Thanks very much - I’ll have a look into it!

BCG

http://talon.bogometer.com/wp/wp-content/plugins/nextgen-gallery/nggextractXML.php?gid=7

This will invoke the nextgen gallery plugin file nggextractXML.php.

It will go for wp-load.php in 2.6 which causes the init function of admin_ssl in https.php to run. That sets up as_ob_handler to run later as an output filter. When as_ob_handler is subquently called, the routine get_option (for get_option(”home”) or get_option(”siteurl”)) is not loaded for some reason. That causes the generation of the xml to fail for nextgen and so no slide show

I kludged around it with

if (!defined(’get-option’)) return $buffer;

But you may want to look into it.

The test setup on the VPS with the Shared SSL Cert on PodVenturesMedia.com
a) we are testing hush-t-scape.com/wp-admin
b) the “umbrella” company is podventuresmedia.com so the SSL is issued to it and NOT to the particular URL being tested. It is a “shared SSL” cert.
c) there are MANY URLs on the VPS with their own account and under the company - that will use this plugin (assuming it works).

1) We are wanting to use the plugin with the Shared SSL Cert for any of the WordPress sites on the VPS.
2) We’re only needing to protect the login and as the plugin has been designed to do.

Other possibly useful information:
And when I logout, the URL is:
https://hush-t-scape.com/wp-admin/ and with a “lock” in FireFox and on the screen with the expected Warning: Unknown: open_basedir restriction in effect.

When I attempt to log back in at http://hush-t-scape.com/wp-admin/
It logs me in automatically without asking for my password
which is not been set to be “saved.” ???

Note:
Under the settings for the Admin SSL plugin and
for the Shared SSL URL
Per our tech support at our VPS hosting company,
it is “https://hush-t-scape.com/wp-admin.

They said that although the cert. is issued to podventuresmedia.com
which is the main site on the VPS and our company URL,
the plugin’s Shared SSL URL setting should be set in Hush-T-Scape.com for the site that’s using the plugin:
https://hush-t-scape.com/wp-admin.

I really do appricate your work on the plugin and
your response to my email.

John

The default behaviour of Admin SSL is to secure the login process and user profile pages, not the entire wp-admin folder.

It is possible to do the latter, but I felt the performance hit is not worth securing every single page, but only those with passwords/confidential information on.

Can you confirm that the login process is secured with your Shared SSL?

bcg

The plugin version is 1.3.2.
My Browser is FireFox v3.0.3.
Under the Admin SSL settings page, the
Shared SSL URL is: https://podventuresmedia.com/wp-admin/

The test site on the VPS is Hush-T-Scape.com running WordPress 2.6.3.
When I log into the dashboard at http://www.hush-t-scape.com
the dashboard opens but without an SSL lock.

When I try to log into https://www.hush-t-scape.com (securely)
I get giberish as expected.

Any help you could provide would be greatly appricated
as we’d like to use this plugin and see it’s value in securing
a WordPress site.

John

This could work - but only for Private SSL. I’ll see what I can do for the next release - I need to check compatibility with WP 2.7 as well.

BCG

I do all my development locally before deploying to production servers and frequently take copies of the production databases for local use. When I do this, my Admin SSL settings are obviously enabled on my dev environment where I don’t have SSL set up, as it isn’t needed.

I’m envisioning something like a boolean WP_ADMIN_SSL definition. This will allow users to wrap it in conditionals and only have it enabled on certain environments (by checking the value of $_SERVER['HTTP_HOST'], for example), and not use it when it isn’t desirable.

(I realize, of course, that I can simply set up SSL locally as well, but I think a wp-config option would a much more practical solution.)

Thanks. Feel free to e-mail me if you have any questions or need clarification about this use case.

Absolutely - if you have Private SSL you can secure individual URLs - that is why the box is called ‘Additional URLs’ rather than ‘Additional Pages’.

So, if you wanted to secure site.com/blog/some-secure-page/ you would add ’some-secure-page/’ to the Additional URLs box.

BCG