Changeset 28627

Timestamp:

05/30/2014 03:07:18 PM (11 years ago)

Author:

nacin

Message:

Use a secure logged_in_cookie when the home URL is forced HTTPS (see #27954).

see #15330.

File:

• trunk/src/wp-includes/pluggable.php (modified) (2 diffs)

trunk/src/wp-includes/pluggable.php

@@ -819 +819 @@
     }
 
-    if ( '' === $secure )
+    if ( '' === $secure ) {
         $secure = is_ssl();
+    }
+
+    // Frontend cookie is secure when the auth cookie is secure and the site's home URL is forced HTTPS.
+    $secure_logged_in_cookie = $secure && 'https' === parse_url( get_option( 'home' ), PHP_URL_SCHEME );
 
     /**
@@ -841 +845 @@
      * @param bool $secure  Whether the connection is secure.
      */
-    $secure_logged_in_cookie = apply_filters( 'secure_logged_in_cookie', false, $user_id, $secure );
+    $secure_logged_in_cookie = apply_filters( 'secure_logged_in_cookie', $secure_logged_in_cookie, $user_id, $secure );
 
     if ( $secure ) {