Remove admin and login exceptions for https in home_url

[herregroen]

Right now the home_url function will automatically switch to https if the current request is already https but will do so only on the front-end.

This was likely created in a time when running the admin with a self-signed certificate with the rest of the site running http was a common use-case.

Today is a very different situation thanks to initiatives like let's encrypt and many hosts providing certificates automatically or with little effort from site owners.

These exceptions may result in users being changed from https to http when navigating from within their admin. In addition it leads to inconsistent behavior of home_url where it will generate different values in the admin and on the frontend.

[mukesh27]

Hi there!

If we implement remote-home-url-https-exceptions.patch​ then we should remove global $pagenow; and there document from the function.

[SergeyBiryukov]

Thanks for the patch! It looks like there are some failing tests with this change that need updating:

1) Tests_REST_API::test_rest_url_scheme
Failed asserting that two strings are identical.
--- Expected
+++ Actual
@@ @@
-'http'
+'https'

S:\home\wordpress.test\develop\tests\phpunit\tests\rest-api.php:792

2) Tests_URL::test_home_url_from_admin
Failed asserting that two strings are identical.
--- Expected
+++ Actual
@@ @@
-'http://example.org'
+'https://example.org'

S:\home\wordpress.test\develop\tests\phpunit\tests\url.php:210

3) Tests_URL::test_network_home_url_from_admin
Failed asserting that two strings are identical.
--- Expected
+++ Actual
@@ @@
-'http://example.org'
+'https://example.org'

S:\home\wordpress.test\develop\tests\phpunit\tests\url.php:259

Working on that now.

[SergeyBiryukov]

In 50156:

General: Remove admin and login exceptions for https in get_home_url().

Previously, get_home_url() would automatically switch to https if the current request is already https, but would only do so on the front end.

This addresses the inconsistent behavior of returning different values in the admin and on the frontend.

Follow-up to [12598], [21937], [24844].

Props herregroen, mukesh27.
Fixes #52421.

[SergeyBiryukov]

This has introduced two other failures:

1) Tests_WP_Resource_Hints::test_dns_prefetch_scripts_does_not_included_registered_only
Undefined index: pagenow

/var/www/build/wp-includes/functions.wp-scripts.php:272
/var/www/tests/phpunit/tests/general/resourceHints.php:192

2) Tests_WP_Resource_Hints::test_deregistered_scripts_are_ignored
Undefined index: pagenow

/var/www/build/wp-includes/functions.wp-scripts.php:272
/var/www/tests/phpunit/tests/general/resourceHints.php:205

Restoring the $pagenow global appears to fix them. It's not quite clear why that happens, as the global is no longer used in the function, but let's address the failures for now and investigate later.

[SergeyBiryukov]

In 50164:

General: Restore the $pagenow global in get_home_url().

This fixes test failures in Tests_WP_Resource_Hints.

Follow-up to [50156].

See #52421.

[SergeyBiryukov]

In 50168:

General: Remove admin exception for https in network_home_url().

Previously, network_home_url() would automatically switch to https if the current request is already https, but would only do so on the front end.

This mirrors the change made earlier for get_home_url().

Follow-up to [12598], [21937], [24844], [50156].
See #52421.

[peterwilsoncc]

The test failure looks to be coming from either a poorly defined global in source, or erroniously reset global in the tests. Either way, it seems luck has caused the tests to pass until now and I wouldn't be surprised to discover other repairs to the global needed along the way.

@SergeyBiryukov are you still wanting to solve this during the 5.7 cycle or would you prefer it to be dealt with on another ticket?

[SergeyBiryukov]

Replying to peterwilsoncc:

are you still wanting to solve this during the 5.7 cycle or would you prefer it to be dealt with on another ticket?

Let's continue in #52566 :)

[SergeyBiryukov]

Replying to herregroen:

Right now the home_url function will automatically switch to https if the current request is already https but will do so only on the front-end.

For reference, just noting that wp_get_attachment_url()​ has a similar exception that may or may not need to be removed later. See [32342] / #32112.