Changeset 62894

Timestamp:

07/29/2026 08:00:07 AM (2 months ago)

Author:

westonruter

Message:

HTTP API: Pass the missing URL to the https_local_ssl_verify filter.

The filter has documented a $url parameter since 5.1.0, when r42682 added it to the transports in WP_Http_Streams and WP_Http_Curl. However, this new parameter was not passed to all instances of the filter being applied, resulting in a possible fatal error if a callback is expecting it.

These call sites were surfaced by the PHPStan extensions under development for this ticket, which are committed separately.

Developed as subset of ​https://github.com/WordPress/wordpress-develop/pull/12022.
Follow-up to r28781, r42682, r46230, r46231, r54043, r58128.

See #65376, #42186, #47957, #56041, #58281.

Location:

trunk/src

Files:

• wp-admin/includes/class-wp-automatic-updater.php (modified) (2 diffs)
• wp-admin/includes/class-wp-site-health.php (modified) (5 diffs)
• wp-admin/includes/file.php (modified) (2 diffs)
• wp-includes/cron.php (modified) (3 diffs)

trunk/src/wp-admin/includes/class-wp-automatic-updater.php

@@ -1786 +1786 @@
                 );
 
-                /** This filter is documented in wp-includes/class-wp-http-streams.php */
-                $sslverify = apply_filters( 'https_local_ssl_verify', false );
-
                 // Include Basic auth in the loopback request.
                 if ( isset( $_SERVER['PHP_AUTH_USER'] ) && isset( $_SERVER['PHP_AUTH_PW'] ) ) {
@@ -1805 +1802 @@
                 $needle_end   = "###### wp_scraping_result_end:$scrape_key ######";
                 $url          = add_query_arg( $scrape_params, home_url( '/' ) );
-                $response     = wp_remote_get( $url, compact( 'cookies', 'headers', 'timeout', 'sslverify' ) );
+
+                /** This filter is documented in wp-includes/class-wp-http-streams.php */
+                $sslverify = apply_filters( 'https_local_ssl_verify', false, $url );
+                $response  = wp_remote_get( $url, compact( 'cookies', 'headers', 'timeout', 'sslverify' ) );
 
                 if ( is_wp_error( $response ) ) {

trunk/src/wp-admin/includes/class-wp-site-health.php

@@ -2213 +2213 @@
                         'X-WP-Nonce'    => wp_create_nonce( 'wp_rest' ),
                 );
-                /** This filter is documented in wp-includes/class-wp-http-streams.php */
-                $sslverify = apply_filters( 'https_local_ssl_verify', false );
-
                 // Include Basic auth in loopback requests.
                 if ( isset( $_SERVER['PHP_AUTH_USER'] ) && isset( $_SERVER['PHP_AUTH_PW'] ) ) {
@@ -2230 +2227 @@
                         $url
                 );
+
+                /** This filter is documented in wp-includes/class-wp-http-streams.php */
+                $sslverify = apply_filters( 'https_local_ssl_verify', false, $url );
 
                 $r = wp_remote_get( $url, compact( 'cookies', 'headers', 'timeout', 'sslverify' ) );
@@ -3280 +3280 @@
                         'Cache-Control' => 'no-cache',
                 );
-                /** This filter is documented in wp-includes/class-wp-http-streams.php */
-                $sslverify = apply_filters( 'https_local_ssl_verify', false );
 
                 // Include Basic auth in loopback requests.
@@ -3289 +3287 @@
 
                 $url = site_url( 'wp-cron.php' );
+
+                /** This filter is documented in wp-includes/class-wp-http-streams.php */
+                $sslverify = apply_filters( 'https_local_ssl_verify', false, $url );
 
                 /*
@@ -3612 +3613 @@
 
                 /** This filter is documented in wp-includes/class-wp-http-streams.php */
-                $sslverify = apply_filters( 'https_local_ssl_verify', false );
+                $sslverify = apply_filters( 'https_local_ssl_verify', false, home_url( '/' ) );
 
                 $headers = array();

trunk/src/wp-admin/includes/file.php

@@ -542 +542 @@
                 );
 
-                /** This filter is documented in wp-includes/class-wp-http-streams.php */
-                $sslverify = apply_filters( 'https_local_ssl_verify', false );
-
                 // Include Basic auth in loopback requests.
                 if ( isset( $_SERVER['PHP_AUTH_USER'] ) && isset( $_SERVER['PHP_AUTH_PW'] ) ) {
@@ -584 +581 @@
                 }
 
-                $url                    = add_query_arg( $scrape_params, $url );
+                $url = add_query_arg( $scrape_params, $url );
+
+                /** This filter is documented in wp-includes/class-wp-http-streams.php */
+                $sslverify = apply_filters( 'https_local_ssl_verify', false, $url );
+
                 $r                      = wp_remote_get( $url, compact( 'cookies', 'headers', 'timeout', 'sslverify' ) );
                 $body                   = wp_remote_retrieve_body( $r );

trunk/src/wp-includes/cron.php

@@ -959 +959 @@
         set_transient( 'doing_cron', $doing_wp_cron );
 
+        $cron_url = add_query_arg( 'doing_wp_cron', $doing_wp_cron, site_url( 'wp-cron.php' ) );
+
         /**
          * Filters the cron request arguments.
@@ -983 +985 @@
                 'cron_request',
                 array(
-                        'url'  => add_query_arg( 'doing_wp_cron', $doing_wp_cron, site_url( 'wp-cron.php' ) ),
+                        'url'  => $cron_url,
                         'key'  => $doing_wp_cron,
                         'args' => array(
@@ -989 +991 @@
                                 'blocking'  => false,
                                 /** This filter is documented in wp-includes/class-wp-http-streams.php */
-                                'sslverify' => apply_filters( 'https_local_ssl_verify', false ),
+                                'sslverify' => apply_filters( 'https_local_ssl_verify', false, $cron_url ),
                         ),
                 ),