Security Warning when customizing a theme

[mattrude]

When a site using https, when a user chooses 'customize theme' on the themes page (version 3.4-alpha-20032) a security warning is displayed stating that some content will not be display via a secure connection.

Looking deeper, the previewed theme dose not honor "define('FORCE_SSL_ADMIN', true);" and is out put via an insecure connection.

[ocean90]

And the current preview doesn't have a warning?

[ocean90]

20137.patch​ should work for links from get_permalink or wp_enqueue_script but not for hardcoded links.

Just a s/http/https/ could break things.

[mattrude]

Replying to ocean90:

And the current preview doesn't have a warning?

Correct, in 3.3.1, no error is displayed when previewing a theme under the same setup.

[koopersmith]

In [20051]:

Theme Customizer: Load the preview iframe with the same scheme as the admin to prevent security warnings. props ocean90. fixes #20137, see #19910.

[nacin]

Is there a reason for get_home_url( null, '/', $scheme ) rather than home_url( '/', $scheme )?

[koopersmith]

In [20057]:

Theme Customizer: Use home_url instead of get_home_url. props nacin, fixes #20137, see #19910.

[koopersmith]

Replying to nacin:

Is there a reason for get_home_url( null, '/', $scheme ) rather than home_url( '/', $scheme )?

Survey says... “No.” [20057]