From b58764ff99b43fee95fb2fafd580b1e7d6ac5e8d Mon Sep 17 00:00:00 2001
From: John Okely <jlokely@gmail.com>
Date: Thu, 14 Sep 2017 16:13:13 +0800
Subject: [PATCH 1/6] MDL-42834 admin: Remove loginhttps

---
 admin/settings/security.php   |  2 +-
 admin/settings/users.php      |  7 +------
 admin/user.php                | 10 ++--------
 blocks/login/block_login.php  |  8 +-------
 enrol/paypal/lib.php          |  8 +-------
 lang/en/admin.php             |  4 ++--
 lang/en/deprecated.txt        |  2 ++
 lib/moodlelib.php             | 22 ++--------------------
 lib/sessionlib.php            |  3 ---
 lib/setuplib.php              |  3 ---
 lib/tests/moodlelib_test.php  | 15 ++-------------
 lib/tests/sessionlib_test.php |  7 -------
 lib/tests/setuplib_test.php   | 27 +--------------------------
 lib/upgrade.txt               |  2 ++
 login/signup_form.php         |  2 +-
 15 files changed, 18 insertions(+), 104 deletions(-)

diff --git a/admin/settings/security.php b/admin/settings/security.php
index 061d4b1a83e..56b727acfe7 100644
--- a/admin/settings/security.php
+++ b/admin/settings/security.php
@@ -124,7 +124,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
 
     // "httpsecurity" settingpage
     $temp = new admin_settingpage('httpsecurity', new lang_string('httpsecurity', 'admin'));
-    $temp->add(new admin_setting_configcheckbox('loginhttps', new lang_string('loginhttps', 'admin'), new lang_string('configloginhttps', 'admin'), 0));
+
     $temp->add(new admin_setting_configcheckbox('cookiesecure', new lang_string('cookiesecure', 'admin'), new lang_string('configcookiesecure', 'admin'), 1));
     $temp->add(new admin_setting_configcheckbox('cookiehttponly', new lang_string('cookiehttponly', 'admin'), new lang_string('configcookiehttponly', 'admin'), 0));
     $temp->add(new admin_setting_configcheckbox('allowframembedding', new lang_string('allowframembedding', 'admin'), new lang_string('allowframembedding_help', 'admin'), 0));
diff --git a/admin/settings/users.php b/admin/settings/users.php
index a82d5d6bf93..7fc752f38e3 100644
--- a/admin/settings/users.php
+++ b/admin/settings/users.php
@@ -15,15 +15,10 @@ if ($hassiteconfig
  or has_capability('moodle/cohort:view', $systemcontext)) { // speedup for non-admins, add all caps used on this page
 
 
-    if (empty($CFG->loginhttps)) {
-        $securewwwroot = $CFG->wwwroot;
-    } else {
-        $securewwwroot = str_replace('http:','https:',$CFG->wwwroot);
-    }
     // stuff under the "accounts" subcategory
     $ADMIN->add('accounts', new admin_externalpage('editusers', new lang_string('userlist','admin'), "$CFG->wwwroot/$CFG->admin/user.php", array('moodle/user:update', 'moodle/user:delete')));
     $ADMIN->add('accounts', new admin_externalpage('userbulk', new lang_string('userbulk','admin'), "$CFG->wwwroot/$CFG->admin/user/user_bulk.php", array('moodle/user:update', 'moodle/user:delete')));
-    $ADMIN->add('accounts', new admin_externalpage('addnewuser', new lang_string('addnewuser'), "$securewwwroot/user/editadvanced.php?id=-1", 'moodle/user:create'));
+    $ADMIN->add('accounts', new admin_externalpage('addnewuser', new lang_string('addnewuser'), "$CFG->wwwroot/user/editadvanced.php?id=-1", 'moodle/user:create'));
 
     // "User default preferences" settingpage.
     $temp = new admin_settingpage('userdefaultpreferences', new lang_string('userdefaultpreferences', 'admin'));
diff --git a/admin/user.php b/admin/user.php
index 65f9f8ce36a..834c0804545 100644
--- a/admin/user.php
+++ b/admin/user.php
@@ -38,12 +38,6 @@
     $strunlock = get_string('unlockaccount', 'admin');
     $strconfirm = get_string('confirm');
 
-    if (empty($CFG->loginhttps)) {
-        $securewwwroot = $CFG->wwwroot;
-    } else {
-        $securewwwroot = str_replace('http:','https:',$CFG->wwwroot);
-    }
-
     $returnurl = new moodle_url('/admin/user.php', array('sort' => $sort, 'dir' => $dir, 'perpage' => $perpage, 'page'=>$page));
 
     // The $user variable is also used outside of these if statements.
@@ -339,7 +333,7 @@
             if (has_capability('moodle/user:update', $sitecontext)) {
                 // prevent editing of admins by non-admins
                 if (is_siteadmin($USER) or !is_siteadmin($user)) {
-                    $url = new moodle_url($securewwwroot.'/user/editadvanced.php', array('id'=>$user->id, 'course'=>$site->id));
+                    $url = new moodle_url($CFG->wwwroot.'/user/editadvanced.php', array('id'=>$user->id, 'course'=>$site->id));
                     $buttons[] = html_writer::link($url, $OUTPUT->pix_icon('t/edit', $stredit));
                 }
             }
@@ -398,7 +392,7 @@
         echo $OUTPUT->paging_bar($usercount, $page, $perpage, $baseurl);
     }
     if (has_capability('moodle/user:create', $sitecontext)) {
-        $url = new moodle_url($securewwwroot . '/user/editadvanced.php', array('id' => -1));
+        $url = new moodle_url($CFG->wwwroot . '/user/editadvanced.php', array('id' => -1));
         echo $OUTPUT->single_button($url, get_string('addnewuser'), 'get');
     }
 
diff --git a/blocks/login/block_login.php b/blocks/login/block_login.php
index e8f2491d20c..e17aea1aa10 100644
--- a/blocks/login/block_login.php
+++ b/blocks/login/block_login.php
@@ -42,13 +42,7 @@ class block_login extends block_base {
             return $this->content;
         }
 
