Make WordPress Core

Opened 9 years ago

Closed 9 years ago

#4046 closed defect (bug) (fixed)

script-loader not https compatible

Reported by: abtime Owned by: rob1n
Milestone: 2.2 Priority: normal
Severity: normal Version: 2.1.2
Component: General Keywords: has-patch 2nd-opinion
Focuses: Cc:


When siteurl starts with https, the function _print_scripts in wp-includes/script-loader.php outputs a wrong url, because it checks for the existence of "http://" at the beginning of the url, and mistakenly prepends a second time the siteurl.

My patch:

Replace this line:

$src = 0 === strpos($this->scripts[$handle]->src, 'http://') ? $this->scripts[$handle]->src : get_option( 'siteurl' ) . $this->scripts[$handle]->src;

with this code:

$src = $this->scripts[$handle]->src;
if (!preg_match("/^https?:\/\//", $src)) {
  $src = get_option( 'siteurl' ) . $src;

Attachments (3)

script-loader.php.diff (858 bytes) - added by abtime 9 years ago.
4046-regex.diff (808 bytes) - added by rob1n 9 years ago.
Regex option.
4046-strpos.diff (964 bytes) - added by rob1n 9 years ago.
Two strpos()'s.

Download all attachments as: .zip

Change History (8)

#1 @JeremyVisser
9 years ago

I had the same problem with my SSL backend, but I found a better solution was to filter "option_siteurl" dynamically, which had the advantage of fixing plugins as well.

I can't pretend my method was without its problems, though. WP-SlimStat got a little inaccurate with the URLS reported.

#2 @JeremyVisser
9 years ago

This is what I use on my site:

        Plugin Name: SSL Backend
        Plugin Author: Jeremy Visser

$swp_is_backend = ( false !== strpos($_SERVER['REQUEST_URI'], '/wp-admin/') );
$swp_should_ssl = ( $swp_is_backend || isset($_SERVER['HTTPS']) );

function swp_siteurl($url) {
// presumes siteurl is set to a http:// address in the options
        return str_replace('http', 'https', $url);

if ($swp_should_ssl)
        add_filter('option_siteurl', 'swp_siteurl');


Yeah, I know. I should be using preg_replace instead, but I can't be bothered to learn regular expressions properly.

#3 @rob1n
9 years ago

  • Milestone changed from 2.4 to 2.2
  • Owner changed from anonymous to rob1n
  • Priority changed from low to normal
  • Status changed from new to assigned

I think replacing the strpos() with either a preg_replace or two strpos()'s would be good. Working in patch for a regex solution.

9 years ago

Regex option.

9 years ago

Two strpos()'s.

#4 @rob1n
9 years ago

  • Keywords has-patch 2nd-opinion added

I'm not sure how much performance varies between the methods, but IMO we should strive for maximum speed especially for the script loader which is called on every page.

#5 @rob1n
9 years ago

  • Resolution set to fixed
  • Status changed from assigned to closed

(In [5145]) Add https:// support to script loader. Props abtime. fixes #4046

Note: See TracTickets for help on using tickets.