Automattic / Automattic/wp-super-cache
Admin-only SSL causes protocol to be attached to get_current_url_supercache_dir
Open
[Plugin] Super Cache
enhancement
- Dominant language
- PHP
- Stars
- 436
- Forks
- 130
- Avg merge
- 15h 11m
- Merged PRs (30d)
- 10
Description
We should do a better check of this.
If the site isn't all http or https, too easy for this to get tricked.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating get_current_url_supercache_dir and inspect how it determines the protocol when a site is not exclusively HTTP or HTTPS. Reproduce the mixed-protocol case, then verify that the resulting supercache directory URL is not tricked into using an incorrect protocol.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 32/100