-        if (empty($CFG->loginhttps)) {
-            $wwwroot = $CFG->wwwroot;
-        } else {
-            // This actually is not so secure ;-), 'cause we're
-            // in unencrypted connection...
-            $wwwroot = str_replace("http://", "https://", $CFG->wwwroot);
-        }
+        $wwwroot = $CFG->wwwroot;
 
         if (signup_is_enabled()) {
             $signup = $wwwroot . '/login/signup.php';
diff --git a/enrol/paypal/lib.php b/enrol/paypal/lib.php
index 7c0fbf748bd..c22e6f2b522 100644
--- a/enrol/paypal/lib.php
+++ b/enrol/paypal/lib.php
@@ -203,13 +203,7 @@ class enrol_paypal_plugin extends enrol_plugin {
             $cost = format_float($cost, 2, false);
 
             if (isguestuser()) { // force login only for guest user, not real users with guest role
-                if (empty($CFG->loginhttps)) {
-                    $wwwroot = $CFG->wwwroot;
-                } else {
-                    // This actually is not so secure ;-), 'cause we're
-                    // in unencrypted connection...
-                    $wwwroot = str_replace("http://", "https://", $CFG->wwwroot);
-                }
+                $wwwroot = $CFG->wwwroot;
                 echo '<div class="mdl-align"><p>'.get_string('paymentrequired').'</p>';
                 echo '<p><b>'.get_string('cost').": $instance->currency $localisedcost".'</b></p>';
                 echo '<p><a href="'.$wwwroot.'/login/">'.get_string('loginsite').'</a></p>';
diff --git a/lang/en/admin.php b/lang/en/admin.php
index 2449b314589..1576b5fe087 100644
--- a/lang/en/admin.php
+++ b/lang/en/admin.php
@@ -258,7 +258,6 @@ $string['configlanglist'] = 'Leave this blank to allow users to choose from any
 $string['configlangmenu'] = 'Choose whether or not you want to display the general-purpose language menu on the home page, login page etc.  This does not affect the user\'s ability to set the preferred language in their own profile.';
 $string['configlatinexcelexport'] = 'Choose the encoding for Excel exports.';
 $string['configlocale'] = 'Choose a sitewide locale - this will override the format and language of dates for all language packs (though names of days in calendar are not affected). You need to have this locale data installed on your operating system (eg for linux en_US.UTF-8 or es_ES.UTF-8). In most cases this field should be left blank.';
-$string['configloginhttps'] = 'Turning this on will make Moodle use a secure https connection just for the login page (providing a secure login), and then afterwards revert back to the normal http URL for general speed.  CAUTION: this setting REQUIRES https to be specifically enabled on the web server - if it is not then YOU COULD LOCK YOURSELF OUT OF YOUR SITE.';
 $string['configloglifetime'] = 'This specifies the length of time you want to keep logs about user activity.  Logs that are older than this age are automatically deleted.  It is best to keep logs as long as possible, in case you need them, but if you have a very busy server and are experiencing performance problems, then you may want to lower the log lifetime. Values lower than 30 are not recommended because statistics may not work properly.';
 $string['configlookahead'] = 'Days to look ahead';
 $string['configmailnewline'] = 'Newline characters used in mail messages. CRLF is required according to RFC 822bis, some mail servers do automatic conversion from LF to CRLF, other mail servers do incorrect conversion from CRLF to CRCRLF, yet others reject mails with bare LF (qmail for example). Try changing this setting if you are having problems with undelivered emails or double newlines.';
@@ -680,7 +679,6 @@ $string['lockoutwindow_desc'] = 'Observation time for lockout threshold, if ther
 $string['log'] = 'Logs';
 $string['logguests'] = 'Log guest access';
 $string['logguests_help'] = 'This setting enables logging of actions by guest account and not logged in users. High profile sites may want to disable this logging for performance reasons. It is recommended to keep this setting enabled on production sites.';
-$string['loginhttps'] = 'Use HTTPS for logins';
 $string['loginpageautofocus'] = 'Autofocus login page form';
 $string['loginpageautofocus_help'] = 'Enabling this option improves usability of the login page, but automatically focusing fields may be considered an accessibility issue.';
 $string['loglifetime'] = 'Keep logs for';
@@ -1285,3 +1283,5 @@ $string['unoconvwarning'] = 'The version of unoconv you have installed is not su
 // Deprecated since Moodle 3.4
 $string['moodleorghubname'] = 'Moodle.net';
 $string['hubs'] = 'Hubs';
+$string['configloginhttps'] = 'Turning this on will make Moodle use a secure https connection just for the login page (providing a secure login), and then afterwards revert back to the normal http URL for general speed.  CAUTION: this setting REQUIRES https to be specifically enabled on the web server - if it is not then YOU COULD LOCK YOURSELF OUT OF YOUR SITE.';
+$string['loginhttps'] = 'Use HTTPS for logins';
diff --git a/lang/en/deprecated.txt b/lang/en/deprecated.txt
index 4fde1a4431f..b912982899b 100644
--- a/lang/en/deprecated.txt
+++ b/lang/en/deprecated.txt
@@ -157,3 +157,5 @@ quickdownloadcalendar,core_calendar
 ical,core_calendar
 privacy,core_hub
 privacy_help,core_hub
+configloginhttps,core_admin
+loginhttps,core_admin
diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index 757becf9639..d5c6c35f5f4 100644
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -1051,19 +1051,12 @@ function clean_param($param, $type) {
             $param = clean_param($param, PARAM_URL);
             if (!empty($param)) {
 
-                // Simulate the HTTPS version of the site.
-                $httpswwwroot = str_replace('http://', 'https://', $CFG->wwwroot);
-
                 if ($param === $CFG->wwwroot) {
                     // Exact match;
-                } else if (!empty($CFG->loginhttps) && $param === $httpswwwroot) {
-                    // Exact match;
                 } else if (preg_match(':^/:', $param)) {
                     // Root-relative, ok!
                 } else if (preg_match('/^' . preg_quote($CFG->wwwroot . '/', '/') . '/i', $param)) {
                     // Absolute, and matches our wwwroot.
-                } else if (!empty($CFG->loginhttps) && preg_match('/^' . preg_quote($httpswwwroot . '/', '/') . '/i', $param)) {
-                    // Absolute, and matches our httpswwwroot.
                 } else {
                     // Relative - let's make sure there are no tricks.
                     if (validateUrlSyntax('/' . $param, 's-u-P-a-p-f+q?r?')) {
@@ -2491,13 +2484,7 @@ function dayofweek($day, $month, $year) {
 function get_login_url() {
     global $CFG;
 
-    $url = "$CFG->wwwroot/login/index.php";
-
-    if (!empty($CFG->loginhttps)) {
-        $url = str_replace('http:', 'https:', $url);
-    }
-
-    return $url;
+    return "$CFG->wwwroot/login/index.php";
 }
 
