diff -r 0c4c93d6bc0c wp-admin/includes/class-wp-list-table.php --- a/wp-admin/includes/class-wp-list-table.php Fri Oct 21 17:16:52 2011 -0500 +++ b/wp-admin/includes/class-wp-list-table.php Mon Oct 24 11:14:55 2011 -0500 @@ -486,7 +486,7 @@ $current = $this->get_pagenum(); - $current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']; + $current_url = scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] ); $current_url = remove_query_arg( array( 'hotkeys_highlight_last', 'hotkeys_highlight_first' ), $current_url ); @@ -645,7 +645,7 @@ list( $columns, $hidden, $sortable ) = $this->get_column_info(); - $current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']; + $current_url = scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] ); $current_url = remove_query_arg( 'paged', $current_url ); if ( isset( $_GET['orderby'] ) ) diff -r 0c4c93d6bc0c wp-admin/includes/class-wp-themes-list-table.php --- a/wp-admin/includes/class-wp-themes-list-table.php Fri Oct 21 17:16:52 2011 -0500 +++ b/wp-admin/includes/class-wp-themes-list-table.php Mon Oct 24 11:14:55 2011 -0500 @@ -155,9 +155,7 @@ $parent_theme = $themes[$theme_name]['Parent Theme']; $theme_root = $themes[$theme_name]['Theme Root']; $theme_root_uri = $themes[$theme_name]['Theme Root URI']; - $preview_link = esc_url( get_option( 'home' ) . '/' ); - if ( is_ssl() ) - $preview_link = str_replace( 'http://', 'https://', $preview_link ); + $preview_link = scheme( esc_url( get_option( 'home' ) . '/' ) ); $preview_link = htmlspecialchars( add_query_arg( array( 'preview' => 1, 'template' => $template, 'stylesheet' => $stylesheet, 'preview_iframe' => true, 'TB_iframe' => 'true' ), $preview_link ) ); $preview_text = esc_attr( sprintf( __( 'Preview of “%s”' ), $title ) ); $tags = $themes[$theme_name]['Tags']; diff -r 0c4c93d6bc0c wp-admin/includes/meta-boxes.php --- a/wp-admin/includes/meta-boxes.php Fri Oct 21 17:16:52 2011 -0500 +++ b/wp-admin/includes/meta-boxes.php Mon Oct 24 11:14:55 2011 -0500 @@ -42,8 +42,6 @@ $preview_button = __( 'Preview Changes' ); } else { $preview_link = get_permalink( $post->ID ); - if ( is_ssl() ) - $preview_link = str_replace( 'http://', 'https://', $preview_link ); $preview_link = esc_url( apply_filters( 'preview_post_link', add_query_arg( 'preview', 'true', $preview_link ) ) ); $preview_button = __( 'Preview' ); } diff -r 0c4c93d6bc0c wp-admin/includes/plugin.php --- a/wp-admin/includes/plugin.php Fri Oct 21 17:16:52 2011 -0500 +++ b/wp-admin/includes/plugin.php Mon Oct 24 11:14:55 2011 -0500 @@ -877,10 +877,8 @@ if ( empty($icon_url) ) $icon_url = esc_url( admin_url( 'images/generic.png' ) ); - elseif ( is_ssl() && 0 === strpos($icon_url, 'http://') ) - $icon_url = 'https://' . substr($icon_url, 7); - $new_menu = array( $menu_title, $capability, $menu_slug, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url ); + $new_menu = array( $menu_title, $capability, $menu_slug, $page_title, 'menu-top ' . $hookname, $hookname, scheme($icon_url) ); if ( null === $position ) $menu[] = $new_menu; diff -r 0c4c93d6bc0c wp-admin/includes/post.php --- a/wp-admin/includes/post.php Fri Oct 21 17:16:52 2011 -0500 +++ b/wp-admin/includes/post.php Mon Oct 24 11:14:55 2011 -0500 @@ -1488,7 +1488,7 @@ foreach ( $mce_external_plugins as $name => $url ) { - if ( is_ssl() ) $url = str_replace('http://', 'https://', $url); + $url = scheme($url); $plugins[] = '-' . $name; @@ -1860,5 +1860,3 @@
