Changeset 34932

Timestamp:

10/08/2015 03:08:05 AM (8 years ago)

Author:

johnbillion

Message:

Correctly set the secure flag on the post password cookie based on the scheme of the referring URL, if it's available, instead of the home URL.

Fixes #29641

File:

• trunk/src/wp-login.php (modified) (1 diff)

trunk/src/wp-login.php

@@ -441 +441 @@
      */
     $expire = apply_filters( 'post_password_expires', time() + 10 * DAY_IN_SECONDS );
-    $secure = ( 'https' === parse_url( home_url(), PHP_URL_SCHEME ) );
+    $referer = wp_get_referer();
+    if ( $referer ) {
+        $secure = ( 'https' === parse_url( $referer, PHP_URL_SCHEME ) );
+    } else {
+        $secure = false;
+    }
     setcookie( 'wp-postpass_' . COOKIEHASH, $hasher->HashPassword( wp_unslash( $_POST['post_password'] ) ), $expire, COOKIEPATH, COOKIE_DOMAIN, $secure );