 /**
@@ -2662,12 +2649,7 @@ function require_login($courseorid = null, $autologinguest = true, $cm = null, $
                 redirect($changeurl);
             } else {
                 // Use moodle internal method.
-                if (empty($CFG->loginhttps)) {
-                    redirect($CFG->wwwroot .'/login/change_password.php');
-                } else {
-                    $wwwroot = str_replace('http:', 'https:', $CFG->wwwroot);
-                    redirect($wwwroot .'/login/change_password.php');
-                }
+                redirect($CFG->wwwroot .'/login/change_password.php');
             }
         } else if ($userauth->can_change_password()) {
             throw new moodle_exception('forcepasswordchangenotice');
diff --git a/lib/sessionlib.php b/lib/sessionlib.php
index 3777434d9b1..59e2e6aa51f 100644
--- a/lib/sessionlib.php
+++ b/lib/sessionlib.php
@@ -96,9 +96,6 @@ function is_moodle_cookie_secure() {
     if (!isset($CFG->cookiesecure)) {
         return false;
     }
-    if (!empty($CFG->loginhttps)) {
-        return false;
-    }
     if (!is_https() and empty($CFG->sslproxy)) {
         return false;
     }
diff --git a/lib/setuplib.php b/lib/setuplib.php
index 7f6191ae576..7bb07522d8a 100644
--- a/lib/setuplib.php
+++ b/lib/setuplib.php
@@ -578,11 +578,8 @@ function get_exception_info($ex) {
 
     // When printing an error the continue button should never link offsite.
     // We cannot use clean_param() here as it is not guaranteed that it has been loaded yet.
-    $httpswwwroot = str_replace('http:', 'https:', $CFG->wwwroot);
     if (stripos($link, $CFG->wwwroot) === 0) {
         // Internal HTTP, all good.
-    } else if (!empty($CFG->loginhttps) && stripos($link, $httpswwwroot) === 0) {
-        // Internal HTTPS, all good.
     } else {
         // External link spotted!
         $link = $CFG->wwwroot . '/';
diff --git a/lib/tests/moodlelib_test.php b/lib/tests/moodlelib_test.php
index d3148878d28..257f82be305 100644
--- a/lib/tests/moodlelib_test.php
+++ b/lib/tests/moodlelib_test.php
@@ -643,31 +643,20 @@ class core_moodlelib_testcase extends advanced_testcase {
         // Local absolute HTTPS in a non HTTPS site.
         $CFG->wwwroot = str_replace('https:', 'http:', $CFG->wwwroot); // Need to simulate non-https site.
         $httpsroot = str_replace('http:', 'https:', $CFG->wwwroot);
-        $CFG->loginhttps = false; // Not allowed.
         $this->assertSame('', clean_param($httpsroot, PARAM_LOCALURL));
         $this->assertSame('', clean_param($httpsroot . '/with/something?else=true', PARAM_LOCALURL));
-        $CFG->loginhttps = true; // Allowed.
-        $this->assertSame($httpsroot, clean_param($httpsroot, PARAM_LOCALURL));
-        $this->assertSame($httpsroot . '/with/something?else=true',
-            clean_param($httpsroot . '/with/something?else=true', PARAM_LOCALURL));
 
         // Local absolute HTTPS in a HTTPS site.
-        $CFG->wwwroot = str_replace('https:', 'http:', $CFG->wwwroot);
+        $CFG->wwwroot = str_replace('http:', 'https:', $CFG->wwwroot);
         $httpsroot = $CFG->wwwroot;
-        $CFG->loginhttps = false; // Always allowed.
-        $this->assertSame($httpsroot, clean_param($httpsroot, PARAM_LOCALURL));
-        $this->assertSame($httpsroot . '/with/something?else=true',
-            clean_param($httpsroot . '/with/something?else=true', PARAM_LOCALURL));
-        $CFG->loginhttps = true; // Always allowed.
         $this->assertSame($httpsroot, clean_param($httpsroot, PARAM_LOCALURL));
         $this->assertSame($httpsroot . '/with/something?else=true',
             clean_param($httpsroot . '/with/something?else=true', PARAM_LOCALURL));
 
         // Test open redirects are not possible.
-        $CFG->loginhttps = false;
         $CFG->wwwroot = 'http://www.example.com';
         $this->assertSame('', clean_param('http://www.example.com.evil.net/hack.php', PARAM_LOCALURL));
-        $CFG->loginhttps = true;
+        $CFG->wwwroot = 'https://www.example.com';
         $this->assertSame('', clean_param('https://www.example.com.evil.net/hack.php', PARAM_LOCALURL));
     }
 
diff --git a/lib/tests/sessionlib_test.php b/lib/tests/sessionlib_test.php
index a5e9eb503a2..c77fdfbc977 100644
--- a/lib/tests/sessionlib_test.php
+++ b/lib/tests/sessionlib_test.php
@@ -167,7 +167,6 @@ class core_sessionlib_testcase extends advanced_testcase {
                     'wwwroot'       => 'http://example.com',
                     'httpswwwroot'  => 'http://example.com',
                     'sslproxy'      => null,
-                    'loginhttps'    => null,
                     'cookiesecure'  => null,
                 ),
                 'secure' => false,
@@ -178,7 +177,6 @@ class core_sessionlib_testcase extends advanced_testcase {
                     'wwwroot'       => 'http://example.com',
                     'httpswwwroot'  => 'http://example.com',
                     'sslproxy'      => null,
-                    'loginhttps'    => null,
                     'cookiesecure'  => false,
                 ),
                 'secure' => false,
@@ -189,7 +187,6 @@ class core_sessionlib_testcase extends advanced_testcase {
                     'wwwroot'       => 'http://example.com',
                     'httpswwwroot'  => 'http://example.com',
                     'sslproxy'      => null,
-                    'loginhttps'    => null,
                     'cookiesecure'  => true,
                 ),
                 'secure' => false,
@@ -200,7 +197,6 @@ class core_sessionlib_testcase extends advanced_testcase {
                     'wwwroot'       => 'http://example.com',
                     'httpswwwroot'  => 'http://example.com',
                     'sslproxy'      => true,
-                    'loginhttps'    => null,
                     'cookiesecure'  => false,
                 ),
                 'secure' => false,
@@ -211,7 +207,6 @@ class core_sessionlib_testcase extends advanced_testcase {
                     'wwwroot'       => 'http://example.com',
                     'httpswwwroot'  => 'http://example.com',
                     'sslproxy'      => true,
-                    'loginhttps'    => null,
                     'cookiesecure'  => true,
                 ),
                 'secure' => true,
@@ -222,7 +217,6 @@ class core_sessionlib_testcase extends advanced_testcase {
                     'wwwroot'       => 'https://example.com',
                     'httpswwwroot'  => 'https://example.com',
                     'sslproxy'      => null,
-                    'loginhttps'    => null,
                     'cookiesecure'  => false,
                 ),
                 'secure' => false,
@@ -233,7 +227,6 @@ class core_sessionlib_testcase extends advanced_testcase {
                     'wwwroot'       => 'https://example.com',
                     'httpswwwroot'  => 'https://example.com',
                     'sslproxy'      => null,
-                    'loginhttps'    => null,
                     'cookiesecure'  => true,
                 ),
                 'secure' => true,
diff --git a/lib/tests/setuplib_test.php b/lib/tests/setuplib_test.php
index e801a14fc7d..e38124e6ad7 100644
--- a/lib/tests/setuplib_test.php
+++ b/lib/tests/setuplib_test.php
@@ -357,7 +357,6 @@ class core_setuplib_testcase extends advanced_testcase {
     public function test_get_exception_info_link() {
         global $CFG, $SESSION;
 