- domain ) ?> + domain ) ?> - + diff -r 0c4c93d6bc0c wp-admin/setup-config.php --- a/wp-admin/setup-config.php Fri Oct 21 17:16:52 2011 -0500 +++ b/wp-admin/setup-config.php Mon Oct 24 11:14:55 2011 -0500 @@ -192,7 +192,7 @@ * @ignore */ function get_bloginfo() { - return ( ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . str_replace( $_SERVER['PHP_SELF'], '/wp-admin/setup-config.php', '' ) ); + return ( scheme( 'http://' . $_SERVER['HTTP_HOST'] ) ); } /**#@-*/ $secret_keys = wp_remote_get( 'https://api.wordpress.org/secret-key/1.1/salt/' ); diff -r 0c4c93d6bc0c wp-includes/canonical.php --- a/wp-includes/canonical.php Fri Oct 21 17:16:52 2011 -0500 +++ b/wp-includes/canonical.php Mon Oct 24 11:14:55 2011 -0500 @@ -40,11 +40,9 @@ if ( is_trackback() || is_search() || is_comments_popup() || is_admin() || !empty($_POST) || is_preview() || is_robots() || $is_IIS ) return; - if ( !$requested_url ) { + if ( ! $requested_url ) { // build the URL in the address bar - $requested_url = is_ssl() ? 'https://' : 'http://'; - $requested_url .= $_SERVER['HTTP_HOST']; - $requested_url .= $_SERVER['REQUEST_URI']; + $requested_url = scheme('http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']); } $original = @parse_url($requested_url); diff -r 0c4c93d6bc0c wp-includes/class-wp-admin-bar.php --- a/wp-includes/class-wp-admin-bar.php Fri Oct 21 17:16:52 2011 -0500 +++ b/wp-includes/class-wp-admin-bar.php Mon Oct 24 11:14:55 2011 -0500 @@ -3,14 +3,9 @@ var $changed_locale = false; var $menu; var $need_to_change_locale = false; - var $proto = 'http://'; var $user; function initialize() { - /* Set the protocol used throughout this code */ - if ( is_ssl() ) - $this->proto = 'https://'; - $this->user = new stdClass; $this->menu = new stdClass; diff -r 0c4c93d6bc0c wp-includes/class-wp-xmlrpc-server.php --- a/wp-includes/class-wp-xmlrpc-server.php Fri Oct 21 17:16:52 2011 -0500 +++ b/wp-includes/class-wp-xmlrpc-server.php Mon Oct 24 11:14:55 2011 -0500 @@ -1752,9 +1752,8 @@ global $current_blog; $domain = $current_blog->domain; $path = $current_blog->path . 'xmlrpc.php'; - $protocol = is_ssl() ? 'https' : 'http'; - - $rpc = new IXR_Client("$protocol://{$domain}{$path}"); + + $rpc = new IXR_Client(scheme("http://{$domain}{$path}")); $rpc->query('wp.getUsersBlogs', $args[1], $args[2]); $blogs = $rpc->getResponse(); diff -r 0c4c93d6bc0c wp-includes/feed.php --- a/wp-includes/feed.php Fri Oct 21 17:16:52 2011 -0500 +++ b/wp-includes/feed.php Mon Oct 24 11:14:55 2011 -0500 @@ -486,13 +486,7 @@ */ function self_link() { $host = @parse_url(home_url()); - $host = $host['host']; - echo esc_url( - 'http' - . ( (isset($_SERVER['https']) && $_SERVER['https'] == 'on') ? 's' : '' ) . '://' - . $host - . stripslashes($_SERVER['REQUEST_URI']) - ); + echo esc_url( $host['scheme'] . '://' . $host['host'] . stripslashes( $_SERVER['REQUEST_URI'] ) ); } /** diff -r 0c4c93d6bc0c wp-includes/functions.php --- a/wp-includes/functions.php Fri Oct 21 17:16:52 2011 -0500 +++ b/wp-includes/functions.php Mon Oct 24 11:14:55 2011 -0500 @@ -3622,6 +3622,64 @@ } /** + * Properly format the scheme of any URL based on SSL state. Safe for use with relative URLs + * + * @since 3.2.X + * + * @param string $url + * @return string A string representing a url with the proper scheme given the SSL state of this site + */ +function scheme( $url ) { + if (is_ssl()) { + $url = str_replace('http://', 'https://', $url); + } + else { + $url = str_replace('https://', 'http://', $url); + } + + return $url; +} + +/** + * Forces an ssl redirect for authentication if SSL is required and we're not currently using an HTTPS scheme + * + * @since 3.2.X + * + * @return bool true if request needs secure redirect + */ +function ssl_redirect() { + + $secure = ( is_ssl() || force_ssl_admin() ); + + $secure = apply_filters('secure_auth_redirect', $secure); + + // If https is required and request is http, redirect + if ( $secure && !is_ssl() && false !