diff --git a/src/wp-admin/includes/class-wp-site-health.php b/src/wp-admin/includes/class-wp-site-health.php
index 9d3a455f23..c2f10fa72d 100644
--- a/src/wp-admin/includes/class-wp-site-health.php
+++ b/src/wp-admin/includes/class-wp-site-health.php
@@ -1502,6 +1502,8 @@ class WP_Site_Health {
// always rely on the latest results.
wp_update_https_detection_errors();
+ $default_update_url = wp_get_default_update_https_url();
+
$result = array(
'label' => __( 'Your website is using an active HTTPS connection' ),
'status' => 'good',
@@ -1514,9 +1516,8 @@ class WP_Site_Health {
__( 'An HTTPS connection is a more secure way of browsing the web. Many services now have HTTPS as a requirement. HTTPS allows you to take advantage of new features that can increase site speed, improve search rankings, and gain the trust of your visitors by helping to protect their online privacy.' )
),
'actions' => sprintf(
- '%s %s
',
- /* translators: Documentation explaining HTTPS and why it should be used. */
- esc_url( __( 'https://wordpress.org/support/article/why-should-i-use-https/' ) ),
+ '%s %s
',
+ esc_url( $default_update_url ),
__( 'Learn more about why you should use HTTPS' ),
/* translators: Accessibility text. */
__( '(opens in a new tab)' )
@@ -1580,16 +1581,54 @@ class WP_Site_Health {
__( 'HTTPS is already supported for your website.' )
);
- $result['actions'] = sprintf(
- '%s
',
- esc_url( admin_url( 'options-general.php' ) ),
- __( 'Update your site addresses' )
- );
+ if ( defined( 'WP_HOME' ) || defined( 'WP_SITEURL' ) ) {
+ $result['description'] .= sprintf(
+ '%s
',
+ sprintf(
+ /* translators: 1: wp-config.php, 2: WP_HOME, 3: WP_SITEURL */
+ __( 'However, your WordPress Address is currently controlled by a PHP constant and therefore cannot be updated. You need to edit your %1$s and remove or update the definitions of %2$s and %3$s.' ),
+ 'wp-config.php',
+ 'WP_HOME',
+ 'WP_SITEURL'
+ )
+ );
+ } elseif ( current_user_can( 'update_https' ) ) {
+ $default_direct_update_url = add_query_arg( 'action', 'update_https', wp_nonce_url( admin_url( 'site-health.php' ), 'wp_update_https' ) );
+ $direct_update_url = wp_get_direct_update_https_url();
+
+ if ( ! empty( $direct_update_url ) ) {
+ $result['actions'] = sprintf(
+ '%2$s %3$s
',
+ esc_url( $direct_update_url ),
+ __( 'Update your site to use HTTPS' ),
+ /* translators: Accessibility text. */
+ __( '(opens in a new tab)' )
+ );
+ } else {
+ $result['actions'] = sprintf(
+ '%2$s
',
+ esc_url( $default_direct_update_url ),
+ __( 'Update your site to use HTTPS' )
+ );
+ }
+ }
} else {
- $result['description'] .= sprintf(
- '%s
',
- __( 'Talk to your web host about supporting HTTPS for your website.' )
- );
+ // If host-specific "Update HTTPS" URL is provided, include a link.
+ $update_url = wp_get_update_https_url();
+ if ( $update_url !== $default_update_url ) {
+ $result['description'] .= sprintf(
+ '%s %s
',
+ esc_url( $update_url ),
+ __( 'Talk to your web host about supporting HTTPS for your website.' ),
+ /* translators: Accessibility text. */
+ __( '(opens in a new tab)' )
+ );
+ } else {
+ $result['description'] .= sprintf(
+ '%s
',
+ __( 'Talk to your web host about supporting HTTPS for your website.' )
+ );
+ }
}
} elseif ( ! wp_is_https_supported() ) {
// If the website is using HTTPS, but HTTPS is actually not supported, inform the user about the potential
diff --git a/src/wp-admin/site-health.php b/src/wp-admin/site-health.php
index b7cc728ef6..be81b957b3 100644
--- a/src/wp-admin/site-health.php
+++ b/src/wp-admin/site-health.php
@@ -14,6 +14,8 @@ if ( isset( $_GET['tab'] ) && 'debug' === $_GET['tab'] ) {
/** WordPress Administration Bootstrap */
require_once __DIR__ . '/admin.php';
+wp_reset_vars( array( 'action' ) );
+
$title = __( 'Site Health Status' );
if ( ! current_user_can( 'view_site_health_checks' ) ) {
@@ -27,6 +29,23 @@ if ( ! class_exists( 'WP_Site_Health' ) ) {
require_once ABSPATH . 'wp-admin/includes/class-wp-site-health.php';
}
+if ( 'update_https' === $action ) {
+ check_admin_referer( 'wp_update_https' );
+
+ if ( ! current_user_can( 'update_https' ) ) {
+ wp_die( __( 'Sorry, you are not allowed to update this site to HTTPS.' ), 403 );
+ }
+
+ if ( ! wp_is_https_supported() ) {
+ wp_die( __( 'It looks like HTTPS is not supported for your website at this point.' ) );
+ }
+
+ $result = wp_update_urls_to_https();
+
+ wp_redirect( add_query_arg( 'https_updated', (int) $result, wp_get_referer() ) );
+ exit;
+}
+
$health_check_site_status = WP_Site_Health::get_instance();
// Start by checking if this is a special request checking for the existence of certain filters.
