Changeset 50072 for trunk/src/wp-admin/includes/class-wp-site-health.php

Timestamp:

01/29/2021 07:09:49 PM (4 years ago)

Author:

flixos90

Message:

Security, Site Health: Improve accuracy in messaging about HTTPS support.

Following up on [49904], this changeset focuses mainly on improving the guidance about the current state of HTTPS in Site Health.

• Correct the existing copy to indicate that both the Site Address and the WordPress Address need to be changed to fully switch to HTTPS.
• Link to the respective input fields via anchor links rather than to the overall General Settings screen.
• Show different copy if the site is using HTTPS for the WordPress Address (for example to have only the administration panel in HTTPS), but not for the Site Address.
• Inform the user about potential problems even when the site is already using HTTPS, for example if the SSL certificate was no longer valid.
• Always rely on fresh information for determining HTTPS support issues in Site Health, and therefore change the https_status test to become asynchronous.
• Rename the new private wp_is_owned_html_output() function to a more appropriate wp_is_local_html_output().

Props adamsilverstein, flixos90, johnjamesjacoby, timothyblynjacobs.
See #47577.

File:

• trunk/src/wp-admin/includes/class-wp-site-health.php (modified) (7 diffs)

trunk/src/wp-admin/includes/class-wp-site-health.php

@@ -109 +109 @@
             // Don't run https test on development environments.
             if ( $this->is_development_environment() ) {
-                unset( $tests['direct']['https_status'] );
+                unset( $tests['async']['https_status'] );
             }
 
@@ -1499 +1499 @@
      */
     public function get_test_https_status() {
+        // Enforce fresh HTTPS detection results. This is normally invoked by using cron, but for Site Health it should
+        // always rely on the latest results.
+        wp_update_https_detection_errors();
+
         $result = array(
             'label'       => __( 'Your website is using an active HTTPS connection' ),
@@ -1522 +1526 @@
 
         if ( ! wp_is_using_https() ) {
+            // If the website is not using HTTPS, provide more information about whether it is supported and how it can
+            // be enabled.
             $result['status'] = 'critical';
             $result['label']  = __( 'Your website does not use HTTPS' );
 
-            if ( is_ssl() ) {
-                $result['description'] = sprintf(
-                    '<p>%s</p>',
-                    sprintf(
-                        /* translators: %s: URL to General Settings screen. */
-                        __( 'You are accessing this website using HTTPS, but your <a href="%s">WordPress Address</a> is not set up to use HTTPS by default.' ),
-                        esc_url( admin_url( 'options-general.php' ) )
-                    )
-                );
+            if ( wp_is_site_url_using_https() ) {
+                if ( is_ssl() ) {
+                    $result['description'] = sprintf(
+                        '<p>%s</p>',
+                        sprintf(
+                            /* translators: %s: URL to Settings > General > Site Address. */
+                            __( 'You are accessing this website using HTTPS, but your <a href="%s">Site Address</a> is not set up to use HTTPS by default.' ),
+                            esc_url( admin_url( 'options-general.php' ) . '#home' )
+                        )
+                    );
+                } else {
+                    $result['description'] = sprintf(
+                        '<p>%s</p>',
+                        sprintf(
+                            /* translators: %s: URL to Settings > General > Site Address. */
+                            __( 'Your <a href="%s">Site Address</a> is not set up to use HTTPS.' ),
+                            esc_url( admin_url( 'options-general.php' ) . '#home' )
+                        )
+                    );
+                }
             } else {
-                $result['description'] = sprintf(
-                    '<p>%s</p>',
-                    sprintf(
-                        /* translators: %s: URL to General Settings screen. */
-                        __( 'Your <a href="%s">WordPress Address</a> is not set up to use HTTPS.' ),
-                        esc_url( admin_url( 'options-general.php' ) )
-                    )
-                );
+                if ( is_ssl() ) {
+                    $result['description'] = sprintf(
+                        '<p>%s</p>',
+                        sprintf(
+                            /* translators: 1: URL to Settings > General > WordPress Address, 2: URL to Settings > General > Site Address. */
+                            __( 'You are accessing this website using HTTPS, but your <a href="%1$s">WordPress Address</a> and <a href="%2$s">Site Address</a> are not set up to use HTTPS by default.' ),
+                            esc_url( admin_url( 'options-general.php' ) . '#siteurl' ),
+                            esc_url( admin_url( 'options-general.php' ) . '#home' )
+                        )
+                    );
+                } else {
+                    $result['description'] = sprintf(
+                        '<p>%s</p>',
+                        sprintf(
+                            /* translators: 1: URL to Settings > General > WordPress Address, 2: URL to Settings > General > Site Address. */
+                            __( 'Your <a href="%1$s">WordPress Address</a> and <a href="%2$s">Site Address</a> are not set up to use HTTPS.' ),
+                            esc_url( admin_url( 'options-general.php' ) . '#siteurl' ),
+                            esc_url( admin_url( 'options-general.php' ) . '#home' )
+                        )
+                    );
+                }
             }
 
@@ -1562 +1592 @@
                 );
             }
+        } elseif ( ! wp_is_https_supported() ) {
+            // If the website is using HTTPS, but HTTPS is actually not supported, inform the user about the potential
+            // problems.
+            $result['status'] = 'critical';
+            $result['label']  = __( 'There are problems with the HTTPS connection of your website' );
+
+            $https_detection_errors = get_option( 'https_detection_errors' );
+            if ( ! empty( $https_detection_errors['ssl_verification_failed'] ) ) {
+                $result['description'] = sprintf(
+                    '<p>%s</p>',
+                    sprintf(
+                        /* translators: %s: URL to Settings > General > WordPress Address. */
+                        __( 'Your <a href="%s">WordPress Address</a> is set up to use HTTPS, but the SSL certificate appears to be invalid.' ),
+                        esc_url( admin_url( 'options-general.php' ) . '#siteurl' )
+                    )
+                );
+            } else {
+                $result['description'] = sprintf(
+                    '<p>%s</p>',
+                    sprintf(
+                        /* translators: %s: URL to Settings > General > WordPress Address. */
+                        __( 'Your <a href="%s">WordPress Address</a> is set up to use HTTPS, but your website appears to be unavailable when using an HTTPS connection.' ),
+                        esc_url( admin_url( 'options-general.php' ) . '#siteurl' )
+                    )
+                );
+            }
+            $result['description'] .= sprintf(
+                '<p>%s</p>',
+                __( 'Talk to your web host about resolving this HTTPS issue for your website.' )
+            );
         }
 
@@ -2201 +2261 @@
                     'test'  => 'utf8mb4_support',
                 ),
-                'https_status'              => array(
-                    'label' => __( 'HTTPS status' ),
-                    'test'  => 'https_status',
-                ),
                 'ssl_support'               => array(
                     'label' => __( 'Secure communication' ),
@@ -2248 +2304 @@
                     'has_rest'          => true,
                     'async_direct_test' => array( WP_Site_Health::get_instance(), 'get_test_loopback_requests' ),
+                ),
+                'https_status'         => array(
+                    'label'             => __( 'HTTPS status' ),
+                    'test'              => rest_url( 'wp-site-health/v1/tests/https-status' ),
+                    'has_rest'          => true,
+                    'async_direct_test' => array( WP_Site_Health::get_instance(), 'get_test_https_status' ),
                 ),
                 'authorization_header' => array(
@@ -2615 +2677 @@
         // Don't run https test on development environments.
         if ( $this->is_development_environment() ) {
-            unset( $tests['direct']['https_status'] );
+            unset( $tests['async']['https_status'] );
         }