Changeset 58822 for trunk/tests/phpunit/tests/avatar.php

Timestamp:

07/29/2024 01:57:11 AM (6 months ago)

Author:

peterwilsoncc

Message:

Users: Always use HTTPS URLs for Gravatar links.

Modifies gravatar image URLs to always use the HTTPS version from secure.gravatar.com.

Gravatar now redirects HTTP image requests to their HTTPS equivalent, resulting in redirects for sites running over an HTTP connection (is_ssl() === false). Since the introduction of HTTP/2 the use of sub-domains for different hashes ([1-3].gravatar.com) now represents a performance hinderance rather than improvement.

The scheme passed to get_avatar_data() is now ignored for the generation of Gravatar URLs but the setting retained to avoid introducing bugs for sites using either local avatars or third party providers.

Props neoxx, SergeyBiryukov, sippis, peterwilsoncc, mukesh27, costdev, dd32.
Fixes #37454.

File:

• trunk/tests/phpunit/tests/avatar.php (modified) (3 diffs)

trunk/tests/phpunit/tests/avatar.php

@@ -12 +12 @@
     public function test_get_avatar_url_gravatar_url() {
         $url = get_avatar_url( 1 );
-        $this->assertSame( preg_match( '|^http?://[0-9]+.gravatar.com/avatar/[0-9a-f]{32}\?|', $url ), 1 );
+        $this->assertSame( preg_match( '|^https?://secure.gravatar.com/avatar/[0-9a-f]{32}\?|', $url ), 1 );
     }
 
@@ -57 +57 @@
 
     /**
-     * @ticket 21195
+     * Ensures the get_avatar_url always returns an HTTPS scheme for gravatars.
+     *
+     * @ticket 21195
+     * @ticket 37454
+     *
+     * @covers ::get_avatar_url
      */
     public function test_get_avatar_url_scheme() {
         $url = get_avatar_url( 1 );
-        $this->assertSame( preg_match( '|^http://|', $url ), 1 );
+        $this->assertSame( preg_match( '|^https://|', $url ), 1, 'Avatars should default to the HTTPS scheme' );
 
         $args = array( 'scheme' => 'https' );
         $url  = get_avatar_url( 1, $args );
-        $this->assertSame( preg_match( '|^https://|', $url ), 1 );
+        $this->assertSame( preg_match( '|^https://|', $url ), 1, 'Requesting the HTTPS scheme should be respected' );
+
+        $args = array( 'scheme' => 'http' );
+        $url  = get_avatar_url( 1, $args );
+        $this->assertSame( preg_match( '|^https://|', $url ), 1, 'Requesting the HTTP scheme should return an HTTPS URL to avoid redirects' );
 
         $args = array( 'scheme' => 'lolcat' );
         $url  = get_avatar_url( 1, $args );
-        $this->assertSame( preg_match( '|^lolcat://|', $url ), 0 );
+        $this->assertSame( preg_match( '|^lolcat://|', $url ), 0, 'Unrecognized schemes should be ignored' );
+        $this->assertSame( preg_match( '|^https://|', $url ), 1, 'Unrecognized schemes should return an HTTPS URL' );
     }
 
@@ -258 +268 @@
 
         $this->assertTrue( is_avatar_comment_type( $comment_type ) );
-        $this->assertMatchesRegularExpression( '|^http?://[0-9]+.gravatar.com/avatar/[0-9a-f]{32}\?|', $actual_data['url'] );
+        $this->assertMatchesRegularExpression( '|^https?://secure.gravatar.com/avatar/[0-9a-f]{32}\?|', $actual_data['url'] );
     }