Site icon URLs don't respect SSL in admin

[kasparsd]

It appears that the following check in wp_get_attachment_url():

if ( is_ssl() && ! is_admin() && 'wp-login.php' !== $GLOBALS['pagenow'] ) {
        $url = set_url_scheme( $url );
}

prevents get_site_icon_url() from using SSL for serving the icon links in the head, which results in non-HTTPS icon URLs on all admin pages:

[kasparsd]

Ensure the correct URL when served via SSL

[joemcgill]

Hi @kasparsd,

Thanks for the report. I believe this is the same root issue affecting #34109.

[kasparsd]

Yes, looks like it @joemcgill.

However, the attachment URLs are different because they might be inserted in post content, etc., while in this case we can safely assume that during is_ssl() the URLs should be HTTPS since they are used for HTML output only.

[ocean90]

#36119 was marked as a duplicate.

[johnbillion]

#36153 was marked as a duplicate.