Ticket #34945: 34945.8.diff

src/wp-admin/includes/media.php

@@ -2819 +2819 @@
         $media_dims = apply_filters( 'media_meta', $media_dims, $post );
 
         $att_url = wp_get_attachment_url( $post->ID );
+        // The "File URL" on the Edit Media screen should be the URL expected in content.
+        $att_url = _wp_ssl_url( $att_url, 'content' );
 ?>
         <div class="misc-pub-section misc-pub-attachment">
                 <label for="attachment_url"><?php _e( 'File URL:' ); ?></label>

src/wp-includes/deprecated.php

@@ -3747 +3747 @@
  * @return string The base URL.
  */
 function _wp_upload_dir_baseurl() {
+        _deprecated_function( __FUNCTION__, '4.5' );
         $upload_dir = wp_get_upload_dir();
         return $upload_dir['baseurl'];
 }

src/wp-includes/media.php

@@ -351 +351 @@
          */
         $class = apply_filters( 'get_image_tag_class', $class, $id, $align, $size );
 
+        $img_src = _wp_ssl_url( $img_src, 'content' );
         $html = '<img src="' . esc_attr($img_src) . '" alt="' . esc_attr($alt) . '" ' . $title . $hwstring . 'class="' . $class . '" />';
 
         /**
@@ -903 +904 @@
 }
 
 /**
+ * For local URLs, sets https scheme if needed.
+ *
+ * @since 4.5.0
+ * @access private
+ *
+ * @param string $url     URL.
+ * @param string $context Whether the URL is being used in a "content" or "admin" context.
+ * @return string The same URL with proper scheme.
+ */
+function _wp_ssl_url( $url, $context = 'admin' ) {
+
+        if ( 'content' === $context ) {
+                /**
+                 * If we're inserting a URL into content, the site's siteurl is configured for HTTP, and the URL host
+                 * matches that of the siteurl, then we convert the URL to HTTP.
+                 */
+                $site_url = parse_url( get_option( 'siteurl' ) );
+                if ( 'https' === substr( $url, 0, 5 ) && 'http' === $site_url['scheme'] && parse_url( $url, PHP_URL_HOST ) === $site_url['host'] ) {
+                        $url = set_url_scheme( $url, 'http' );
+                }
+        } else {
+                /*
+                 * If we're using a URL outside of content and are currently viewing an HTTPS page, prefer HTTPS URLs
+                 * as we know they are supported by the domain.
+                 */
+                if ( is_ssl() && 'https' !== substr( $url, 0, 5 ) && parse_url( $url, PHP_URL_HOST ) === $_SERVER['HTTP_HOST'] ) {
+                        $url = set_url_scheme( $url, 'https' );
+                }
+        }
+
+        return $url;
+}
+
+/**
  * Get the image size as array from its meta data.
  *
  * Used for responsive images.
@@ -1025 +1060 @@
         }
 
         $upload_dir = wp_get_upload_dir();
-        $image_baseurl = trailingslashit( $upload_dir['baseurl'] ) . $dirname;
+
+        // Set URL scheme when front-end is https.
+        $image_baseurl = _wp_ssl_url( $upload_dir['baseurl'] );
+        $image_baseurl = trailingslashit( $image_baseurl ) . $dirname;
 
         /*
          * Images that have been edited in WordPress after being uploaded will
@@ -2998 +3036 @@
 
         $attachment_url = wp_get_attachment_url( $attachment->ID );
 