-        $initialloginhttps = $CFG->loginhttps;
         $httpswwwroot = str_replace('http:', 'https:', $CFG->wwwroot);
 
         // Simple local URL.
@@ -372,8 +371,7 @@ class core_setuplib_testcase extends advanced_testcase {
         $infos = $this->get_exception_info($exception);
         $this->assertSame($CFG->wwwroot . '/', $infos->link);
 
-        // HTTPS URL when login HTTPS is not enabled and site is HTTP.
-        $CFG->loginhttps = false;
+        // HTTPS URL when login HTTPS is not enabled (default) and site is HTTP.
         $CFG->wwwroot = str_replace('https:', 'http:', $CFG->wwwroot);
         $url = $httpswwwroot . '/something/here?really=yes';
         $exception = new moodle_exception('none', 'error', $url);
@@ -387,21 +385,6 @@ class core_setuplib_testcase extends advanced_testcase {
         $infos = $this->get_exception_info($exception);
         $this->assertSame($url, $infos->link);
 
-        // HTTPS URL when login HTTPS enabled and site is HTTP.
-        $CFG->loginhttps = true;
-        $CFG->wwwroot = str_replace('https:', 'http:', $CFG->wwwroot);
-        $url = $httpswwwroot . '/something/here?really=yes';
-        $exception = new moodle_exception('none', 'error', $url);
-        $infos = $this->get_exception_info($exception);
-        $this->assertSame($url, $infos->link);
-
-        // HTTPS URL when login HTTPS enabled and site is HTTPS.
-        $CFG->wwwroot = str_replace('http:', 'https:', $CFG->wwwroot);
-        $url = $httpswwwroot . '/something/here?really=yes';
-        $exception = new moodle_exception('none', 'error', $url);
-        $infos = $this->get_exception_info($exception);
-        $this->assertSame($url, $infos->link);
-
         // External HTTP URL.
         $url = 'http://moodle.org/something/here?really=yes';
         $exception = new moodle_exception('none', 'error', $url);
@@ -444,14 +427,6 @@ class core_setuplib_testcase extends advanced_testcase {
         $infos = $this->get_exception_info($exception);
         $this->assertSame($CFG->wwwroot . '/', $infos->link);
 
-        // External HTTPS link from fromurl with login HTTPS.
-        $CFG->loginhttps = true;
-        $SESSION->fromurl = 'https://moodle.org/something/here?really=yes';
-        $exception = new moodle_exception('none');
-        $infos = $this->get_exception_info($exception);
-        $this->assertSame($CFG->wwwroot . '/', $infos->link);
-
-        $CFG->loginhttps = $initialloginhttps;
         $SESSION->fromurl = '';
     }
 
diff --git a/lib/upgrade.txt b/lib/upgrade.txt
index 1824caf2c23..c9106759fb1 100644
--- a/lib/upgrade.txt
+++ b/lib/upgrade.txt
@@ -54,6 +54,8 @@ information provided here is intended especially for developers.
 * Instead of checking the 'moodle/course:viewparticipants' and 'moodle/site:viewparticipants' capabilities use the
   new functions course_can_view_participants() and course_require_view_participants().
 * $stored_file->add_to_curl_request() now adds the filename to the curl request.
+* The option for Login HTTPS (authentication-only SSL) has been removed
+* $CFG->loginhttps is now deprecated, do not use it.
 
 === 3.3.1 ===
 
diff --git a/login/signup_form.php b/login/signup_form.php
index 246ecf7323e..325594b0bbb 100644
--- a/login/signup_form.php
+++ b/login/signup_form.php
@@ -93,7 +93,7 @@ class login_signup_form extends moodleform implements renderable, templatable {
         profile_signup_fields($mform);
 
         if (signup_captcha_enabled()) {
-            $mform->addElement('recaptcha', 'recaptcha_element', get_string('security_question', 'auth'), array('https' => $CFG->loginhttps));
+            $mform->addElement('recaptcha', 'recaptcha_element', get_string('security_question', 'auth'));
             $mform->addHelpButton('recaptcha_element', 'recaptcha', 'auth');
             $mform->closeHeaderBefore('recaptcha_element');
         }

From 4b501ec96b18461fb471713cef5727304ebcc416 Mon Sep 17 00:00:00 2001
From: John Okely <jlokely@gmail.com>
Date: Fri, 15 Sep 2017 09:18:18 +0800
Subject: [PATCH 2/6] MDL-42834 admin: Deprecate https_required and
 verify_https_required

---
 admin/tool/mobile/autologin.php |  2 --
 auth/ldap/ntlmsso_attempt.php   |  4 ---
 auth/ldap/ntlmsso_finish.php    |  3 --
 auth/ldap/ntlmsso_magic.php     |  4 ---
 auth/shibboleth/login.php       |  3 --
 lib/deprecatedlib.php           |  4 +--
 lib/pagelib.php                 | 61 +++++----------------------------
 lib/upgrade.txt                 |  1 +
 login/change_password.php       |  6 ----
 login/forgot_password.php       |  3 --
 login/index.php                 |  6 ----
 login/lib.php                   |  4 ---
 login/signup.php                |  6 ----
 user/edit.php                   |  6 ----
 user/editadvanced.php           |  6 ----
 15 files changed, 12 insertions(+), 107 deletions(-)

diff --git a/admin/tool/mobile/autologin.php b/admin/tool/mobile/autologin.php
index d5ef969439a..13154b3d3ef 100644
--- a/admin/tool/mobile/autologin.php
+++ b/admin/tool/mobile/autologin.php
@@ -31,8 +31,6 @@ $urltogo = optional_param('urltogo', $CFG->wwwroot, PARAM_URL);    // URL to red
 
 $context = context_system::instance();
 $PAGE->set_context($context);
-// Force https.
-$PAGE->https_required();
 
 // Check if the user is already logged-in.
 if (isloggedin() and !isguestuser()) {
diff --git a/auth/ldap/ntlmsso_attempt.php b/auth/ldap/ntlmsso_attempt.php
index 561d7bf9d47..155866b14d7 100644
--- a/auth/ldap/ntlmsso_attempt.php
+++ b/auth/ldap/ntlmsso_attempt.php
@@ -2,9 +2,6 @@
 
 require(__DIR__.'/../../config.php');
 
