From afd88e2a10cc17a45af55cb2d4a0a2eeae5eddb2 Mon Sep 17 00:00:00 2001 From: hbhalodia Date: Thu, 23 Jul 2026 15:18:26 +0530 Subject: [PATCH 1/5] Fix site logo on site with https but stored without ssl --- src/wp-includes/general-template.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wp-includes/general-template.php b/src/wp-includes/general-template.php index 29c30137e173d..4334fd0c5c1c9 100644 --- a/src/wp-includes/general-template.php +++ b/src/wp-includes/general-template.php @@ -1182,7 +1182,7 @@ function get_site_icon_url( $size = 512, $url = '', $blog_id = 0 ) { } $attachment_url = wp_get_attachment_image_url( $site_icon_id, $size_data ); if ( $attachment_url ) { - $url = $attachment_url; + $url = set_url_scheme( $attachment_url ); } } From 1a3ad282cd51d700c4d813a2ca695bd0701c6c12 Mon Sep 17 00:00:00 2001 From: hbhalodia Date: Thu, 23 Jul 2026 15:38:33 +0530 Subject: [PATCH 2/5] Add tests for the changes --- tests/phpunit/tests/general/template.php | 42 ++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/tests/phpunit/tests/general/template.php b/tests/phpunit/tests/general/template.php index 00b683971a6a0..d2df367c18004 100644 --- a/tests/phpunit/tests/general/template.php +++ b/tests/phpunit/tests/general/template.php @@ -138,6 +138,48 @@ public function test_get_site_icon_url_returns_fallback_when_attachment_url_fail $this->assertSame( $fallback, $url, 'Fallback URL should be returned when attachment URL lookup fails.' ); } + /** + * Ensures the site icon URL scheme is aligned with the current request. + * + * The site icon is display chrome that also renders in wp-admin and on the + * login screen, where wp_get_attachment_url() does not correct the scheme. + * + * On an HTTPS request with an http:// siteurl the icon must still be served + * over HTTPS to avoid a broken, mixed-content image. + * + * @ticket 65696 + * @group site_icon + * @covers ::get_site_icon_url + * @requires function imagejpeg + */ + public function test_get_site_icon_url_uses_https_scheme_on_ssl_admin_request() { + $this->set_site_icon(); + + set_current_screen( 'dashboard' ); + $this->assertTrue( is_admin(), 'Test should run in the admin context.' ); + + $url_http = get_site_icon_url(); + + // Simulate the same admin request served over HTTPS. + $_SERVER['HTTPS'] = 'on'; + $url_https = get_site_icon_url(); + + unset( $_SERVER['HTTPS'] ); + + set_current_screen( 'front' ); + + $this->assertStringStartsWith( + 'https://', + $url_https, + 'Site icon URL should use the HTTPS scheme on an SSL admin request.' + ); + $this->assertSame( + set_url_scheme( $url_http, 'https' ), + $url_https, + 'Only the URL scheme should differ between HTTP and HTTPS admin requests.' + ); + } + /** * @group site_icon * @covers ::site_icon_url From 1d70c7ae0f449378be8c5a677ed68e92401514f0 Mon Sep 17 00:00:00 2001 From: hbhalodia Date: Thu, 23 Jul 2026 15:49:06 +0530 Subject: [PATCH 3/5] Add spacing between the function doc comments --- tests/phpunit/tests/general/template.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/phpunit/tests/general/template.php b/tests/phpunit/tests/general/template.php index d2df367c18004..af72377eda74f 100644 --- a/tests/phpunit/tests/general/template.php +++ b/tests/phpunit/tests/general/template.php @@ -148,8 +148,11 @@ public function test_get_site_icon_url_returns_fallback_when_attachment_url_fail * over HTTPS to avoid a broken, mixed-content image. * * @ticket 65696 + * * @group site_icon + * * @covers ::get_site_icon_url + * * @requires function imagejpeg */ public function test_get_site_icon_url_uses_https_scheme_on_ssl_admin_request() { From c5481bea7be530a289382b234e7662053d8c7911 Mon Sep 17 00:00:00 2001 From: hbhalodia Date: Thu, 23 Jul 2026 16:18:00 +0530 Subject: [PATCH 4/5] Resolve copilot