HTTPS local html detection RSD check is protocol specific

[TimothyBlynJacobs]

The wp_is_local_html_output function is used to check whether the output from the https detection loopback request comes from the WordPress site itself.

The first check is done is for RSD, but it checks specifically for the http version of the URL, whereas the other checks ignore the protocol.

In my testing environment at least, the RSD link header is output as an https url when the site is requested over https, and as such this check returns false. Incorrectly asserting in Site Health that I need to talk to my host about supporting HTTPS even though my site already supports it.

Tentatively milestoning for 5.7.

[lukecarbis]

@TimothyBlynJacobs That sounds like a bug specific to the changes to Site Health in the 5.7 beta, is that right? Possibly introduced by [49904]. Is this something we could get fixed in the next week before RC1 is out?

[TimothyBlynJacobs]

@lukecarbis Yep! Sorry for not including that in the original report! Yeah, I believe @flixos90 is planning on working on it this week.

• Updates the RSD link check in wp_is_local_html_output() to be protocol-agnostic as expected, like the other ones.
• Updates a minor issue in the REST API link check: The removal of the protocol should happen on the complete URL as included in the HTML output, which is run through esc_url. Before esc_url was called after removing the protocol which is not correct.

Trac ticket: https://core.trac.wordpress.org/ticket/52542

[flixos90]

@TimothyBlynJacobs I've added PR to address this bug. Can you review please?

[TimothyBlynJacobs]

Looks great to me!

[flixos90]

In 50391:

Security: Fix bug in wp_is_local_html_output().

Prior to this changeset, the check for the correct RSD link output was relying on a specific protocol, although it needs to accept both the HTTP and HTTPS version of the URL.

Props TimothyBlynJacobs.
Fixes #52542. See #47577.