-//HTTPS is required in this page when $CFG->loginhttps enabled
-$PAGE->https_required();
-
 $PAGE->set_url('/auth/ldap/ntlmsso_attempt.php');
 $PAGE->set_context(context_system::instance());
 
@@ -33,7 +30,6 @@ $PAGE->set_title("$site->fullname: $loginsite");
 $PAGE->set_heading($site->fullname);
 echo $OUTPUT->header();
 
-// $PAGE->https_required() up above takes care of what $CFG->httpswwwroot should be.
 $msg = '<p>'.get_string('ntlmsso_attempting', 'auth_ldap').'</p>'
     . '<img width="1", height="1" '
     . ' src="' . $CFG->httpswwwroot . '/auth/ldap/ntlmsso_magic.php?sesskey='
diff --git a/auth/ldap/ntlmsso_finish.php b/auth/ldap/ntlmsso_finish.php
index 26a5129fa2f..e1b816f1d69 100644
--- a/auth/ldap/ntlmsso_finish.php
+++ b/auth/ldap/ntlmsso_finish.php
@@ -2,9 +2,6 @@
 
 require(__DIR__.'/../../config.php');
 
-//HTTPS is required in this page when $CFG->loginhttps enabled
-$PAGE->https_required();
-
 $PAGE->set_url('/auth/ldap/ntlmsso_finish.php');
 $PAGE->set_context(context_system::instance());
 
diff --git a/auth/ldap/ntlmsso_magic.php b/auth/ldap/ntlmsso_magic.php
index 5d02ebe61c5..fcbdf890d38 100644
--- a/auth/ldap/ntlmsso_magic.php
+++ b/auth/ldap/ntlmsso_magic.php
@@ -8,9 +8,6 @@ define('NO_MOODLE_COOKIES', true);
 
 require(__DIR__.'/../../config.php');
 
-//HTTPS is required in this page when $CFG->loginhttps enabled
-$PAGE->https_required();
-
 $PAGE->set_context(context_system::instance());
 
 $authsequence = get_enabled_auth_plugins(true); // auths, in sequence
@@ -29,7 +26,6 @@ $file = $CFG->dirroot.'/pix/spacer.gif';
 if ($authplugin->ntlmsso_magic($sesskey) && file_exists($file)) {
     if (!empty($authplugin->config->ntlmsso_ie_fastpath)) {
         if (core_useragent::is_ie()) {
-            // $PAGE->https_required() up above takes care of what $CFG->httpswwwroot should be.
             redirect($CFG->httpswwwroot.'/auth/ldap/ntlmsso_finish.php');
         }
     }
diff --git a/auth/shibboleth/login.php b/auth/shibboleth/login.php
index cfe474e06d5..4b41bd6895a 100644
--- a/auth/shibboleth/login.php
+++ b/auth/shibboleth/login.php
@@ -15,9 +15,6 @@
     }
 
 
-//HTTPS is required in this page when $CFG->loginhttps enabled
-$PAGE->https_required();
-
 /// Define variables used in page
     $site = get_site();
 
diff --git a/lib/deprecatedlib.php b/lib/deprecatedlib.php
index 6d35d855ffb..5beb8dd63e2 100644
--- a/lib/deprecatedlib.php
+++ b/lib/deprecatedlib.php
@@ -501,10 +501,10 @@ function filter_text($text, $courseid = NULL) {
 }
 
 /**
- * @deprecated use $PAGE->https_required() instead
+ * @deprecated Loginhttps is no longer supported
  */
 function httpsrequired() {
-    throw new coding_exception('httpsrequired() can not be used any more use $PAGE->https_required() instead.');
+    throw new coding_exception('httpsrequired() can not be used any more. Loginhttps is no longer supported.');
 }
 
 /**
diff --git a/lib/pagelib.php b/lib/pagelib.php
index ce5254a0d7c..1ec4206388d 100644
--- a/lib/pagelib.php
+++ b/lib/pagelib.php
@@ -1461,71 +1461,28 @@ class moodle_page {
 
     /**
      * This function indicates that current page requires the https when $CFG->loginhttps enabled.
+     * Since loginhttps was removed this is no longer required or functional.
      *
-     * By using this function properly, we can ensure 100% https-ized pages
-     * at our entire discretion (login, forgot_password, change_password)
+     * @deprecated since Moodle 3.4 MDL-42834 - please do not use this function any more.
+     * @todo MDL-46267 This will be deleted in Moodle 3.8
      *
-     * @return void
      * @throws coding_exception
      */
     public function https_required() {
-        global $CFG;
-
-        if (!is_null($this->_url)) {
-            throw new coding_exception('https_required() must be used before setting page url!');
-        }
-
-        $this->ensure_theme_not_set();
-
-        $this->_https_login_required = true;
-
-        if (!empty($CFG->loginhttps)) {
-            $CFG->httpswwwroot = str_replace('http:', 'https:', $CFG->wwwroot);
-        } else {
-            $CFG->httpswwwroot = $CFG->wwwroot;
-        }
+        debugging('https_required() has been deprecated. It no longer needs to be called.', DEBUG_DEVELOPER);
     }
 
     /**
      * Makes sure that page previously marked with https_required() is really using https://, if not it redirects to https://
+     * Since loginhttps was removed this is no longer required or functional.
+     *
+     * @deprecated since Moodle 3.4 MDL-42834 - please do not use this function any more.
+     * @todo MDL-46267 This will be deleted in Moodle 3.8
      *
-     * @return void (may redirect to https://self)
      * @throws coding_exception
      */
     public function verify_https_required() {
-        global $CFG, $FULLME;
-
-        if (is_null($this->_url)) {
-            throw new coding_exception('verify_https_required() must be called after setting page url!');
-        }
-
-        if (!$this->_https_login_required) {
-            throw new coding_exception('verify_https_required() must be called only after https_required()!');
-        }
-
-        if (empty($CFG->loginhttps)) {
-            // Https not required, so stop checking.
-            return;
-        }
-
-        if (strpos($this->_url, 'https://')) {
-            // Detect if incorrect PAGE->set_url() used, it is recommended to use root-relative paths there.
-            throw new coding_exception('Invalid page url. It must start with https:// for pages that set https_required()!');
-        }
-
-        if (!empty($CFG->sslproxy)) {
-            // It does not make much sense to use sslproxy and loginhttps at the same time.
-            return;
-        }
-
-        // Now the real test and redirect!
-        // NOTE: do NOT use this test for detection of https on current page because this code is not compatible with SSL proxies,
-        //       instead use is_https().
-        if (strpos($FULLME, 'https:') !== 0) {
-            // This may lead to infinite redirect on an incorrectly configured site.
-            // In that case set $CFG->loginhttps=0; within /config.php.
-            redirect($this->_url);
-        }
+        debugging('verify_https_required() has been deprecated. It no longer needs to be called.', DEBUG_DEVELOPER);
     }
 
     // Initialisation methods =====================================================
diff --git a/lib/upgrade.txt b/lib/upgrade.txt
index c9106759fb1..a2b7ca8441c 100644
--- a/lib/upgrade.txt
+++ b/lib/upgrade.txt
@@ -56,6 +56,7 @@ information provided here is intended especially for developers.
 * $stored_file->add_to_curl_request() now adds the filename to the curl request.
 * The option for Login HTTPS (authentication-only SSL) has been removed
 * $CFG->loginhttps is now deprecated, do not use it.
+* $PAGE->https_required and $PAGE->verify_https_required() are now deprecated. They are no longer used and will throw a coding_exception.
 