== strpos($_SERVER['REQUEST_URI'], 'wp-admin') ) { + do_ssl_redirect(); + } + + return $secure; +} + +/** + * Does actual redirect for https scheme + * + * @since 3.2.X + * + * @return null + */ +function do_ssl_redirect() { + + if ( 0 === strpos($_SERVER['REQUEST_URI'], 'http') ) { + wp_redirect(preg_replace('|^http://|', 'https://', $_SERVER['REQUEST_URI'])); + exit(); + } else { + wp_redirect('https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']); + exit(); + } +} + +/** * Whether SSL login should be forced. * * @since 2.6.0 @@ -3675,8 +3733,7 @@ if ( defined('WP_SITEURL') && '' != WP_SITEURL ) { $url = WP_SITEURL; } else { - $schema = is_ssl() ? 'https://' : 'http://'; - $url = preg_replace('|/wp-admin/.*|i', '', $schema . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']); + $url = preg_replace('|/wp-admin/.*|i', '', scheme('http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'])); } return rtrim($url, '/'); } diff -r 0c4c93d6bc0c wp-includes/link-template.php --- a/wp-includes/link-template.php Fri Oct 21 17:16:52 2011 -0500 +++ b/wp-includes/link-template.php Mon Oct 24 11:14:55 2011 -0500 @@ -1926,7 +1926,7 @@ * Retrieve the home url for the current site. * * Returns the 'home' option with the appropriate protocol, 'https' if - * is_ssl() and 'http' otherwise. If $scheme is 'http' or 'https', is_ssl() is + * is_ssl and 'http' otherwise. If $scheme is 'http' or 'https', is_ssl is * overridden. * * @package WordPress @@ -1946,7 +1946,7 @@ * Retrieve the home url for a given site. * * Returns the 'home' option with the appropriate protocol, 'https' if - * is_ssl() and 'http' otherwise. If $scheme is 'http' or 'https', is_ssl() is + * is_ssl and 'http' otherwise. If $scheme is 'http' or 'https', is_ssl is * overridden. * * @package WordPress @@ -1981,7 +1981,7 @@ * Retrieve the site url for the current site. * * Returns the 'site_url' option with the appropriate protocol, 'https' if - * is_ssl() and 'http' otherwise. If $scheme is 'http' or 'https', is_ssl() is + * is_ssl and 'http' otherwise. If $scheme is 'http' or 'https', is_ssl is * overridden. * * @package WordPress @@ -2001,7 +2001,7 @@ * Retrieve the site url for a given site. * * Returns the 'site_url' option with the appropriate protocol, 'https' if - * is_ssl() and 'http' otherwise. If $scheme is 'http' or 'https', is_ssl() is + * is_ssl and 'http' otherwise. If $scheme is 'http' or 'https', is_ssl is * overridden. * * @package WordPress @@ -2047,7 +2047,7 @@ * @since 2.6.0 * * @param string $path Optional path relative to the admin url - * @param string $scheme The scheme to use. Default is 'admin', which obeys force_ssl_admin() and is_ssl(). 'http' or 'https' can be passed to force those schemes. + * @param string $scheme The scheme to use. Default is 'admin', which obeys force_ssl_admin() and is_ssl. 'http' or 'https' can be passed to force those schemes. * @return string Admin url link with optional path appended */ function admin_url( $path = '', $scheme = 'admin' ) { @@ -2062,7 +2062,7 @@ * * @param int $blog_id (optional) Blog ID. Defaults to current blog. * @param string $path Optional path relative to the admin url - * @param string $scheme The scheme to use. Default is 'admin', which obeys force_ssl_admin() and is_ssl(). 