WordPress.org

Make WordPress Core

Opened 3 years ago

Closed 3 years ago

#18931 closed defect (bug) (duplicate)

WordPress Multisite generates site URLs with http in SSL mode

Reported by: jammitch Owned by:
Milestone: Priority: normal
Severity: normal Version: 3.2.1
Component: Multisite Keywords:
Focuses: Cc:

Description

When WordPress Multisite generates a site URL (on blog creation or URL change), the function get_blogaddress_by_domain in ms-blogs.php hard-codes the protocol as http. This URL gets stored in the site's options table and propagated into uploaded files in the posts table. When the rest of the site is running on SSL, this causes many security warnings (if the non-secure version points to the same place) or dead images (if it does not).

Workaround: Manually fix any corrupted images in the posts table and site URLs in the options table, then add a pre_update_option_siteurl filter to check is_ssl and replace http:// with https:// when necessary.

Suggested fix: in get_blogaddress_by_domain, choose whether to use http:// or https:// based on the value of is_ssl().

Change History (1)

comment:1 SergeyBiryukov3 years ago

  • Milestone Awaiting Review deleted
  • Resolution set to duplicate
  • Status changed from new to closed
Note: See TracTickets for help on using tickets.