 === 3.3.1 ===
 
diff --git a/login/change_password.php b/login/change_password.php
index ccc1cab82da..32e79531659 100644
--- a/login/change_password.php
+++ b/login/change_password.php
@@ -35,9 +35,6 @@ $return = optional_param('return', 0, PARAM_BOOL); // redirect after password ch
 
 $systemcontext = context_system::instance();
 
-//HTTPS is required in this page when $CFG->loginhttps enabled
-$PAGE->https_required();
-
 $PAGE->set_url('/login/change_password.php', array('id'=>$id));
 
 $PAGE->set_context($systemcontext);
@@ -148,9 +145,6 @@ if ($mform->is_cancelled()) {
     exit;
 }
 
-// make sure we really are on the https page when https login required
-$PAGE->verify_https_required();
-
 $strchangepassword = get_string('changepassword');
 
 $fullname = fullname($USER, true);
diff --git a/login/forgot_password.php b/login/forgot_password.php
index 70f10af50ad..5f23664903e 100644
--- a/login/forgot_password.php
+++ b/login/forgot_password.php
@@ -41,9 +41,6 @@ require_once('set_password_form.php');
 
 $token = optional_param('token', false, PARAM_ALPHANUM);
 
-//HTTPS is required in this page when $CFG->loginhttps enabled
-$PAGE->https_required();
-
 $PAGE->set_url('/login/forgot_password.php');
 $systemcontext = context_system::instance();
 $PAGE->set_context($systemcontext);
diff --git a/login/index.php b/login/index.php
index ef92109deb9..8e2d45773fa 100644
--- a/login/index.php
+++ b/login/index.php
@@ -37,9 +37,6 @@ if ($cancel) {
     redirect(new moodle_url('/'));
 }
 
-//HTTPS is required in this page when $CFG->loginhttps enabled
-$PAGE->https_required();
-
 $context = context_system::instance();
 $PAGE->set_url("$CFG->httpswwwroot/login/index.php");
 $PAGE->set_context($context);
@@ -305,9 +302,6 @@ if (!empty($CFG->alternateloginurl)) {
     redirect($loginurl->out(false));
 }
 
-// make sure we really are on the https page when https login required
-$PAGE->verify_https_required();
-
 /// Generate the login page with forms
 
 if (!isset($frm) or !is_object($frm)) {
diff --git a/login/lib.php b/login/lib.php
index 9ea72fde604..c2879d2dec7 100644
--- a/login/lib.php
+++ b/login/lib.php
@@ -58,9 +58,6 @@ function core_login_process_password_reset_request() {
         die; // Never reached.
     }
 
-    // Make sure we really are on the https page when https login required.
-    $PAGE->verify_https_required();
-
     // DISPLAY FORM.
 
     echo $OUTPUT->header();
@@ -253,7 +250,6 @@ function core_login_process_password_set($token) {
         $setdata->username2 = $user->username;
         $setdata->token = $user->token;
         $mform->set_data($setdata);
-        $PAGE->verify_https_required();
         echo $OUTPUT->header();
         echo $OUTPUT->box(get_string('setpasswordinstructions'), 'generalbox boxwidthnormal boxaligncenter');
         $mform->display();
diff --git a/login/signup.php b/login/signup.php
index 03321e459e6..72746856afb 100644
--- a/login/signup.php
+++ b/login/signup.php
@@ -32,9 +32,6 @@ if (!$authplugin = signup_is_enabled()) {
     print_error('notlocalisederrormessage', 'error', '', 'Sorry, you may not use this page.');
 }
 
-//HTTPS is required in this page when $CFG->loginhttps enabled
-$PAGE->https_required();
-
 $PAGE->set_url('/login/signup.php');
 $PAGE->set_context(context_system::instance());
 
@@ -75,9 +72,6 @@ if ($mform_signup->is_cancelled()) {
     exit; //never reached
 }
 
-// make sure we really are on the https page when https login required
-$PAGE->verify_https_required();
-
 
 $newaccount = get_string('newaccount');
 $login      = get_string('login');
diff --git a/user/edit.php b/user/edit.php
index deeca38c568..bb4a440c561 100644
--- a/user/edit.php
+++ b/user/edit.php
@@ -29,9 +29,6 @@ require_once($CFG->dirroot.'/user/editlib.php');
 require_once($CFG->dirroot.'/user/profile/lib.php');
 require_once($CFG->dirroot.'/user/lib.php');
 
-// HTTPS is required in this page when $CFG->loginhttps enabled.
-$PAGE->https_required();
-
 $userid = optional_param('id', $USER->id, PARAM_INT);    // User id.
 $course = optional_param('course', SITEID, PARAM_INT);   // Course id (defaults to Site).
 $returnto = optional_param('returnto', null, PARAM_ALPHA);  // Code determining where to return to after save.
@@ -304,9 +301,6 @@ if ($usernew = $userform->get_data()) {
     }
 }
 
-// Make sure we really are on the https page when https login required.
-$PAGE->verify_https_required();
-
 
 // Display page header.
 $streditmyprofile = get_string('editmyprofile');
diff --git a/user/editadvanced.php b/user/editadvanced.php
index 176311d9e12..6f3d07e40cc 100644
--- a/user/editadvanced.php
+++ b/user/editadvanced.php
@@ -31,9 +31,6 @@ require_once($CFG->dirroot.'/user/profile/lib.php');
 require_once($CFG->dirroot.'/user/lib.php');
 require_once($CFG->dirroot.'/webservice/lib.php');
 
-// HTTPS is required in this page when $CFG->loginhttps enabled.
-$PAGE->https_required();
-
 $id     = optional_param('id', $USER->id, PARAM_INT);    // User id; -1 if creating new user.
 $course = optional_param('course', SITEID, PARAM_INT);   // Course id (defaults to Site).
 $returnto = optional_param('returnto', null, PARAM_ALPHA);  // Code determining where to return to after save.
@@ -313,9 +310,6 @@ if ($usernew = $userform->get_data()) {
     // Never reached..
 }
 
-// Make sure we really are on the https page when https login required.
-$PAGE->verify_https_required();
-
 