'http' or 'https' can be passed to force those schemes. + * @param string $scheme The scheme to use. Default is 'admin', which obeys force_ssl_admin() and is_ssl. 'http' or 'https' can be passed to force those schemes. * @return string Admin url link with optional path appended */ function get_admin_url( $blog_id = null, $path = '', $scheme = 'admin' ) { @@ -2102,9 +2102,7 @@ * @return string Content url link with optional path appended. */ function content_url($path = '') { - $url = WP_CONTENT_URL; - if ( 0 === strpos($url, 'http') && is_ssl() ) - $url = str_replace( 'http://', 'https://', $url ); + $url = scheme( WP_CONTENT_URL ); if ( !empty($path) && is_string($path) && strpos($path, '..') === false ) $url .= '/' . ltrim($path, '/'); @@ -2136,8 +2134,7 @@ else $url = WP_PLUGIN_URL; - if ( 0 === strpos($url, 'http') && is_ssl() ) - $url = str_replace( 'http://', 'https://', $url ); + $url = scheme($url); if ( !empty($plugin) && is_string($plugin) ) { $folder = dirname(plugin_basename($plugin)); @@ -2155,7 +2152,7 @@ * Retrieve the site url for the current network. * * Returns the site url with the appropriate protocol, 'https' if - * is_ssl() and 'http' otherwise. If $scheme is 'http' or 'https', is_ssl() is + * is_ssl and 'http' otherwise. If $scheme is 'http' or 'https', is_ssl is * overridden. * * @package WordPress @@ -2195,7 +2192,7 @@ * Retrieve the home url for the current network. * * Returns the home url with the appropriate protocol, 'https' if - * is_ssl() and 'http' otherwise. If $scheme is 'http' or 'https', is_ssl() is + * is_ssl and 'http' otherwise. If $scheme is 'http' or 'https', is_ssl is * overridden. * * @package WordPress @@ -2231,7 +2228,7 @@ * @since 3.0.0 * * @param string $path Optional path relative to the admin url - * @param string $scheme The scheme to use. Default is 'admin', which obeys force_ssl_admin() and is_ssl(). 'http' or 'https' can be passed to force those schemes. + * @param string $scheme The scheme to use. Default is 'admin', which obeys force_ssl_admin() and is_ssl. 'http' or 'https' can be passed to force those schemes. * @return string Admin url link with optional path appended */ function network_admin_url( $path = '', $scheme = 'admin' ) { @@ -2253,7 +2250,7 @@ * @since 3.0.0 * * @param string $path Optional path relative to the admin url - * @param string $scheme The scheme to use. Default is 'admin', which obeys force_ssl_admin() and is_ssl(). 'http' or 'https' can be passed to force those schemes. + * @param string $scheme The scheme to use. Default is 'admin', which obeys force_ssl_admin() and is_ssl. 'http' or 'https' can be passed to force those schemes. * @return string Admin url link with optional path appended */ function user_admin_url( $path = '', $scheme = 'admin' ) { @@ -2272,7 +2269,7 @@ * @since 3.1.0 * * @param string $path Optional path relative to the admin url - * @param string $scheme The scheme to use. Default is 'admin', which obeys force_ssl_admin() and is_ssl(). 'http' or 'https' can be passed to force those schemes. + * @param string $scheme The scheme to use. Default is 'admin', which obeys force_ssl_admin() and is_ssl. 