Fix: Site icon in the toolbar is broken (mixed content) in the admin when siteurl is stored with http:// on an SSL site

src/wp-includes/general-template.php

@@ -1182,7 +1182,7 @@ function get_site_icon_url( $size = 512, $url = '', $blog_id = 0 ) {
 		}
 		$attachment_url = wp_get_attachment_image_url( $site_icon_id, $size_data );
 		if ( $attachment_url ) {
-			$url = $attachment_url;
+			$url = set_url_scheme( $attachment_url );
 		}
 	}
 

tests/phpunit/tests/general/template.php

@@ -138,6 +138,53 @@ public function test_get_site_icon_url_returns_fallback_when_attachment_url_fail
 		$this->assertSame( $fallback, $url, 'Fallback URL should be returned when attachment URL lookup fails.' );
 	}
 
+	/**
+	 * Ensures the site icon URL scheme is aligned with the current request.
+	 *
+	 * The site icon is display chrome that also renders in wp-admin and on the
+	 * login screen, where wp_get_attachment_image_url() does not correct the scheme.
+	 *
+	 * On an HTTPS request with an http:// siteurl the icon must still be served
+	 * over HTTPS to avoid a broken, mixed-content image.
+	 *
+	 * @ticket 65696
+	 *
+	 * @group site_icon
+	 *
+	 * @covers ::get_site_icon_url
+	 *
+	 * @requires function imagejpeg
+	 */
+	public function test_get_site_icon_url_uses_https_scheme_on_ssl_admin_request() {
+		$this->set_site_icon();
+
+		set_current_screen( 'dashboard' );
+		$this->assertTrue( is_admin(), 'Test should run in the admin context.' );
+
+		unset( $_SERVER['HTTPS'] );
+
+		$this->assertFalse( is_ssl(), 'Baseline request should not be detected as SSL.' );
+
+		$url_http = get_site_icon_url();
+		$this->assertStringStartsWith( 'http://', $url_http, 'Baseline icon URL should use the HTTP scheme.' );
+
+		$_SERVER['HTTPS'] = 'on';
+		$this->assertTrue( is_ssl(), 'Request should now be detected as SSL.' );
+
+		$url_https = get_site_icon_url();
+
+		$this->assertStringStartsWith(
+			'https://',
+			$url_https,
+			'Site icon URL should use the HTTPS scheme on an SSL admin request.'
+		);
+		$this->assertSame(
+			set_url_scheme( $url_http, 'https' ),
+			$url_https,
+			'Only the URL scheme should differ between HTTP and HTTPS admin requests.'
+		);
+	}
+
 	/**
 	 * @group site_icon
 	 * @covers ::site_icon_url