 // Display page header.
 if ($user->id == -1 or ($user->id != $USER->id)) {

From ebc11ab3c6e0810145d5fcd54aba0b214309123a Mon Sep 17 00:00:00 2001
From: John Okely <jlokely@gmail.com>
Date: Fri, 15 Sep 2017 09:20:37 +0800
Subject: [PATCH 3/6] MDL-42834 admin: Cleanup logic of login page only needed
 for loginhttps

---
 login/index.php | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/login/index.php b/login/index.php
index 8e2d45773fa..322575b2527 100644
--- a/login/index.php
+++ b/login/index.php
@@ -30,13 +30,8 @@ require_once('lib.php');
 redirect_if_major_upgrade_required();
 
 $testsession = optional_param('testsession', 0, PARAM_INT); // test session works properly
-$cancel      = optional_param('cancel', 0, PARAM_BOOL);      // redirect to frontpage, needed for loginhttps
 $anchor      = optional_param('anchor', '', PARAM_RAW);      // Used to restore hash anchor to wantsurl.
 
-if ($cancel) {
-    redirect(new moodle_url('/'));
-}
-
 $context = context_system::instance();
 $PAGE->set_url("$CFG->httpswwwroot/login/index.php");
 $PAGE->set_context($context);

From cd1eb7ce9c192720978d3c0bc754c56a47123440 Mon Sep 17 00:00:00 2001
From: John Okely <jlokely@gmail.com>
Date: Fri, 15 Sep 2017 09:23:20 +0800
Subject: [PATCH 4/6] MDL-42834 admin: Upgrade script and warning for
 loginhttps sites

---
 admin/index.php    |  4 +++-
 admin/renderer.php | 19 ++++++++++++++++++-
 lang/en/admin.php  |  1 +
 lib/db/upgrade.php | 12 ++++++++++++
 lib/setuplib.php   |  7 +++++++
 version.php        |  2 +-
 6 files changed, 42 insertions(+), 3 deletions(-)

diff --git a/admin/index.php b/admin/index.php
index 48c714431b2..8d0199ee1dd 100644
--- a/admin/index.php
+++ b/admin/index.php
@@ -875,6 +875,8 @@ if (empty($CFG->disabledevlibdirscheck) && (is_dir($CFG->dirroot.'/vendor') || i
 } else {
     $devlibdir = false;
 }
+// Check if the site is being foced onto ssl.
+$overridetossl = !empty($CFG->overridetossl);
 
 admin_externalpage_setup('adminnotifications');
 
@@ -883,4 +885,4 @@ $output = $PAGE->get_renderer('core', 'admin');
 echo $output->admin_notifications_page($maturity, $insecuredataroot, $errorsdisplayed, $cronoverdue, $dbproblems,
                                        $maintenancemode, $availableupdates, $availableupdatesfetch, $buggyiconvnomb,
                                        $registered, $cachewarnings, $eventshandlers, $themedesignermode, $devlibdir,
-                                       $mobileconfigured);
+                                       $mobileconfigured, $overridetossl);
diff --git a/admin/renderer.php b/admin/renderer.php
index 1fd8cb5ff95..9ea4ea1d280 100644
--- a/admin/renderer.php
+++ b/admin/renderer.php
@@ -279,13 +279,15 @@ class core_admin_renderer extends plugin_renderer_base {
      * @param bool $themedesignermode Warn about the theme designer mode.
      * @param bool $devlibdir Warn about development libs directory presence.
      * @param bool $mobileconfigured Whether the mobile web services have been enabled
+     * @param bool $overridetossl Whether or not ssl is being forced.
      *
      * @return string HTML to output.
      */
     public function admin_notifications_page($maturity, $insecuredataroot, $errorsdisplayed,
             $cronoverdue, $dbproblems, $maintenancemode, $availableupdates, $availableupdatesfetch,
             $buggyiconvnomb, $registered, array $cachewarnings = array(), $eventshandlers = 0,
-            $themedesignermode = false, $devlibdir = false, $mobileconfigured = false) {
+            $themedesignermode = false, $devlibdir = false, $mobileconfigured = false,
+            $overridetossl = false) {
         global $CFG;
         $output = '';
 
@@ -301,6 +303,7 @@ class core_admin_renderer extends plugin_renderer_base {
         $output .= $this->cron_overdue_warning($cronoverdue);
         $output .= $this->db_problems($dbproblems);
         $output .= $this->maintenance_mode_warning($maintenancemode);
+        $output .= $this->overridetossl_warning($overridetossl);
         $output .= $this->cache_warnings($cachewarnings);
         $output .= $this->events_handlers($eventshandlers);
         $output .= $this->registration_warning($registered);
@@ -668,6 +671,20 @@ class core_admin_renderer extends plugin_renderer_base {
         return $this->warning(get_string('sitemaintenancewarning2', 'admin', $url));
     }
 
+    /**
+     * Render a warning that ssl is forced because the site was on loginhttps.
+     *
+     * @param bool $overridetossl Whether or not ssl is being forced.
+     * @return string
+     */
+    protected function overridetossl_warning($overridetossl) {
+        if (!$overridetossl) {
+            return '';
+        }
+        $warning = get_string('overridetossl', 'core_admin');
+        return $this->warning($warning, 'warning');
+    }
+
     /**
      * Display a warning about installing development code if necesary.
      * @param int $maturity
diff --git a/lang/en/admin.php b/lang/en/admin.php
index 1576b5fe087..89832944e8d 100644
--- a/lang/en/admin.php
+++ b/lang/en/admin.php
@@ -813,6 +813,7 @@ $string['order2'] = 'Second';
 $string['order3'] = 'Third';
 $string['order4'] = 'Fourth';
 $string['outgoingmailconfig'] = 'Outgoing mail configuration';
+$string['overridetossl'] = 'HTTPS for logins has now been deprecated. This instance is now forced to SSL. To remedy this warning change your wwwroot in config.php to https://';
 $string['passwordchangelogout'] = 'Log out after password change';
 $string['passwordchangelogout_desc'] = 'If enabled, when a password is changed, all browser sessions are terminated, apart from the one in which the new password is specified. (This setting does not affect password changes via bulk user upload.)';
 $string['passwordchangetokendeletion'] = 'Remove web service access tokens after password change';
diff --git a/lib/db/upgrade.php b/lib/db/upgrade.php
index 02c60ea1615..90fedd79f70 100644
--- a/lib/db/upgrade.php
+++ b/lib/db/upgrade.php
@@ -2781,5 +2781,17 @@ function xmldb_main_upgrade($oldversion) {
         upgrade_main_savepoint(true, 2017101900.02);
     }
 
