Use https for wp-pass.php if SSL login configured

[ryan]

get_the_password_form() should use https for the wp-pass.php link in the form action attribute if secure logins are configured. This is probably as easy as using site_url('wp-pass.php', 'login')

[Denis-de-Bernardy]

while we're on the same topic, this, in wp-pass.php, seems like garbage:

if ( get_magic_quotes_gpc() )
	$_POST['post_password'] = stripslashes($_POST['post_password']);

should be:

$_POST['post_password'] = stripslashes($_POST['post_password']);

[johnbillion]

I can see the thinking behind this suggestion, but inputting post passwords and logging into the admin area are two exclusive actions and the setting for one shouldn't have an affect on the other. The administration over SSL settings are for administration after all, not for visitors using the front end.

[ryan]

The login SSL settings are separate from the admin settings.

[Denis-de-Bernardy]

There also is the issue when the password is actually set in the editor. When a password is present, it should ideally send the request over SSL.

See also #10267 and #10268.

[Denis-de-Bernardy]

see also #9008

[nacin]

[19925]