'http' or 'https' can be passed to force those schemes. * @return string Admin url link with optional path appended */ function self_admin_url($path = '', $scheme = 'admin') { @@ -2295,7 +2292,7 @@ * * @param int $user_id User ID * @param string $path Optional path relative to the dashboard. Use only paths known to both blog and user admins. - * @param string $scheme The scheme to use. Default is 'admin', which obeys force_ssl_admin() and is_ssl(). 'http' or 'https' can be passed to force those schemes. + * @param string $scheme The scheme to use. Default is 'admin', which obeys force_ssl_admin() and is_ssl. 'http' or 'https' can be passed to force those schemes. * @return string Dashboard url link with optional path appended */ function get_dashboard_url( $user_id, $path = '', $scheme = 'admin' ) { @@ -2328,7 +2325,7 @@ * @since 3.1.0 * * @param int $user User ID - * @param string $scheme The scheme to use. Default is 'admin', which obeys force_ssl_admin() and is_ssl(). 'http' or 'https' can be passed to force those schemes. + * @param string $scheme The scheme to use. Default is 'admin', which obeys force_ssl_admin() and is_ssl. 'http' or 'https' can be passed to force those schemes. * @return string Dashboard url link with optional path appended */ function get_edit_profile_url( $user, $scheme = 'admin' ) { diff -r 0c4c93d6bc0c wp-includes/ms-functions.php --- a/wp-includes/ms-functions.php Fri Oct 21 17:16:52 2011 -0500 +++ b/wp-includes/ms-functions.php Mon Oct 24 11:14:55 2011 -0500 @@ -2035,9 +2035,8 @@ $arrURL = parse_url( $url ); - if ( force_ssl_content() && is_ssl() ) { - if ( 'http' === $arrURL['scheme'] && 'https' !== $arrURL['scheme'] ) - $url = str_replace( $arrURL['scheme'], 'https', $url ); + if ( 'http' === $arrURL['scheme'] && force_ssl_content() && is_ssl() ) { + $url = str_replace( $arrURL['scheme'], 'https', $url ); } return $url; diff -r 0c4c93d6bc0c wp-includes/nav-menu-template.php --- a/wp-includes/nav-menu-template.php Fri Oct 21 17:16:52 2011 -0500 +++ b/wp-includes/nav-menu-template.php Mon Oct 24 11:14:55 2011 -0500 @@ -360,7 +360,7 @@ // if the menu item corresponds to the currently-requested URL } elseif ( 'custom' == $menu_item->object ) { - $current_url = untrailingslashit( ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] ); + $current_url = untrailingslashit( scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] ) ); $item_url = untrailingslashit( strpos( $menu_item->url, '#' ) ? substr( $menu_item->url, 0, strpos( $menu_item->url, '#' ) ) : $menu_item->url ); $_indexless_current = untrailingslashit( preg_replace( '/index.php$/', '', $current_url ) ); diff -r 0c4c93d6bc0c wp-includes/pluggable.php --- a/wp-includes/pluggable.php Fri Oct 21 17:16:52 2011 -0500 +++ b/wp-includes/pluggable.php Mon Oct 24 11:14:55 2011 -0500 @@ -799,20 +799,7 @@ function auth_redirect() { // Checks if a user is logged in, if not redirects them to the login page - $secure = ( is_ssl() || force_ssl_admin() ); - - $secure = apply_filters('secure_auth_redirect', $secure); - - // If https is required and request is http, redirect - if ( $secure && !is_ssl() && false !== strpos($_SERVER['REQUEST_URI'], 'wp-admin') ) { - if ( 0 === strpos($_SERVER['REQUEST_URI'], 'http') ) { - wp_redirect(preg_replace('|^http://|', 'https://', $_SERVER['REQUEST_URI'])); - exit(); - } else { - wp_redirect('https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']); - exit(); - } - } + $secure = ssl_redirect(); if ( is_user_admin() ) $scheme = 'logged_in'; @@ -824,13 +811,7 @@ // If the user wants ssl but the session is not ssl, redirect. if ( !$secure && get_user_option('use_ssl', $user_id) && false !