@@ -41,6 +60,20 @@ require_once ABSPATH . 'wp-admin/admin-header.php';
+
+
+
+
+
+
diff --git a/src/wp-includes/capabilities.php b/src/wp-includes/capabilities.php
index ac976ff15c..9aecc3b06a 100644
--- a/src/wp-includes/capabilities.php
+++ b/src/wp-includes/capabilities.php
@@ -593,6 +593,14 @@ function map_meta_cap( $cap, $user_id, ...$args ) {
$caps[] = 'update_core';
}
break;
+ case 'update_https':
+ if ( is_multisite() && ! is_super_admin( $user_id ) ) {
+ $caps[] = 'do_not_allow';
+ } else {
+ $caps[] = 'manage_options';
+ $caps[] = 'update_core';
+ }
+ break;
case 'export_others_personal_data':
case 'erase_others_personal_data':
case 'manage_privacy_options':
diff --git a/src/wp-includes/default-filters.php b/src/wp-includes/default-filters.php
index 5efa182c2b..e8e0a84d45 100644
--- a/src/wp-includes/default-filters.php
+++ b/src/wp-includes/default-filters.php
@@ -176,6 +176,7 @@ add_filter( 'the_content', 'wpautop' );
add_filter( 'the_content', 'shortcode_unautop' );
add_filter( 'the_content', 'prepend_attachment' );
add_filter( 'the_content', 'wp_filter_content_tags' );
+add_filter( 'the_content', 'wp_replace_insecure_home_url' );
add_filter( 'the_excerpt', 'wptexturize' );
add_filter( 'the_excerpt', 'convert_smilies' );
@@ -183,6 +184,7 @@ add_filter( 'the_excerpt', 'convert_chars' );
add_filter( 'the_excerpt', 'wpautop' );
add_filter( 'the_excerpt', 'shortcode_unautop' );
add_filter( 'the_excerpt', 'wp_filter_content_tags' );
+add_filter( 'the_excerpt', 'wp_replace_insecure_home_url' );
add_filter( 'get_the_excerpt', 'wp_trim_excerpt', 10, 2 );
add_filter( 'the_post_thumbnail_caption', 'wptexturize' );
@@ -209,8 +211,11 @@ add_filter( 'widget_text_content', 'convert_smilies', 20 );
add_filter( 'widget_text_content', 'wpautop' );
add_filter( 'widget_text_content', 'shortcode_unautop' );
add_filter( 'widget_text_content', 'wp_filter_content_tags' );
+add_filter( 'widget_text_content', 'wp_replace_insecure_home_url' );
add_filter( 'widget_text_content', 'do_shortcode', 11 ); // Runs after wpautop(); note that $post global will be null when shortcodes run.
+add_filter( 'wp_get_custom_css', 'wp_replace_insecure_home_url' );
+
// RSS filters.
add_filter( 'the_title_rss', 'strip_tags' );
add_filter( 'the_title_rss', 'ent2ncr', 8 );
@@ -347,6 +352,9 @@ add_action( 'init', 'wp_schedule_https_detection' );
add_action( 'wp_https_detection', 'wp_update_https_detection_errors' );
add_filter( 'cron_request', 'wp_cron_conditionally_prevent_sslverify', 9999 );
+// HTTPS migration.
+add_action( 'update_option_home', 'wp_update_https_migration_required', 10, 2 );
+
// 2 Actions 2 Furious.
add_action( 'do_feed_rdf', 'do_feed_rdf', 10, 0 );
add_action( 'do_feed_rss', 'do_feed_rss', 10, 0 );
diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index 8a5826d865..75a2463b0d 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -7580,6 +7580,91 @@ function wp_direct_php_update_button() {
echo '';
}
+/**
+ * Gets the URL to learn more about updating the site to use HTTPS.
+ *
+ * This URL can be overridden by specifying an environment variable `WP_UPDATE_HTTPS_URL` or by using the
+ * {@see 'wp_update_https_url'} filter. Providing an empty string is not allowed and will result in the
+ * default URL being used. Furthermore the page the URL links to should preferably be localized in the
+ * site language.
