Ticket #34945: 34945.6.diff

src/wp-includes/deprecated.php

@@ -3747 +3747 @@
  * @return string The base URL.
  */
 function _wp_upload_dir_baseurl() {
+        _deprecated_function( __FUNCTION__, '4.5' );
         $upload_dir = wp_get_upload_dir();
         return $upload_dir['baseurl'];
 }

src/wp-includes/media.php

@@ -351 +351 @@
          */
         $class = apply_filters( 'get_image_tag_class', $class, $id, $align, $size );
 
+        $site_url = get_option( 'siteurl' );
+        if ( 'https' === substr( $img_src, 0, 5 ) && 'http' === parse_url( $site_url, PHP_URL_SCHEME ) && parse_url( $img_src, PHP_URL_HOST ) === parse_url( $site_url, PHP_URL_HOST ) ) {
+                $img_src = set_url_scheme( $img_src, 'http' );
+        }
+
         $html = '<img src="' . esc_attr($img_src) . '" alt="' . esc_attr($alt) . '" ' . $title . $hwstring . 'class="' . $class . '" />';
 
         /**
@@ -903 +908 @@
 }
 
 /**
+ * Sets the protocol, caches and returns the base URL of the uploads directory.
+ *
+ * @since 4.5.0
+ * @access private
+ *
+ * @param string $baseurl The base URL of the uploads directory.
+ * @return string The base URL, cached.
+ */
+function _ssl_image_baseurl( $baseurl ) {
+        /*
+         * If currently on SSL, prefer HTTPS URLs when we know they're supported by the domain
+         * (which is to say, when they share the domain name of the current SSL page).
+         */
+        if ( is_ssl() && 'https' !== substr( $baseurl, 0, 5 ) && parse_url( $baseurl, PHP_URL_HOST ) === $_SERVER['HTTP_HOST'] ) {
+                $baseurl = set_url_scheme( $baseurl, 'https' );
+        }
+
+        return $baseurl;
+}
+
+/**
  * Get the image size as array from its meta data.
  *
  * Used for responsive images.
@@ -1025 +1051 @@
         }
 
         $upload_dir = wp_get_upload_dir();
-        $image_baseurl = trailingslashit( $upload_dir['baseurl'] ) . $dirname;
+
+        // Set URL schema when front-end is https.
+        $image_baseurl = _ssl_image_baseurl( $upload_dir['baseurl'] );
+        $image_baseurl = trailingslashit( $image_baseurl ) . $dirname;
 
         /*
          * Images that have been edited in WordPress after being uploaded will
@@ -2998 +3027 @@
 
         $attachment_url = wp_get_attachment_url( $attachment->ID );
 
+        $site_url = get_option( 'siteurl' );
+
+        if ( 'https' === substr( $attachment_url, 0, 5 ) && 'http' === parse_url( $site_url, PHP_URL_SCHEME ) && parse_url( $attachment_url, PHP_URL_HOST ) === parse_url( $site_url, PHP_URL_HOST ) ) {
+                $attachment_url = set_url_scheme( $attachment_url, 'http' );
+        }
+
         $response = array(
                 'id'          => $attachment->ID,
                 'title'       => $attachment->post_title,

src/wp-includes/post.php

@@ -5015 +5015 @@
         if ( $file = get_post_meta( $post->ID, '_wp_attached_file', true ) ) {
                 // Get upload directory.
                 if ( ( $uploads = wp_get_upload_dir() ) && false === $uploads['error'] ) {
+                        $image_baseurl = _ssl_image_baseurl( $uploads['baseurl'] );
                         // Check that the upload base exists in the file location.
                         if ( 0 === strpos( $file, $uploads['basedir'] ) ) {
                                 // Replace file location with url location.
-                                $url = str_replace($uploads['basedir'], $uploads['baseurl'], $file);
+                                $url = str_replace( $uploads['basedir'], $image_baseurl, $file );
                         } elseif ( false !== strpos($file, 'wp-content/uploads') ) {
                                 // Get the directory name relative to the basedir (back compat for pre-2.7 uploads)
-                                $url = trailingslashit( $uploads['baseurl'] . '/' . _wp_get_attachment_relative_path( $file ) ) . basename( $file );
+                                $url = trailingslashit( $image_baseurl . '/' . _wp_get_attachment_relative_path( $file ) ) . basename( $file );
                         } else {
                                 // It's a newly-uploaded file, therefore $file is relative to the basedir.
-                                $url = $uploads['baseurl'] . "/$file";
+                                $url = trailingslashit( $image_baseurl ) . $file;
                         }
                 }
         }

tests/phpunit/tests/media.php

@@ -1407 +1407 @@
                 $actual     = wp_make_content_images_responsive( $unfiltered );
 
                 $this->assertSame( $expected, $actual );
+}
+
+        /**
+         * @ticket 34945
+         * @ticket 33641
+         */
+        function test_wp_get_attachment_image_with_https_on() {
+                global $blog_id;
+                
+                // Save server data for cleanup
+                $is_ssl = is_ssl();
+                $current_blog_id = get_current_blog_id();
+
+                // Mock meta for the image.
+                $image_meta = array(
+                        'width' => 1200,
+                        'height' => 600,
+                        'file' => 'test.jpg',
+                        'sizes' => array(
+                                'thumbnail' => array(
+                                        'file' => 'test-150x150.jpg',
+                                        'width' => 150,
+                                        'height' => 150,
+                                ),
+                                'medium' => array(
+                                        'file' => 'test-300x150.jpg',
+                                        'width' => 300,
+                                        'height' => 150,
+                                ),
+                                'large' => array(
+                                        'file' => 'test-1024x512.jpg',
+                                        'width' => 1024,
+                                        'height' => 512,
+                                ),
+                        )
+                );
+
+                // Test using the large file size.
+                $size_array = array(1024, 512);
+                $image_url  = 'http://' . WP_TESTS_DOMAIN . '/wp-content/uploads/' . $image_meta['sizes']['large']['file'];
+
+                $_SERVER['HTTPS'] = 'on';
+                $blog_id = 42; // Used to bust the cache in _ssl_image_baseurl()
+
+                $expected = 'https://example.org/wp-content/uploads/test-300x150.jpg 300w, https://example.org/wp-content/uploads/test-1024x512.jpg 1024w, https://example.org/wp-content/uploads/test.jpg 1200w';
+
+                $this->assertSame( $expected, wp_calculate_image_srcset( $size_array, $image_url, $image_meta ) );
+
+                // Cleanup
+                $_SERVER['HTTPS'] = $is_ssl;
+                $blog_id = $current_blog_id;
         }
 }

tests/phpunit/tests/post/attachments.php

@@ -389 +389 @@
         /**
         * @ticket 15928
         */
-        public function test_wp_get_attachment_url_should_not_force_https_when_administering_over_https_but_siteurl_is_not_https() {
+        public function test_wp_get_attachment_url_should_force_https_when_administering_over_https_but_siteurl_is_not_https() {
                 $siteurl = get_option( 'siteurl' );
                 update_option( 'siteurl', set_url_scheme( $siteurl, 'http' ) );
 
@@ -410 +410 @@
                 // Cleanup.
                 set_current_screen( 'front' );
 
-                $this->assertSame( set_url_scheme( $url, 'http' ), $url );
+                $this->assertSame( set_url_scheme( $url, 'https' ), $url );
         }
 
         /**