IXR client doesn't properly handle XMLRPC over HTTPS

[bryanmaupin]

There are two problems with the IXR XMLRPC client:

1. The current IXR client code defaults to port 80, and isn't smart enough to know the port should be 443 if an https URL is sent.

2. The IXR client doesn't create an SSL connection even if the port is 443.

I first noticed this because we're using an apache redirect to redirect XMLRPC requests to SSL (except the RSD) to avoid sending passwords in clear text. Some clients (like windows live writer) use the blogger API instead of the wp API for wp sites. For wp multisite, blogger_getUsersBlogs() calls _multisite_getUsersBlogs(), which creates a new IXR XMLRPC client. But _multisite_getUsersBlogs() doesn't send a port number with the URL, so the IXR client defaults to port 80 (problem #1). Even if _multisite_getUsersBlogs() sent a port, the IXR client connection wouldn't be SSL (problem #2).

I'm also going to look into submitting this upstream.

[bryanmaupin]

patch for r17369

[dd32]

WordPress has it's own version of the client: ​http://core.trac.wordpress.org/browser/trunk/wp-includes/class-wp-http-ixr-client.php that should be used in preference to the IXR_Client base class, as it can handle server configurations and proxy servers better.

Unfortunately, It looks like that may also be affected by this, given it hard codes port 80 if it's not specified.

[dd32]

(Of course, this is only for 3.1+ #10588)

[garyc40]

fix WP_HTTP_IXR_Client

[garyc40]

@bryanmaupin : could you test the patch I just attached? It modifies WP_HTTP_IXR_Client instead of IXR_Client

[nacin]

Moving version to 3.0 as this would not be a regression.

[mdawaffe]

There's no need to change the scheme to "ssl://". wp_remote_post() handles all of that internally when it needs to.

Additionally, we should just let wp_remote_post() (or the underlying transports) handle the default ports for the given scheme.

Patch attached.

[nacin]

Looks good here.

[ryan]

In [17811]:

Properly handle https in ixr client. Props mdawaffe. fixes #16402

[Michael_K]

It appears that this issue is still there in WordPress 3.2:

• The XMLRPC-code still uses the IXR-client instead of the WP-HTTP-IXR-Client, so the patch appears to have not been applied.

• Testing WordPress 3.2 in an environment with multi-site and SSL (plus a DMZ that also uses SSL) still fails.

• Replacing IXR-Client with WP-HTTP-IXR-Client still does not get this working.

Please, see also #17541 for additional information.

Michael

[westi]

Replying to Michael_K:

It appears that this issue is still there in WordPress 3.2:

• The XMLRPC-code still uses the IXR-client instead of the WP-HTTP-IXR-Client, so the patch appears to have not been applied.

• Testing WordPress 3.2 in an environment with multi-site and SSL (plus a DMZ that also uses SSL) still fails.

• Replacing IXR-Client with WP-HTTP-IXR-Client still does not get this working.

Please, see also #17541 for additional information.

Lets use #17541 to track this and re-close this ticket.