Changeset 62953 for trunk/src/wp-includes/general-template.php

Timestamp:

07/31/2026 08:41:49 AM (5 weeks ago)

Author:

tyxla

Message:

Toolbar: Serve the site icon over HTTPS on SSL admin requests.

wp_get_attachment_url() intentionally limits its scheme correction to the front end, skipping it in the admin and on wp-login.php. Consequently, on a site whose siteurl option is still stored with http:// but which is served over TLS, get_site_icon_url() returned an http:// URL, and browsers blocked the site icon as mixed content in the admin bar and as the admin favicon.

Upgrade the attachment URL to https:// when the current request is served over SSL.

Includes a unit test asserting both the upgrade on an SSL admin request and the absence of a downgrade on a non-SSL one.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/12655.

Props hbhalodia, wildworks, mukesh27, tyxla, westonruter, youknowriad, fushar, mirmpro.
Fixes #65696.

File:

• trunk/src/wp-includes/general-template.php (modified) (1 diff)

trunk/src/wp-includes/general-template.php

@@ -1183 +1183 @@
                 $attachment_url = wp_get_attachment_image_url( $site_icon_id, $size_data );
                 if ( $attachment_url ) {
-                        $url = $attachment_url;
+                        $url = is_ssl() ? set_url_scheme( $attachment_url, 'https' ) : $attachment_url;
                 }
         }