+        // @todo When displaying images in the media grid, this is an admin context. Is this different elsewhere?
+        $attachment_url = _wp_ssl_url( $attachment_url, 'admin' );
+
         $response = array(
                 'id'          => $attachment->ID,
                 'title'       => $attachment->post_title,

src/wp-includes/post.php

@@ -5015 +5015 @@
         if ( $file = get_post_meta( $post->ID, '_wp_attached_file', true ) ) {
                 // Get upload directory.
                 if ( ( $uploads = wp_get_upload_dir() ) && false === $uploads['error'] ) {
+                        $image_baseurl = _wp_ssl_url( $uploads['baseurl'] );
                         // Check that the upload base exists in the file location.
                         if ( 0 === strpos( $file, $uploads['basedir'] ) ) {
                                 // Replace file location with url location.
-                                $url = str_replace($uploads['basedir'], $uploads['baseurl'], $file);
+                                $url = str_replace( $uploads['basedir'], $image_baseurl, $file );
                         } elseif ( false !== strpos($file, 'wp-content/uploads') ) {
                                 // Get the directory name relative to the basedir (back compat for pre-2.7 uploads)
-                                $url = trailingslashit( $uploads['baseurl'] . '/' . _wp_get_attachment_relative_path( $file ) ) . basename( $file );
+                                $url = trailingslashit( $image_baseurl . '/' . _wp_get_attachment_relative_path( $file ) ) . basename( $file );
                         } else {
                                 // It's a newly-uploaded file, therefore $file is relative to the basedir.
-                                $url = $uploads['baseurl'] . "/$file";
+                                $url = trailingslashit( $image_baseurl ) . $file;
                         }
                 }
         }

tests/phpunit/tests/media.php

@@ -1407 +1407 @@
                 $actual     = wp_make_content_images_responsive( $unfiltered );
 
                 $this->assertSame( $expected, $actual );
+}
+
+        /**
+         * @ticket 34945
+         * @ticket 33641
+         */
+        function test_wp_get_attachment_image_with_https_on() {
+                global $blog_id;
+
+                // Save server data for cleanup
+                $is_ssl = is_ssl();
+
+                // Mock meta for the image.
+                $image_meta = array(
+                        'width' => 1200,
+                        'height' => 600,
+                        'file' => 'test.jpg',
+                        'sizes' => array(
+                                'thumbnail' => array(
+                                        'file' => 'test-150x150.jpg',
+                                        'width' => 150,
+                                        'height' => 150,
+                                ),
+                                'medium' => array(
+                                        'file' => 'test-300x150.jpg',
+                                        'width' => 300,
+                                        'height' => 150,
+                                ),
+                                'large' => array(
+                                        'file' => 'test-1024x512.jpg',
+                                        'width' => 1024,
+                                        'height' => 512,
+                                ),
+                        )
+                );
+
+                // Test using the large file size.
+                $size_array = array(1024, 512);
+                $image_url  = 'http://' . WP_TESTS_DOMAIN . '/wp-content/uploads/' . $image_meta['sizes']['large']['file'];
+
+                $_SERVER['HTTPS'] = 'on';
+
+                $expected = 'https://example.org/wp-content/uploads/test-300x150.jpg 300w, https://example.org/wp-content/uploads/test-1024x512.jpg 1024w, https://example.org/wp-content/uploads/test.jpg 1200w';
+
+                $this->assertSame( $expected, wp_calculate_image_srcset( $size_array, $image_url, $image_meta ) );
+
+                // Cleanup
+                $_SERVER['HTTPS'] = $is_ssl;
         }
 }

tests/phpunit/tests/post/attachments.php

@@ -389 +389 @@
         /**
         * @ticket 15928
         */
-        public function test_wp_get_attachment_url_should_not_force_https_when_administering_over_https_but_siteurl_is_not_https() {
+        public function test_wp_get_attachment_url_should_force_https_when_administering_over_https_but_siteurl_is_not_https() {
                 $siteurl = get_option( 'siteurl' );
                 update_option( 'siteurl', set_url_scheme( $siteurl, 'http' ) );
 
@@ -410 +410 @@
                 // Cleanup.
                 set_current_screen( 'front' );
 
-                $this->assertSame( set_url_scheme( $url, 'http' ), $url );
+                $this->assertSame( set_url_scheme( $url, 'https' ), $url );
         }
 
         /**