Changeset 40843

Timestamp:

05/25/2017 06:01:16 PM (7 years ago)

Author:

johnbillion

Message:

REST API: In the admin area, ensure the REST API endpoint URL is forced to https when necessary.

In this situation, a site which uses http on the front end but https in the admin area is more likely to have a working REST API endpoint URL when used in the admin area.

Props mohanjith, westonruter, jnylen0

Fixes #36451

File:

• trunk/src/wp-includes/rest-api.php (modified) (1 diff)

trunk/src/wp-includes/rest-api.php

@@ -336 +336 @@
             $url = set_url_scheme( $url, 'https' );
         }
+    }
+
+    if ( is_admin() && force_ssl_admin() ) {
+        // In this situation the home URL may be http:, and `is_ssl()` may be
+        // false, but the admin is served over https: (one way or another), so
+        // REST API usage will be blocked by browsers unless it is also served
+        // over HTTPS.
+        $url = set_url_scheme( $url, 'https' );
     }