CUNY Academic Commons

Thanks so much for working on this so quickly, Boone. Should we open a separate issue for a less heavy-handed fix or reopen this one?

Thanks, Ray. Somehow I missed the FORCE_SSL_ADMIN thing in 4.2. That definitely explains the problem in the 1.8 upgrade - WP 4.2 was part of it.

The 'login_url' filter seems OK, though I would generally prefer to force SSL in the admin. (With the exception of mapped domains.) Your suggestion means that SSL is optional for the admin, especially when people are already logged in and navigate to the dashboard using the toolbar links, etc.

The 'login_url' filter seems OK, though I would generally prefer to force SSL in the admin. (With the exception of mapped domains.)

If we want to enable SSL for logins and the admin area across the entire network except for mapped domains, then this code snippet might cover all instances:

/**
 * Determine if the current blog is domain mapped.
 *
 * Requires the WPMU Domain Mapping plugin.
 *
 * @return bool
 */
function cac_is_domain_mapping_enabled_for_current_blog() {
    if ( false === function_exists( 'get_original_url' ) ) {
        return false;
    }

    global $current_blog;

    $orig_domain = get_original_url( 'siteurl' );
    $orig_domain = substr( $orig_domain, strpos( $orig_domain, '://' ) + 3 );

    if ( $orig_domain !== $current_blog->domain ) {
        return true;
    }

    return false;
}

/**
 * Handles login and logout URLs
 */
add_filter( 'site_url', function( $retval ) {
    // if current blog is domain mapped, bail
    if ( cac_is_domain_mapping_enabled_for_current_blog() ) {
        return $retval;
    }

    if ( false === strpos( $retval, 'wp-login.php' ) ) {
        return $retval;
    }

    // set wp-login.php links to HTTPS
    return set_url_scheme( $retval, 'https' );
}, 30 );

/**
 * Handles wp-admin login redirects.
 */
add_filter( 'login_url', function( $retval, $redirect_to ) {
    // if current blog is domain mapped, bail
    if ( cac_is_domain_mapping_enabled_for_current_blog() ) {
        return $retval;
    }

    if ( empty( $redirect_to ) ) {
        return $retval;
    }

    if ( false === strpos( $redirect_to, 'wp-admin' ) ) {
        return $retval;
    }

    // set wp-admin redirect links to HTTPS
    $redirect_to = set_url_scheme( $redirect_to, 'https' );

    return add_query_arg( 'redirect_to', urlencode( $redirect_to ), $retval );
}, 30, 2 );

/**
 * Switch WP adminbar links to HTTPS.
 */
add_filter( 'admin_url', function( $retval ) {
    // we only want to alter WP adminbar links
    if ( ! did_action( 'admin_bar_menu' ) ) {
        return $retval;
    } 

    // if current blog is domain mapped, bail
    if ( cac_is_domain_mapping_enabled_for_current_blog() ) {
        return $retval;
    }

    // set admin to HTTPS
    return set_url_scheme( $retval, 'https' );
}, 30 );

I've tested this locally a bit, but might require some tweaking for some edge cases.

Thanks for this, Ray. The cac_is_domain_mapping_enabled_for_current_blog() function is a good idea and looks handy.

I still have the feeling that this is going to result in some non-SSL links leaking through. How about coming at this from the other direction? Set `FORCE_SSL_ADMIN` to true. Then:

function cac_set_admin_url_scheme( $url ) {
    if ( cac_is_domain_mapping_enabled_for_current_blog() ) {
        return $url;
    }

    if ( is_admin() ) {
        return $url;
    }

    return set_url_scheme( $url );
}
add_filter( 'admin_url', 'cac_set_admin_url_scheme' );

In other words, admin URLs will always be SSL, except on the front end, when the front end is viewed over HTTP. If you attempt to visit an admin page over an unencrypted connection, WP will handle the redirect because of FORCE_SSL_ADMIN during the auth_redirect() chain. This seems like it'll be less whack-a-molish than trying to find all the links that ought to be SSL.

That sounds way better!

On the frontend though, cac_set_admin_url_scheme() replaces admin bar links with 'http' instead of using 'https' for WP adminbar links.

To avoid the HTTP to HTTPS redirect done by FORCE_SSL_ADMIN, we could manually replace the adminbar links to HTTPS with:

function cac_set_admin_url_scheme_for_adminbar_links( $url ) {
    if ( is_admin() ) {
        return $url;
    } 

    // we only want to alter WP adminbar links
    if ( ! did_action( 'admin_bar_menu' ) ) {
        return $url;
    } 

    // if current blog is domain mapped, bail
    if ( cac_is_domain_mapping_enabled_for_current_blog() ) {
        return $url;
    }

    // set adminbar links to HTTPS
    return set_url_scheme( $url, 'https' );
}
add_filter( 'admin_url', 'cac_set_admin_url_scheme_for_adminbar_links', 20 );

This isn't really necessary though.

Let's try this on for size: https://github.com/cuny-academic-commons/cac/commit/3d33d31618b1c3158633404c7c0599035ad32254 Look OK to you, Ray? I won't be able to test fully until after release.