Ticket #52886: 52886.diff

src/wp-includes/formatting.php

@@ -4297 +4297 @@
  *
  * @since 2.8.0
  *
- * @param string   $url       The URL to be cleaned.
- * @param string[] $protocols Optional. An array of acceptable protocols.
- *                            Defaults to return value of wp_allowed_protocols().
- * @param string   $_context  Private. Use esc_url_raw() for database usage.
+ * @param string   $url               The URL to be cleaned.
+ * @param string[] $protocols         Optional. An array of acceptable protocols.
+ *                                    Defaults to return value of wp_allowed_protocols().
+ * @param string   $_context          Private. Use esc_url_raw() for database usage.
+ * @param string   $default_protocol  Use to specify different default, for historical
+ *                                    reasons esc_url defaults to http:// pass string
+ *                                    https:// to change the default behavior.
  * @return string The cleaned URL after the {@see 'clean_url'} filter is applied.
  *                An empty string is returned if `$url` specifies a protocol other than
  *                those in `$protocols`, or if `$url` contains an empty string.
  */
-function esc_url( $url, $protocols = null, $_context = 'display' ) {
+function esc_url( $url, $protocols = null, $_context = 'display', $default_protocol = 'http://' ) {
         $original_url = $url;
 
         if ( '' === $url ) {
@@ -4329 +4332 @@
          * If the URL doesn't appear to contain a scheme, we presume
          * it needs http:// prepended (unless it's a relative link
          * starting with /, # or ?, or a PHP file).
+         * @since 5.8 use default_protocol to allow https:// presumption
          */
         if ( strpos( $url, ':' ) === false && ! in_array( $url[0], array( '/', '#', '?' ), true ) &&
                 ! preg_match( '/^[a-z0-9-]+?\.php/i', $url ) ) {
-                $url = 'http://' . $url;
+                $url = $default_protocol . $url;
         }
 
         // Replace ampersands and single quotes only when displaying.