Changeset 60734 for trunk/src/wp-includes/formatting.php

Timestamp:

09/12/2025 10:03:25 PM (11 months ago)

Author:

SergeyBiryukov

Message:

Formatting: Allow specifying https:// as the default protocol in esc_url().

esc_url() will now prepend https:// to the URL if it does not already contain a scheme and the first item in the $protocols array is 'https'.

Follow-up to [5088], [6015], [13299], [33851], [60672].

Props sabernhardt, mkaz, rachelbaker, audrasjb, costdev, aksl95, johnbillion, pcarvalho, SergeyBiryukov.
Fixes #52886.

File:

• trunk/src/wp-includes/formatting.php (modified) (2 diffs)

trunk/src/wp-includes/formatting.php

@@ -4643 +4643 @@
  *
  * @since 2.8.0
+ * @since 6.9.0 Prepends `https://` to the URL if it does not already contain a scheme
+ *              and the first item in `$protocols` is 'https'.
  *
  * @param string   $url       The URL to be cleaned.
@@ -4675 +4677 @@
          * If the URL doesn't appear to contain a scheme, we presume
          * it needs http:// prepended (unless it's a relative link
-         * starting with /, # or ?, or a PHP file).
+         * starting with /, # or ?, or a PHP file). If the first item
+         * in $protocols is 'https', then https:// is prepended.
          */
         if ( ! str_contains( $url, ':' ) && ! in_array( $url[0], array( '/', '#', '?' ), true ) &&
                 ! preg_match( '/^[a-z0-9-]+?\.php/i', $url )
         ) {
-                $url = 'http://' . $url;
+                $scheme = ( is_array( $protocols ) && 'https' === array_first( $protocols ) ) ? 'https://' : 'http://';
+                $url    = $scheme . $url;
         }