[wp-trac] [WordPress Trac] #15928: wp_get_attachment_url does not check for HTTPS

[WordPress Trac]

#15928: wp_get_attachment_url does not check for HTTPS
--------------------------+-----------------------------
 Reporter:  atetlaw       |       Owner:  boonebgorges
     Type:  defect (bug)  |      Status:  accepted
 Priority:  normal        |   Milestone:  Future Release
Component:  Permalinks    |     Version:  3.0.3
 Severity:  major         |  Resolution:
 Keywords:  has-patch     |     Focuses:
--------------------------+-----------------------------
Changes (by boonebgorges):

 * keywords:  needs-patch 4.2-early => has-patch


Comment:

 joemcgill - Sorry that this ticket has gotten a bit lost in the shuffle.

 I think we're close to being ready with this patch, but I'm not totally
 clear on the tests in [attachment:15928.12.patch]. I was hoping I could
 get some clarification.

 In `test_wp_get_attachment_with_https_off()`, you are forcing
 `$_SERVER['https']` to `off`. But then, instead of doing a hard check that
 `set_url_scheme( $url, 'http' ) === $url`, you are fetching the scheme
 from `wp_upload_dir()`. Why the abstraction? Why are we checking that the
 URL is unchanged after being forced to the same scheme as
 `wp_upload_dir()`, instead of checking directly that the scheme is http?
 If we're testing more than one thing here, maybe we need two separate
 tests? Something similar is happening in the `diff_host` test.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/15928#comment:94>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform