<?php

[0] Fix | Delete

/**

[1] Fix | Delete

* HTTPS migration functions.

[2] Fix | Delete

*

[3] Fix | Delete

* @package WordPress

[4] Fix | Delete

* @since 5.7.0

[5] Fix | Delete

*/

[6] Fix | Delete

[7] Fix | Delete

/**

[8] Fix | Delete

* Checks whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart.

[9] Fix | Delete

*

[10] Fix | Delete

* If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`, causing WordPress to

[11] Fix | Delete

* add frontend filters to replace insecure site URLs that may be present in older database content. The

[12] Fix | Delete

* {@see 'wp_should_replace_insecure_home_url'} filter can be used to modify that behavior.

[13] Fix | Delete

*

[14] Fix | Delete

* @since 5.7.0

[15] Fix | Delete

*

[16] Fix | Delete

* @return bool True if insecure URLs should replaced, false otherwise.

[17] Fix | Delete

*/

[18] Fix | Delete

function wp_should_replace_insecure_home_url() {

[19] Fix | Delete

$should_replace_insecure_home_url = wp_is_using_https()

[20] Fix | Delete

&& get_option( 'https_migration_required' )

[21] Fix | Delete

// For automatic replacement, both 'home' and 'siteurl' need to not only use HTTPS, they also need to be using

[22] Fix | Delete

// the same domain.

[23] Fix | Delete

&& wp_parse_url( home_url(), PHP_URL_HOST ) === wp_parse_url( site_url(), PHP_URL_HOST );

[24] Fix | Delete

[25] Fix | Delete

/**

[26] Fix | Delete

* Filters whether WordPress should replace old HTTP URLs to the site with their HTTPS counterpart.

[27] Fix | Delete

*

[28] Fix | Delete

* If a WordPress site had its URL changed from HTTP to HTTPS, by default this will return `true`. This filter can

[29] Fix | Delete

* be used to disable that behavior, e.g. after having replaced URLs manually in the database.

[30] Fix | Delete

*

[31] Fix | Delete

* @since 5.7.0

[32] Fix | Delete

*

[33] Fix | Delete

* @param bool $should_replace_insecure_home_url Whether insecure HTTP URLs to the site should be replaced.

[34] Fix | Delete

*/

[35] Fix | Delete

return apply_filters( 'wp_should_replace_insecure_home_url', $should_replace_insecure_home_url );

[36] Fix | Delete

}

[37] Fix | Delete

[38] Fix | Delete

/**

[39] Fix | Delete

* Replaces insecure HTTP URLs to the site in the given content, if configured to do so.

[40] Fix | Delete

*

[41] Fix | Delete

* This function replaces all occurrences of the HTTP version of the site's URL with its HTTPS counterpart, if

[42] Fix | Delete

* determined via {@see wp_should_replace_insecure_home_url()}.

[43] Fix | Delete

*

[44] Fix | Delete

* @since 5.7.0

[45] Fix | Delete

*

[46] Fix | Delete

* @param string $content Content to replace URLs in.

[47] Fix | Delete

* @return string Filtered content.

[48] Fix | Delete

*/

[49] Fix | Delete

function wp_replace_insecure_home_url( $content ) {

[50] Fix | Delete

if ( ! wp_should_replace_insecure_home_url() ) {

[51] Fix | Delete

return $content;

[52] Fix | Delete

}

[53] Fix | Delete

[54] Fix | Delete

$https_url = home_url( '', 'https' );

[55] Fix | Delete

$http_url = str_replace( 'https://', 'http://', $https_url );

[56] Fix | Delete

[57] Fix | Delete

// Also replace potentially escaped URL.

[58] Fix | Delete

$escaped_https_url = str_replace( '/', '\/', $https_url );

[59] Fix | Delete

$escaped_http_url = str_replace( '/', '\/', $http_url );

[60] Fix | Delete

[61] Fix | Delete

return str_replace(

[62] Fix | Delete

array(

[63] Fix | Delete

$http_url,

[64] Fix | Delete

$escaped_http_url,

[65] Fix | Delete

),

[66] Fix | Delete

array(

[67] Fix | Delete

$https_url,

[68] Fix | Delete

$escaped_https_url,

[69] Fix | Delete

),

[70] Fix | Delete

$content

[71] Fix | Delete

);

[72] Fix | Delete

}

[73] Fix | Delete

[74] Fix | Delete

/**

[75] Fix | Delete

* Update the 'home' and 'siteurl' option to use the HTTPS variant of their URL.

[76] Fix | Delete

*

[77] Fix | Delete

* If this update does not result in WordPress recognizing that the site is now using HTTPS (e.g. due to constants

[78] Fix | Delete

* overriding the URLs used), the changes will be reverted. In such a case the function will return false.

[79] Fix | Delete

*

[80] Fix | Delete

* @since 5.7.0

[81] Fix | Delete

*

[82] Fix | Delete

* @return bool True on success, false on failure.

[83] Fix | Delete

*/

[84] Fix | Delete

function wp_update_urls_to_https() {

[85] Fix | Delete

// Get current URL options.

[86] Fix | Delete

$orig_home = get_option( 'home' );

[87] Fix | Delete

$orig_siteurl = get_option( 'siteurl' );

[88] Fix | Delete

[89] Fix | Delete

// Get current URL options, replacing HTTP with HTTPS.

[90] Fix | Delete

$home = str_replace( 'http://', 'https://', $orig_home );

[91] Fix | Delete

$siteurl = str_replace( 'http://', 'https://', $orig_siteurl );

[92] Fix | Delete

[93] Fix | Delete

// Update the options.

[94] Fix | Delete

update_option( 'home', $home );

[95] Fix | Delete

update_option( 'siteurl', $siteurl );

[96] Fix | Delete

[97] Fix | Delete

if ( ! wp_is_using_https() ) {

[98] Fix | Delete

// If this did not result in the site recognizing HTTPS as being used,

[99] Fix | Delete

// revert the change and return false.

[100] Fix | Delete

update_option( 'home', $orig_home );

[101] Fix | Delete

update_option( 'siteurl', $orig_siteurl );

[102] Fix | Delete

return false;

[103] Fix | Delete

}

[104] Fix | Delete

[105] Fix | Delete

// Otherwise the URLs were successfully changed to use HTTPS.

[106] Fix | Delete

return true;

[107] Fix | Delete

}

[108] Fix | Delete

[109] Fix | Delete

/**

[110] Fix | Delete

* Updates the 'https_migration_required' option if needed when the given URL has been updated from HTTP to HTTPS.

[111] Fix | Delete

*

[112] Fix | Delete

* If this is a fresh site, a migration will not be required, so the option will be set as `false`.

[113] Fix | Delete

*

[114] Fix | Delete

* This is hooked into the {@see 'update_option_home'} action.

[115] Fix | Delete

*

[116] Fix | Delete

* @since 5.7.0

[117] Fix | Delete

* @access private

[118] Fix | Delete

*

[119] Fix | Delete

* @param mixed $old_url Previous value of the URL option.

[120] Fix | Delete

* @param mixed $new_url New value of the URL option.

[121] Fix | Delete

*/

[122] Fix | Delete

function wp_update_https_migration_required( $old_url, $new_url ) {

[123] Fix | Delete

// Do nothing if WordPress is being installed.

[124] Fix | Delete

if ( wp_installing() ) {

[125] Fix | Delete

return;

[126] Fix | Delete

}

[127] Fix | Delete

[128] Fix | Delete

// Delete/reset the option if the new URL is not the HTTPS version of the old URL.

[129] Fix | Delete

if ( untrailingslashit( (string) $old_url ) !== str_replace( 'https://', 'http://', untrailingslashit( (string) $new_url ) ) ) {

[130] Fix | Delete

delete_option( 'https_migration_required' );

[131] Fix | Delete

return;

[132] Fix | Delete

}

[133] Fix | Delete

[134] Fix | Delete

// If this is a fresh site, there is no content to migrate, so do not require migration.

[135] Fix | Delete

$https_migration_required = get_option( 'fresh_site' ) ? false : true;

[136] Fix | Delete

[137] Fix | Delete

update_option( 'https_migration_required', $https_migration_required );

[138] Fix | Delete

}

[139] Fix | Delete

[140] Fix | Delete