WordPress.org
Get WordPress

Make WordPress Core

Opened 5 years ago

Last modified 2 years ago

#46673 reopened defect (bug)

Update esc_url function (default https).

Reported by: aksl95's profile aksl95 Owned by:
Milestone: Priority: normal
Severity: normal Version:
Component: Formatting Keywords:
Focuses: Cc:

Description

Hello,

If by default the link doesn't contain a protocol, WordPress adds http. Today I think it's better to use https.

I think this is a position to take because in both cases (http or https) the redirection may be bad.

This ticket follows the modification of the protocol in the menu (#46312).

Attachments (1)

46673.diff​ (824 bytes) - added by aksl95 5 years ago.
Update esc_url function

Download all attachments as: .zip

Change History (5)

@aksl95
5 years ago

Update esc_url function

#1 @SergeyBiryukov
5 years ago

  • Component changed from General to Formatting

This ticket was mentioned in ​Slack in #core by mukeshpanchal27. ​View the logs.
5 years ago

#3 @johnbillion
5 years ago

  • Milestone Awaiting Review deleted
  • Resolution set to maybelater
  • Status changed from new to closed

Thanks for the patch @aksl95 , but this isn't a good idea because it's easy to break a link by setting its scheme to https when the site doesn't support HTTPS. Conversely, any website available over HTTPS is also available over HTTP and likely will be for the foreseeable future.

#4 @pcarvalho
2 years ago

  • Resolution maybelater deleted
  • Status changed from closed to reopened

Can this be reviewed?

Issues:
1- Having the ​http:// hardcoded makes less sense here, it doesn't look up to $protocols.

2- There's no way to use this function if I want to have ​https:// as default instead.

3- I'm also not sure about
" any website available over HTTPS is also available over HTTP and likely will be for the foreseeable future."

I would suggest then that it pops the first allowed $protocols.

Note: See TracTickets for help on using tickets.