+ *
+ * @since 5.7.0
+ *
+ * @return string URL to learn more about updating to HTTPS.
+ */
+function wp_get_update_https_url() {
+ $default_url = wp_get_default_update_https_url();
+
+ $update_url = $default_url;
+ if ( false !== getenv( 'WP_UPDATE_HTTPS_URL' ) ) {
+ $update_url = getenv( 'WP_UPDATE_HTTPS_URL' );
+ }
+
+ /**
+ * Filters the URL to learn more about updating the HTTPS version the site is running on.
+ *
+ * Providing an empty string is not allowed and will result in the default URL being used. Furthermore
+ * the page the URL links to should preferably be localized in the site language.
+ *
+ * @since 5.7.0
+ *
+ * @param string $update_url URL to learn more about updating HTTPS.
+ */
+ $update_url = apply_filters( 'wp_update_https_url', $update_url );
+ if ( empty( $update_url ) ) {
+ $update_url = $default_url;
+ }
+
+ return $update_url;
+}
+
+/**
+ * Gets the default URL to learn more about updating the site to use HTTPS.
+ *
+ * Do not use this function to retrieve this URL. Instead, use {@see wp_get_update_https_url()} when relying on the URL.
+ * This function does not allow modifying the returned URL, and is only used to compare the actually used URL with the
+ * default one.
+ *
+ * @since 5.7.0
+ * @access private
+ *
+ * @return string Default URL to learn more about updating to HTTPS.
+ */
+function wp_get_default_update_https_url() {
+ /* translators: Documentation explaining HTTPS and why it should be used. */
+ return __( 'https://wordpress.org/support/article/why-should-i-use-https/' );
+}
+
+/**
+ * Gets the URL for directly updating the site to use HTTPS.
+ *
+ * A URL will only be returned if the `WP_DIRECT_UPDATE_HTTPS_URL` environment variable is specified or
+ * by using the {@see 'wp_direct_update_https_url'} filter. This allows hosts to send users directly to
+ * the page where they can update their site to use HTTPS.
+ *
+ * @since 5.7.0
+ *
+ * @return string URL for directly updating to HTTPS or empty string.
+ */
+function wp_get_direct_update_https_url() {
+ $direct_update_url = '';
+
+ if ( false !== getenv( 'WP_DIRECT_UPDATE_HTTPS_URL' ) ) {
+ $direct_update_url = getenv( 'WP_DIRECT_UPDATE_HTTPS_URL' );
+ }
+
+ /**
+ * Filters the URL for directly updating the PHP version the site is running on from the host.
+ *
+ * @since 5.7.0
+ *
+ * @param string $direct_update_url URL for directly updating PHP.
+ */
+ $direct_update_url = apply_filters( 'wp_direct_update_https_url', $direct_update_url );
+
+ return $direct_update_url;
+}
+
/**
* Get the size of a directory.
*
diff --git a/src/wp-includes/https-migration.php b/src/wp-includes/https-migration.php
new file mode 100644
index 0000000000..b8b80d63f0
--- /dev/null
+++ b/src/wp-includes/https-migration.php
@@ -0,0 +1,140 @@
+force_wp_is_using_https( false );
+ $this->assertFalse( wp_should_replace_insecure_home_url() );
+
+ // Should still return false because HTTPS migration flag is not set.
+ $this->force_wp_is_using_https( true );
+ $this->assertFalse( wp_should_replace_insecure_home_url() );
+
+ // Should return false because HTTPS migration flag is marked as not required.
+ update_option( 'https_migration_required', '0' );
+ $this->assertFalse( wp_should_replace_insecure_home_url() );
+
+ // Should return true because HTTPS migration flag is marked as required.
+ update_option( 'https_migration_required', '1' );
+ $this->assertTrue( wp_should_replace_insecure_home_url() );
+
+ // Should be overridable via filter.
+ add_filter( 'wp_should_replace_insecure_home_url', '__return_false' );
+ $this->assertFalse( wp_should_replace_insecure_home_url() );
+ }
+
+ /**
+ * @ticket 51437
+ */
+ public function test_wp_replace_insecure_home_url() {
+ $http_url = home_url( '', 'http' );
+ $https_url = home_url( '', 'https' );
+
+ $http_block_data = array(
+ 'id' => 3,
+ 'url' => $http_url . '/wp-content/uploads/2021/01/image.jpg',
+ );
+ $https_block_data = array(
+ 'id' => 3,
+ 'url' => $https_url . '/wp-content/uploads/2021/01/image.jpg',
+ );
+
+ $content = '
+
+ This is a link.
+
+
+
+