feedbacks --- tests/phpunit/tests/general/template.php | 28 ++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-) diff --git a/tests/phpunit/tests/general/template.php b/tests/phpunit/tests/general/template.php index af72377eda74f..f4f0fc7cc36b0 100644 --- a/tests/phpunit/tests/general/template.php +++ b/tests/phpunit/tests/general/template.php @@ -142,7 +142,7 @@ public function test_get_site_icon_url_returns_fallback_when_attachment_url_fail * Ensures the site icon URL scheme is aligned with the current request. * * The site icon is display chrome that also renders in wp-admin and on the - * login screen, where wp_get_attachment_url() does not correct the scheme. + * login screen, where wp_get_attachment_image_url() does not correct the scheme. * * On an HTTPS request with an http:// siteurl the icon must still be served * over HTTPS to avoid a broken, mixed-content image. @@ -158,16 +158,36 @@ public function test_get_site_icon_url_returns_fallback_when_attachment_url_fail public function test_get_site_icon_url_uses_https_scheme_on_ssl_admin_request() { $this->set_site_icon(); + $https_backup = isset( $_SERVER['HTTPS'] ) ? $_SERVER['HTTPS'] : null; + $port_backup = isset( $_SERVER['SERVER_PORT'] ) ? $_SERVER['SERVER_PORT'] : null; + set_current_screen( 'dashboard' ); $this->assertTrue( is_admin(), 'Test should run in the admin context.' ); + unset( $_SERVER['HTTPS'] ); + $_SERVER['SERVER_PORT'] = '80'; + + $this->assertFalse( is_ssl(), 'Baseline request should not be detected as SSL.' ); + $url_http = get_site_icon_url(); + $this->assertStringStartsWith( 'http://', $url_http, 'Baseline icon URL should use the HTTP scheme.' ); - // Simulate the same admin request served over HTTPS. $_SERVER['HTTPS'] = 'on'; - $url_https = get_site_icon_url(); + $this->assertTrue( is_ssl(), 'Request should now be detected as SSL.' ); - unset( $_SERVER['HTTPS'] ); + $url_https = get_site_icon_url(); + + if ( null === $https_backup ) { + unset( $_SERVER['HTTPS'] ); + } else { + $_SERVER['HTTPS'] = $https_backup; + } + + if ( null === $port_backup ) { + unset( $_SERVER['SERVER_PORT'] ); + } else { + $_SERVER['SERVER_PORT'] = $port_backup; + } set_current_screen( 'front' ); From 34ba3e329a0c3ef15509eee3b526c95853c059d4 Mon Sep 17 00:00:00 2001 From: hbhalodia Date: Fri, 24 Jul 2026 10:49:25 +0530 Subject: [PATCH 5/5] Address feedbacks --- tests/phpunit/tests/general/template.php | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/tests/phpunit/tests/general/template.php b/tests/phpunit/tests/general/template.php index f4f0fc7cc36b0..c31fdec184ab2 100644 --- a/tests/phpunit/tests/general/template.php +++ b/tests/phpunit/tests/general/template.php @@ -158,14 +158,10 @@ public function test_get_site_icon_url_returns_fallback_when_attachment_url_fail public function test_get_site_icon_url_uses_https_scheme_on_ssl_admin_request() { $this->set_site_icon(); - $https_backup = isset( $_SERVER['HTTPS'] ) ? $_SERVER['HTTPS'] : null; - $port_backup = isset( $_SERVER['SERVER_PORT'] ) ? $_SERVER['SERVER_PORT'] : null; - set_current_screen( 'dashboard' ); $this->assertTrue( is_admin(), 'Test should run in the admin context.' ); unset( $_SERVER['HTTPS'] ); - $_SERVER['SERVER_PORT'] = '80'; $this->assertFalse( is_ssl(), 'Baseline request should not be detected as SSL.' ); @@ -177,20 +173,6 @@ public function test_get_site_icon_url_uses_https_scheme_on_ssl_admin_request() $url_https = get_site_icon_url(); - if ( null === $https_backup ) { - unset( $_SERVER['HTTPS'] ); - } else { - $_SERVER['HTTPS'] = $https_backup; - } - - if ( null === $port_backup ) { - unset( $_SERVER['SERVER_PORT'] ); - } else { - $_SERVER['SERVER_PORT'] = $port_backup; - } - - set_current_screen( 'front' ); - $this->assertStringStartsWith( 'https://', $url_https,