WordPress Multisite generates site URLs with http in SSL mode

[jammitch]

When WordPress Multisite generates a site URL (on blog creation or URL change), the function get_blogaddress_by_domain in ms-blogs.php hard-codes the protocol as http. This URL gets stored in the site's options table and propagated into uploaded files in the posts table. When the rest of the site is running on SSL, this causes many security warnings (if the non-secure version points to the same place) or dead images (if it does not).

Workaround: Manually fix any corrupted images in the posts table and site URLs in the options table, then add a pre_update_option_siteurl filter to check is_ssl and replace ​http:// with ​https:// when necessary.

Suggested fix: in get_blogaddress_by_domain, choose whether to use ​http:// or ​https:// based on the value of is_ssl().

[SergeyBiryukov]

#14867