @@
  * @return bool True if SSL, false if not used.
  */
 function is_ssl() {
+        if ( force_ssl() ) {
+                return true;
+        }
+
         if ( isset($_SERVER['HTTPS']) ) {
                 if ( 'on' == strtolower($_SERVER['HTTPS']) )
                         return true;
@@ -3718 +3722 @@
 }
 
 /**
+ * Determine whether to force SSL
+ *
+ * @since 4.2.0
+ *
+ * @return bool True if forced SSL, false if not used.
+ */
+function force_ssl() {
+        return defined( 'FORCE_SSL' ) && FORCE_SSL;
+}
+
+/**
+ * Determine whether to force SSL
+ *
+ * @since 4.2.0
+ *
+ * @param string $content
+ *
+ * @return string The filtered content.
+ */
+function wp_ssl_urls( $content ) {
+        $search = array(
+                home_url( '', 'http' ),
+                site_url( '', 'http' )
+        );
+        $replace = array(
+                home_url( '', 'https' ),
+                site_url( '', 'https' )
+        );
+        return str_replace( $search, $replace, $content );
+}
+
+/**
  * Guess the URL for the site.
  *
  * Will remove wp-admin links to retrieve only return URLs not in the wp-admin

src/wp-includes/option.php

@@ -749 +749 @@
         }
 
         // The cookie is not set in the current browser or the saved value is newer.
-        $secure = ( 'https' === parse_url( site_url(), PHP_URL_SCHEME ) );
+        $secure = ( 'https' === parse_url( site_url(), PHP_URL_SCHEME ) ) || force_ssl();
         setcookie( 'wp-settings-' . $user_id, $settings, time() + YEAR_IN_SECONDS, SITECOOKIEPATH, null, $secure );
         setcookie( 'wp-settings-time-' . $user_id, time(), time() + YEAR_IN_SECONDS, SITECOOKIEPATH, null, $secure );
         $_COOKIE['wp-settings-' . $user_id] = $settings;

src/wp-includes/pluggable.php

@@ -873 +873 @@
          */
         $secure_logged_in_cookie = apply_filters( 'secure_logged_in_cookie', $secure_logged_in_cookie, $user_id, $secure );
 
-        if ( $secure ) {
+        if ( $secure || force_ssl() ) {
                 $auth_cookie_name = SECURE_AUTH_COOKIE;
                 $scheme = 'secure_auth';
         } else {

src/wp-login.php

@@ -434 +434 @@
 }
 
 //Set a cookie now to see if they are supported by the browser.
-$secure = ( 'https' === parse_url( site_url(), PHP_URL_SCHEME ) && 'https' === parse_url( home_url(), PHP_URL_SCHEME ) );
+$secure = ( 'https' === parse_url( site_url(), PHP_URL_SCHEME ) && 'https' === parse_url( home_url(), PHP_URL_SCHEME ) ) || force_ssl();
 setcookie( TEST_COOKIE, 'WP Cookie check', 0, COOKIEPATH, COOKIE_DOMAIN, $secure );
 if ( SITECOOKIEPATH != COOKIEPATH )
         setcookie( TEST_COOKIE, 'WP Cookie check', 0, SITECOOKIEPATH, COOKIE_DOMAIN, $secure );
@@ -476 +476 @@
          * @param int $expires The expiry time, as passed to setcookie().
          */
         $expire = apply_filters( 'post_password_expires', time() + 10 * DAY_IN_SECONDS );
-        $secure = ( 'https' === parse_url( home_url(), PHP_URL_SCHEME ) );
+        $secure = ( 'https' === parse_url( home_url(), PHP_URL_SCHEME ) ) || force_ssl();
         setcookie( 'wp-postpass_' . COOKIEHASH, $hasher->HashPassword( wp_unslash( $_POST['post_password'] ) ), $expire, COOKIEPATH, COOKIE_DOMAIN, $secure );
 
         wp_safe_redirect( wp_get_referer() );