1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
|
<?php
/**
* HTTPS migration functions.
*
* @package WordPress
* @since 5.7.0
*/
/**
* Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart.
*
* If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to
* add frontend filters to replace insecure site URLs that may be present in older database content. The
* {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior.
*
* @since 5.7.0
*
* @return bool True if insecure URLs should replaced, false otherwise.
*/
function wp_should_replace_insecure_home_url() {
$should_replace_insecure_home_url = wp_is_using_https()
&& get_option( 'https_migration_required' )
// For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using
// the same domain.
&& wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST );
/**
* Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart.
*
* If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can
* be used to disable that behavior, e.g. after having replaced URLs manually in the database.
*
* @since 5.7.0
*
* @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced.
*/
return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url );
}
/**
* Replaces insecure HTTP URLs to the site in the given content, if configured to do so.
*
* This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if
* determined via {@see wp_should_replace_insecure_home_url()}.
*
* @since 5.7.0
*
* @param string $content Content to replace URLs in.
* @return string Filtered content.
*/
function wp_replace_insecure_home_url( $content ) {
if ( ! wp_should_replace_insecure_home_url() ) {
return $content;
}
$https_url = home_url( '', 'https' );
$http_url = str_replace( 'https://', 'http://', $https_url );
// Also replace potentially escaped URL.
$escaped_https_url = str_replace( '/', '\/', $https_url );
$escaped_http_url = str_replace( '/', '\/', $http_url );
return str_replace(
array(
$http_url,
$escaped_http_url,
),
array(
$https_url,
$escaped_https_url,
),
$content
);
}
/**
* Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL.
*
* If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants
* overriding the URLs used), the changes will be reverted. In such a case the function will return false.
*
* @since 5.7.0
*
* @return bool True on success, false on failure.
*/
function wp_update_urls_to_https() {
// Get current URL options.
$orig_home = get_option( 'home' );
$orig_siteurl = get_option( 'siteurl' );
// Get current URL options, replacing HTTP with HTTPS.
$home = str_replace( 'http://', 'https://', $orig_home );
$siteurl = str_replace( 'http://', 'https://', $orig_siteurl );
// Update the options.
update_option( 'home', $home );
update_option( 'siteurl', $siteurl );
if ( ! wp_is_using_https() ) {
/*
* If this did not result in the site recognizing HTTPS as being used,
* revert the change and return false.
*/
update_option( 'home', $orig_home );
update_option( 'siteurl', $orig_siteurl );
return false;
}
// Otherwise the URLs were successfully changed to use HTTPS.
return true;
}
/**
* Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS.
*
* If this is a fresh site, a migration will not be required, so the option will be set as `false`.
*
* This is hooked into the {@see 'update_option_home'} action.
*
* @since 5.7.0
* @access private
*
* @param mixed $old_url Previous value of the URL option.
* @param mixed $new_url New value of the URL option.
*/
function wp_update_https_migration_required( $old_url, $new_url ) {
// Do nothing if WordPress is being installed.
if ( wp_installing() ) {
return;
}
// Delete/reset the option if the new URL is not the HTTPS version of the old URL.
if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) {
delete_option( 'https_migration_required' );
return;
}
// If this is a fresh site, there is no content to migrate, so do not require migration.
$https_migration_required = get_option( 'fresh_site' ) ? false : true;
update_option( 'https_migration_required', $https_migration_required );
}
|
