• Nextgen Gallery and a few other plugins I have installed seem to never want to use https urls when the rest of the site does. I have tracked this down to fact that the get_option(‘siteurl’) is not filtered using is_ssl() to ensure the proper URL scheme. This means that any plugin (or theme or whatever) that makes use of a defined URL will always reference http instead of properly switching to https, since the defined URLs are always based on WP_CONTENT_URL (such as WP_PLUGIN_URL).

    The proper fix for this would ?probably? be for WP to modify their ‘wp-includes/default-filters.php’ file to have the filter listed below, but for now the easiest thing for me to do is to paste the code below in to my wp-settings.php file, just above the first reference to “WP_CONTENT_URL” (which is line 390 in WP ver 2.9).

    Search for:

    if ( !defined('WP_CONTENT_URL') )
    	define( 'WP_CONTENT_URL', get_option('siteurl') . '/wp-content'); // full url - WP_CONTENT_DIR is defined further up

    Replace with:

    // Fix the URL root for SSL
    function fix_ssl_siteurl($url) {
    	$scheme = (is_ssl() ? 'https' : 'http');
    	if(0 === strpos($url, 'http')) {
    		if(is_ssl())
    			$url = str_replace('https://', "{$scheme}://", $url);
    	}
    
        return $url;
    }
    add_filter('option_siteurl', fix_ssl_siteurl);
    add_filter('option_home', fix_ssl_siteurl);
    
    if ( !defined('WP_CONTENT_URL') )
    	define( 'WP_CONTENT_URL', get_option('siteurl') . '/wp-content'); // full url - WP_CONTENT_DIR is defined further up

    It would be great if this could be fixed in WordPress in the same manner than content_url() was recently added.

Viewing 3 replies - 1 through 3 (of 3 total)
  • Makes sense, shaunco. Why not see if this exists in Trac already, and if not, issue a ticket ?

    Thanks for the tip! I hope this security flaw is fixed in the next update!

    lesion

    (@lesion)

    if think you don’t need to use all that filters and checks, you can just use site_url and replace

    if ( !defined('WP_CONTENT_URL') )
    	define( 'WP_CONTENT_URL', get_option('siteurl') . '/wp-content');

    with

    if ( !defined('WP_CONTENT_URL') )
    	define( 'WP_CONTENT_URL', site_url( 'wp-content') );
Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘WP_CONTENT_URL based defines do not work over SSL (HTTPS)’ is closed to new replies.