Insecure Content Warning appears when the Manage Themes page is loaded via HTTPS

[peaceablewhale]

When the Manage Themes page is loaded via HTTPS, the themes' screenshots and preview links may still be HTTP, causing broswer warnings.

[peaceablewhale]

Tested with PHP 5.2.9-2 NTS on IIS 7.5 via FastCGI.

[Denis-de-Bernardy]

get_option(home) != site_url() on sites that have the WP files in a separate folder.

[Denis-de-Bernardy]

that link can probably remain non-https, btw. what really counts are the screenshots, I suspect.

[peaceablewhale]

An insecure content warning will appear when the preview is loaded via the JavaScript

[Denis-de-Bernardy]

oh, ok. in this case, we'd want to str_replace() the thingy if ssl is enabled.

[peaceablewhale]

Do we need to define a "home_url" function in link-template.php?

[Denis-de-Bernardy]

That would be ideal imo, but I'm not sure such a function would make it into 2.8 -- since it's on the 2.9 todo list.

[peaceablewhale]

I have uploaded a new patch that uses get_option(home) with the protocal removed.

[peaceablewhale]

Updated regex to do case-insensive match. Also tested on the same platform.

[Denis-de-Bernardy]

let's hope the committers get this fixed in 2.8...

[azaozz]

Replying to peaceablewhale: This regex won't work for all browsers. Some would always prepend http when the protocol is missing so removing it won't make them add the right one. This is not the same as the baseurl that the browsers calculate internally including the right protocol.

[peaceablewhale]

I have tested that the regex works at least with IE7, IE8, Firefox 3, Opera 10 and Safari 4. The relative URI is also valid per ​http://tools.ietf.org/html/rfc3986#section-4.2.

[peaceablewhale]

Since the recent versions of all major browsers support the regex, I suggest checking in the patch.

[azaozz]

Fixed in [11539].

I think you see which browser is missing above :) With about 20% of the people still using IE6 don't think we should exclude it. Also there are several ways to do that.

[peaceablewhale]

Actually I didn't test my patch with IE6 simply because I don't have it :)

Thanks for checking in a better patch anyway!