== strpos($_SERVER['REQUEST_URI'], 'wp-admin') ) { - if ( 0 === strpos($_SERVER['REQUEST_URI'], 'http') ) { - wp_redirect(preg_replace('|^http://|', 'https://', $_SERVER['REQUEST_URI'])); - exit(); - } else { - wp_redirect('https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']); - exit(); - } + do_ssl_redirect(); } return; // The cookie is good so we're done @@ -839,16 +820,14 @@ // The cookie is no good so force login nocache_headers(); - if ( is_ssl() ) - $proto = 'https://'; - else - $proto = 'http://'; + if ( strpos($_SERVER['REQUEST_URI'], '/options.php') && wp_get_referer() ) { + $redirect = wp_get_referer(); + } + else { + $redirect = scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] ); + } - $redirect = ( strpos($_SERVER['REQUEST_URI'], '/options.php') && wp_get_referer() ) ? wp_get_referer() : $proto . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']; - - $login_url = wp_login_url($redirect, true); - - wp_redirect($login_url); + wp_redirect( wp_login_url($redirect, true) ); exit(); } endif; diff -r 0c4c93d6bc0c wp-includes/theme.php --- a/wp-includes/theme.php Fri Oct 21 17:16:52 2011 -0500 +++ b/wp-includes/theme.php Mon Oct 24 11:14:55 2011 -0500 @@ -1437,12 +1437,7 @@ if ( is_random_header_image() ) $url = get_random_header_image(); - if ( is_ssl() ) - $url = str_replace( 'http://', 'https://', $url ); - else - $url = str_replace( 'https://', 'http://', $url ); - - return esc_url_raw( $url ); + return esc_url_raw( scheme( $url ) ); } /** diff -r 0c4c93d6bc0c wp-login.php --- a/wp-login.php Fri Oct 21 17:16:52 2011 -0500 +++ b/wp-login.php Mon Oct 24 11:14:55 2011 -0500 @@ -12,15 +12,7 @@ require( dirname(__FILE__) . '/wp-load.php' ); // Redirect to https login if forced to use SSL -if ( force_ssl_admin() && !is_ssl() ) { - if ( 0 === strpos($_SERVER['REQUEST_URI'], 'http') ) { - wp_redirect(preg_replace('|^http://|', 'https://', $_SERVER['REQUEST_URI'])); - exit(); - } else { - wp_redirect('https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']); - exit(); - } -} +ssl_redirect(); /** * Outputs the header for the login page. @@ -356,9 +348,9 @@ if ( isset( $_SERVER['PATH_INFO'] ) && ($_SERVER['PATH_INFO'] != $_SERVER['PHP_SELF']) ) $_SERVER['PHP_SELF'] = str_replace( $_SERVER['PATH_INFO'], '', $_SERVER['PHP_SELF'] ); - $schema = is_ssl() ? 'https://' : 'http://'; - if ( dirname($schema . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF']) != get_option('siteurl') ) - update_option('siteurl', dirname($schema . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF']) ); + $path = dirname( scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] ) ); + if ( $path != get_option('siteurl') ) + update_option('siteurl', $path); } //Set a cookie now to see if they are supported by the browser. diff -r 0c4c93d6bc0c wp-signup.php --- a/wp-signup.php Fri Oct 21 17:16:52 2011 -0500 +++ b/wp-signup.php Mon Oct 24 11:14:55 2011 -0500 @@ -399,11 +399,7 @@ if ( $active_signup == 'none' ) { _e( 'Registration has been disabled.' ); } elseif ( $active_signup == 'blog' && !is_user_logged_in() ) { - if ( is_ssl() ) - $proto = 'https://'; - else - $proto = 'http://'; - $login_url = site_url( 'wp-login.php?redirect_to=' . urlencode($proto . $_SERVER['HTTP_HOST'] . '/wp-signup.php' )); + $login_url = site_url( 'wp-login.php?redirect_to=' . urlencode( scheme( 'http://' . $_SERVER['HTTP_HOST'] . '/wp-signup.php' ))); echo sprintf( __( 'You must first log in, and then you can create a new site.' ), $login_url ); } else { $stage = isset( $_POST['stage'] ) ? $_POST['stage'] : 'default';