Fix feed location check and force HTTPS over HTTP.

[message-dimke]

Changes proposed in this Pull Request:

• Replacing get_site_url with wp_get_upload_dir for the feed location check.
• Forcing HTTPS over HTTP for the feed location URI.

Additional details:

Changelog entry

Fix - Feed location URL matching.

[layoutd]

If a site doesn't use HTTPS, what will happen? Would it make sense to check is_ssl() to determine whether to force http or https? If the site doesn't have a valid certificate, would unconditionally forcing https still work?

[layoutd]

Also is this a draft still?

[message-dimke]

Hey, @layoutd !

I believe that for any e-commerce store SSL is a must. Most payment gateways require it, etc. To my understanding is_ssl won't give you any information if the website has SSL configured, it will tell you if the current page is served by HTTPS or not. I would always force HTTP to HTTPS.

[Copilot]

Pull request overview

This PR updates how the plugin detects/matches feed “location” URLs by basing comparisons on the uploads base URL (via wp_get_upload_dir()) instead of the site URL, and normalizes the feed URL scheme to HTTPS to avoid mismatches from HTTP upload URLs.

Changes:

• Update feed location matching logic to use uploads baseurl + PINTEREST_FOR_WOOCOMMERCE_LOG_PREFIX prefix (instead of get_site_url()).
• Force HTTPS scheme when building local feed URLs and when matching feed locations.
• Update unit tests to mock uploads baseurl via the upload_dir filter.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
tests/Unit/FeedsTest.php	Adjusts tests to stub uploads base URL via upload_dir filter for feed-location matching.
src/LocalFeedConfigs.php	Forces HTTPS when generating the feed URL base derived from uploads baseurl.
src/Feeds.php	Switches feed location matching from get_site_url() to uploads baseurl + prefix, forcing HTTPS.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The comment says "HTTP schema", but for URLs the correct term is "scheme". Please update to avoid confusion.

Suggested change

	// Some sites may be misconfigured and return HTTP schema for the feed location URL. We force it to become HTTPS.
	// Some sites may be misconfigured and return HTTP scheme for the feed location URL. We force it to become HTTPS.

[Copilot]

does_feed_match() is called inside loops over remote feeds; calling wp_get_upload_dir() each time can be unnecessarily expensive and may behave inconsistently if upload_dir is filtered dynamically. Consider computing the normalized base URL/prefix once (e.g., in the caller or via a cached/static value) and reusing it for all comparisons.

Suggested change

	// Some sites may be misconfigured and return HTTP schema for the feed location URL. We force it to become HTTPS.
	$force_https = str_replace( 'http:', 'https:', wp_get_upload_dir()['baseurl'] );
	$feed_location = trailingslashit( $force_https ) . PINTEREST_FOR_WOOCOMMERCE_LOG_PREFIX . '-';
	return 0 === strpos( $feed['location'] ?? '', $feed_location );
	static $feed_location_prefix = null;
	if ( null === $feed_location_prefix ) {
	// Some sites may be misconfigured and return HTTP schema for the feed location URL. We force it to become HTTPS.
	$force_https = str_replace( 'http:', 'https:', wp_get_upload_dir()['baseurl'] );
	$feed_location_prefix = trailingslashit( $force_https ) . PINTEREST_FOR_WOOCOMMERCE_LOG_PREFIX . '-';
	}
	return 0 === strpos( $feed['location'] ?? '', $feed_location_prefix );

[Copilot]

wp_get_upload_dir() is called multiple times here; it’s cleaner and avoids repeated work to store the result in a local variable and use it for both basedir and baseurl. Also, WordPress provides set_url_scheme( $url, 'https' ) which is more robust than a raw str_replace when forcing HTTPS.

[simplysaru]

@copilot apply changes based on this feedback

[Copilot]

If a site doesn't use HTTPS, what will happen? Would it make sense to check is_ssl() to determine whether to force http or https? If the site doesn't have a valid certificate, would unconditiona...

The HTTPS forcing is applied consistently in both places — when the feed URL is first created/registered with Pinterest (LocalFeedConfigs.php) and when matching against it (Feeds.php). Since both sides normalize to HTTPS, the comparison stays consistent regardless of the site's SSL status.

For sites without a valid certificate, the feed URL would be HTTPS in Pinterest's records but the file might not be reachable over HTTPS — that's a broader hosting configuration issue separate from URL matching. Checking is_ssl() would actually cause a mismatch: if the site later enables SSL, the newly forced-HTTPS URL in LocalFeedConfigs wouldn't match the previously HTTP-registered URL at Pinterest. The current unconditional normalization avoids that inconsistency.