Theme previewing fails because of mixed content errors (SSL)

[stephdau]

I'm getting mixed content errors while trying to preview not-yet-installed themes inside a WP install running under SSL.

This happens because we try to load the theme preview from its originator, such as ​http://wp-themes.com/zinnia

Looks like the previewing should be "proxied" via the local install instead.

Samples errors:

[blocked] The page at 'https://localhost/~epsi/wptrunk/wp-admin/theme-install.php?theme=zinnia'
was loaded over HTTPS, but ran insecure content from 'http://wp-themes.com/zinnia': this content
should also be loaded over HTTPS.

[stephdau]

Actually, ​https://wp-themes.com/ is valid and working fine, so it'd probably just be a matter of moving to protocol-relative URLs (wp-themes.com/), if it is the only domain all themes are always previewed under.

[SergeyBiryukov]

Related: ​#meta344

[Otto42]

Note that ​https://wp-themes.com/ is valid and working fine now. It was not yesterday. :)

We still need to go through and SSL all-the-things on that site, so using a protocol-relative URL is the correct way to go for core. That site will be made fully SSL capable, even if it is not quite there yet.

But yes, wp-themes.com is the official domain that theme previews will happen under for w.org.

[stephdau]

Replying to Otto42:

Note that ​https://wp-themes.com/ is valid and working fine now. It was not yesterday. :)

Heheh, nice timing. :)

We still need to go through and SSL all-the-things on that site, so using a protocol-relative URL is the correct way to go for core. That site will be made fully SSL capable, even if it is not quite there yet.

But yes, wp-themes.com is the official domain that theme previews will happen under for w.org.

Awesome, thanks Otto.

[helen]

Closing as a dupe of ​#meta344 - feel free to reopen if something needs to change in core to accommodate.