WordPress.org

Forums

Image Widget
FORCE_SSL_ADMIN results in https:// links to image (13 posts)

  1. aerobrent
    Member
    Posted 3 years ago #

    I did not see this posted yet, but I notice that if I have FORCE_SSL_ADMIN configured for my site, and I insert images into the widget when logged in under SSL, the links that get stored pointing to the image source are HTTPS rather than HTTP. This is not always the desired result, and often is not desired at all.

    There doesn't seem to be a way to change the links except manually in the database. Does anyone know a work-around?

    Perhaps when inserting a photo, there needs to be a radio button to allow the selection of HTTP or HTTPS when serving up the image.

    - Brent

    http://wordpress.org/extend/plugins/image-widget/

  2. aerobrent
    Member
    Posted 3 years ago #

    I see where this is happening, and is the result of an "HTTPS" enhancement of the plugin a while back.

    if( $_SERVER["HTTPS"] == "on" ) {
    $instance['imageurl'] = str_replace('http://', 'https://', $instance['imageurl']);
    }

    The problem is that this is not a valid assumption. More often than not, people editing with FORCE_SSL_ADMIN enabled will not want their live content being served up via SSL. This is especially true if the live site has a self signed SSL cert.

    Perhaps this bit of HTTPS code could be reworked.

  3. Modern Tribe, Inc.
    Member
    Plugin Author

    Posted 3 years ago #

    You have any suggestions of a rewrite?

  4. TheFluffyDoneky
    Member
    Posted 3 years ago #

    Bump.

    if( $_SERVER["HTTPS"] == "on" ) {
    $instance['imageurl'] = str_replace('http://', 'https://', $instance['imageurl']);
    }

    Move it to image-widget/views/widget.php ?

  5. Peter Chester
    Modern Tribe
    Plugin Author

    Posted 3 years ago #

    you guys are awesome! I'm watching this closely and am eager to post the fix.

  6. Peter Chester
    Modern Tribe
    Plugin Author

    Posted 3 years ago #

    so basically what you're saying is that you've got the admin in https so the image widget is trying to put the images behind SSL?

  7. Peter Chester
    Modern Tribe
    Plugin Author

    Posted 3 years ago #

    Are you suggesting that that code should be removed? Or should we use if ( $_SERVER["HTTPS"] == "on" && !defined( 'FORCE_SSL_ADMIN' ) )?

    I added this code based on a user submission but never really tested it since it's never applied to me. I'm working in the blind on this one.

  8. aerobrent
    Member
    Posted 3 years ago #

    so basically what you're saying is that you've got the admin in https so the image widget is trying to put the images behind SSL?

    Yeah, that's the issue, but not sure of the best solution. You can't really assume the presence or lack of FORCE_SSL_ADMIN would indicate whether you want images to be served with HTTPS or not.

    Can the images be inserted with relative links? IE, HTTP or HTTPS isn't hard coded?

  9. Peter Chester
    Modern Tribe
    Plugin Author

    Posted 3 years ago #

    I don't know if it's safe to assume relative links. I am concerned that that sort of update might also break existing installs... but not sure without further investigation.

    I assume you're using FORCE_SSL_ADMIN. Is that just for the admin area?

    Here's another idea....

    Add a new constant just for the image widget. default to not using https at all. But if you defined FORCE_SSL_IMAGE_WIDGET to be true, and HTTPS is on, then the image widget uses https.

    That way people who need the existing https feature can reapply it simply by updating the wp-config.php file.

  10. TheFluffyDoneky
    Member
    Posted 3 years ago #

    If the site is loaded over HTTP, the image should be loaded over HTTP as well.
    If the site is loaded over HTTPS, the image should be loaded over HTTPS as well.

    My yesterdays hack was to add some nasty code to image-widget/views/widget.php (see line 19-25):

    http://pastebin.com/LaMxiUsF

    Not elegant, but working.

  11. Peter Chester
    Modern Tribe
    Plugin Author

    Posted 3 years ago #

    Cool Thanks! Here's what I'm thinking then...

    in the initialization i'll add this:

    add_filter( 'image_widget_image_url', array( $this, 'https_cleanup' ) );

    I'll update the view function as follows:

    /**
     * Widget frontend output
     *
     * @param array $args
     * @param array $instance
     * @author Modern Tribe, Inc. (Peter Chester)
     */
    function widget( $args, $instance ) {
    	extract( $args );
    	extract( $instance );
    	if ( !empty( $imageurl ) ) {
    		$title = apply_filters( 'widget_title', empty( $title ) ? '' : $title );
    		$imageurl = apply_filters( 'image_widget_image_url', $imageurl, $args, $instance );
    		include( $this->getTemplateHierarchy( 'widget' ) );
    	}
    }

    And add the following function:

    /**
     * Adjust the image url on output to account for SSL.
     *
     * @param string $imageurl
     * @return string $imageurl
     */
    function https_cleanup( $imageurl = '' ) {
    	if( isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on" ) {
    		$imageurl = str_replace('http://', 'https://', $imageurl);
    	} else {
    		$imageurl = str_replace('https://', 'http://', $imageurl);
    	}
    	return $imageurl;
    }

    And remove the previous HTTPS code. The benefit of this approach is that someone can choose to remove_filter to bypass this https prefixing or even do their own thing.

    I've updated trunk as such. I've tried it out as a non SSL / non HTTPS user and it's working fine but I haven't tested HTTPS / SSL.

    Can you guys test it out?

    http://downloads.wordpress.org/plugin/image-widget.zip
    - OR -
    http://plugins.svn.wordpress.org/image-widget/trunk

  12. TheFluffyDoneky
    Member
    Posted 3 years ago #

    Hmmm. Now all images no load over http, which is much better actually.

    Once I moved

    add_filter( 'image_widget_image_url', array( $this, 'https_cleanup' ) );

    out of admin_setup() and added it to the end of Tribe_Image_Widget() it's been working as expected.

    I'm happy as is. :)

  13. webaware
    Member
    Posted 2 years ago #

    @Peter Chester:

    • don't do your own HTTPS detect, use is_ssl(), it's more comprehensive
    • I wouldn't bother messing with fixing images for HTTP, they'll work
    • if you do want to make the images load on the page with the same protocol as the page, whether that's HTTP or HTTPS, just trim off the protocol: preg_replace('/^https?:/i', '', $imageurl);

    cheers,
    Ross

Topic Closed

This topic has been closed to new replies.

About this Plugin

  • Image Widget
  • Frequently Asked Questions
  • Support Threads
  • Reviews

About this Topic