| @@ -77,10 +77,13 @@ | ||
| 77 | 77 | add_filter( 'wp_get_attachment_url', array( $this, 'fix_url_scheme' ), 10, 1 ); |
| 78 | 78 | add_filter( 'the_content', array( $this, 'fix_content_urls' ), 999 ); |
| 79 | 79 | add_filter( 'widget_text', array( $this, 'fix_content_urls' ), 999 ); |
| 80 | 80 | |
| 81 | - // The rewriters above only cover same-domain URLs; external | |
| 82 | - // http:// references need the browser-side CSP directive. | |
| 81 | + } | |
| 82 | + | |
| 83 | + // Its own setting since 2.9.8: the rewriters above are same-domain and | |
| 84 | + // harmless, this one governs everybody else's resources too. | |
| 85 | + if ( ! empty( $this->options['upgrade_insecure_requests'] ) ) { | |
| 83 | 86 | add_action( 'send_headers', array( $this, 'emit_upgrade_insecure_requests' ) ); |
| 84 | 87 | } |
| 85 | 88 | } |
| 86 | 89 | |
| @@ -92,8 +95,22 @@ | ||
| 92 | 95 | if ( is_ssl() ) { |
| 93 | 96 | return; |
| 94 | 97 | } |
| 95 | 98 | |
| 99 | + /* | |
| 100 | + * Only redirect when the site itself declares HTTPS. A site whose home | |
| 101 | + * URL is still http:// has not moved to HTTPS, and sending every request | |
| 102 | + * to an address that may not answer takes it offline outright. Read from | |
| 103 | + * the home option (which honours the WP_HOME constant through the | |
| 104 | + * option_home filter) rather than home_url(), so the answer is the | |
| 105 | + * address the site declares and not one derived from the current | |
| 106 | + * request. A site already on HTTPS has an https home URL and keeps | |
| 107 | + * redirecting exactly as before. | |
| 108 | + */ | |
| 109 | + if ( 0 !== strpos( (string) get_option( 'home' ), 'https://' ) ) { | |
| 110 | + return; | |
| 111 | + } | |
| 112 | + | |
| 96 | 113 | // Skip CLI |
| 97 | 114 | if ( defined( 'WP_CLI' ) && WP_CLI ) { |
| 98 | 115 | return; |
| 99 | 116 | } |
| @@ -292,31 +309,8 @@ | ||
| 292 | 309 | return $content; |
| 293 | 310 | } |
| 294 | 311 | |
| 295 | 312 | return $this->replace_http_with_https( $content ); |
| 296 | - } | |
| 297 | - | |
| 298 | - /** | |
| 299 | - * Update WordPress site URLs to HTTPS | |
| 300 | - * | |
| 301 | - * @return bool | |
| 302 | - */ | |
| 303 | - public function update_site_urls() { | |
| 304 | - $siteurl = get_option( 'siteurl' ); | |
| 305 | - $home = get_option( 'home' ); | |
| 306 | - $updated = false; | |
| 307 | - | |
| 308 | - if ( strpos( $siteurl, 'http://' ) === 0 ) { | |
| 309 | - update_option( 'siteurl', str_replace( 'http://', 'https://', $siteurl ) ); | |
| 310 | - $updated = true; | |
| 311 | - } | |
| 312 | - | |
| 313 | - if ( strpos( $home, 'http://' ) === 0 ) { | |
| 314 | - update_option( 'home', str_replace( 'http://', 'https://', $home ) ); | |
| 315 | - $updated = true; | |
| 316 | - } | |
| 317 | - | |
| 318 | - return $updated; | |
| 319 | 313 | } |
| 320 | 314 | |
| 321 | 315 | /** |
| 322 | 316 | * Check if site is properly configured for HTTPS |