+    if ($oldversion < 2017101900.03) {
+        // We will need to force them onto ssl if loginhttps is set.
+        if (!empty($CFG->loginhttps)) {
+            set_config('overridetossl', 1);
+        }
+        // Loginhttps should no longer be set.
+        unset_config('loginhttps');
+
+        // Main savepoint reached.
+        upgrade_main_savepoint(true, 2017101900.03);
+    }
+
     return true;
 }
diff --git a/lib/setuplib.php b/lib/setuplib.php
index 7bb07522d8a..8bd7623c1f3 100644
--- a/lib/setuplib.php
+++ b/lib/setuplib.php
@@ -828,6 +828,13 @@ function initialise_fullme() {
         initialise_fullme_cli();
         return;
     }
+    if (!empty($CFG->overridetossl)) {
+        if (strpos($CFG->wwwroot, 'http://') === 0) {
+            $CFG->wwwroot = str_replace('http:', 'https:', $CFG->wwwroot);
+        } else {
+            unset_config('overridetossl');
+        }
+    }
 
     $rurl = setup_get_remote_url();
     $wwwroot = parse_url($CFG->wwwroot.'/');
diff --git a/version.php b/version.php
index b85e45db3e4..a5f273e5925 100644
--- a/version.php
+++ b/version.php
@@ -29,7 +29,7 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$version  = 2017101900.02;              // YYYYMMDD      = weekly release date of this DEV branch.
+$version  = 2017101900.03;              // YYYYMMDD      = weekly release date of this DEV branch.
                                         //         RR    = release increments - 00 in DEV branches.
                                         //           .XX = incremental changes.
 

From 672f4836702365f69ddc2f9549d42abb752244a8 Mon Sep 17 00:00:00 2001
From: John Okely <jlokely@gmail.com>
Date: Fri, 15 Sep 2017 10:09:01 +0800
Subject: [PATCH 5/6] MDL-42834 admin: Removal of httpswwwroot

---
 admin/tool/mobile/classes/api.php             |  2 +-
 admin/tool/mobile/tests/externallib_test.php  |  1 -
 auth/classes/output/login.php                 |  4 +-
 auth/ldap/auth.php                            |  8 ++--
 auth/ldap/ntlmsso_attempt.php                 |  4 +-
 auth/ldap/ntlmsso_finish.php                  |  2 +-
 auth/ldap/ntlmsso_magic.php                   |  2 +-
 auth/mnet/auth.php                            |  2 +-
 auth/oauth2/classes/auth.php                  | 18 ++++-----
 auth/shibboleth/login.php                     |  8 ++--
 comment/index.php                             |  4 +-
 lib/deprecatedlib.php                         |  3 --
 lib/editor/tinymce/lib.php                    | 10 ++---
 .../tinymce/plugins/spellchecker/lib.php      |  2 +-
 lib/editor/tinymce/tests/editor_test.php      |  2 +-
 lib/filelib.php                               |  2 +-
 lib/filterlib.php                             |  2 +-
 lib/moodlelib.php                             |  6 +--
 lib/outputcomponents.php                      |  3 +-
 lib/outputlib.php                             | 16 ++++----
 lib/outputrequirementslib.php                 | 37 +++++++++----------
 lib/pagelib.php                               | 10 ++---
 lib/phpunit/tests/basic_test.php              |  1 +
 lib/questionlib.php                           |  2 +-
 lib/setup.php                                 |  4 +-
 lib/tests/outputcomponents_test.php           | 10 ++---
 lib/tests/sessionlib_test.php                 | 11 +-----
 lib/upgrade.txt                               |  1 +
 lib/weblib.php                                | 21 ++++-------
 login/change_password.php                     |  2 +-
 login/forgot_password.php                     |  2 +-
 login/index.php                               | 18 ++++-----
 login/lib.php                                 |  2 +-
 login/signup.php                              |  2 +-
 mod/chat/gui_ajax/index.php                   |  4 +-
 mod/lti/locallib.php                          |  2 +-
 repository/draftfiles_manager.php             |  2 +-
 repository/dropbox/lib.php                    |  2 +-
 repository/filepicker.php                     |  4 +-
 theme/styles_debug.php                        |  2 +-
 user/edit.php                                 |  2 +-
 user/editlib.php                              |  2 +-
 42 files changed, 111 insertions(+), 133 deletions(-)

diff --git a/admin/tool/mobile/classes/api.php b/admin/tool/mobile/classes/api.php
index 8741016dbe0..bfc42ee0226 100644
--- a/admin/tool/mobile/classes/api.php
+++ b/admin/tool/mobile/classes/api.php
@@ -134,7 +134,7 @@ class api {
         list($maintenancemessage, $notusedformat) = external_format_text($CFG->maintenance_message, FORMAT_MOODLE, $context->id);
         $settings = array(
             'wwwroot' => $CFG->wwwroot,
-            'httpswwwroot' => $CFG->httpswwwroot,
+            'httpswwwroot' => $CFG->wwwroot,
             'sitename' => external_format_string($SITE->fullname, $context->id, true),
             'guestlogin' => $CFG->guestloginbutton,
             'rememberusername' => $CFG->rememberusername,
diff --git a/admin/tool/mobile/tests/externallib_test.php b/admin/tool/mobile/tests/externallib_test.php
index 328011a492e..b5986aa9d9a 100644
--- a/admin/tool/mobile/tests/externallib_test.php
+++ b/admin/tool/mobile/tests/externallib_test.php
@@ -235,7 +235,6 @@ class tool_mobile_external_testcase extends externallib_advanced_testcase {
 
         // Need to simulate a non HTTPS site here.
         $CFG->wwwroot = str_replace('https:', 'http:', $CFG->wwwroot);
-        $CFG->httpswwwroot = str_replace('https:', 'http:', $CFG->wwwroot);
 
         $this->resetAfterTest(true);
         $this->setAdminUser();
diff --git a/auth/classes/output/login.php b/auth/classes/output/login.php
index 8bdf91de9e2..e42707a5dee 100644
--- a/auth/classes/output/login.php
+++ b/auth/classes/output/login.php
@@ -90,8 +90,8 @@ class login implements renderable, templatable {
         $this->autofocusform = !empty($CFG->loginpageautofocus);
         $this->rememberusername = isset($CFG->rememberusername) and $CFG->rememberusername == 2;
 
-        $this->forgotpasswordurl = new moodle_url($CFG->httpswwwroot . '/login/forgot_password.php');
-        $this->loginurl = new moodle_url($CFG->httpswwwroot . '/login/index.php');
+        $this->forgotpasswordurl = new moodle_url($CFG->wwwroot . '/login/forgot_password.php');
+        $this->loginurl = new moodle_url($CFG->wwwroot . '/login/index.php');
         $this->signupurl = new moodle_url('/login/signup.php');
 
         // Authentication instructions.
diff --git a/auth/ldap/auth.php b/auth/ldap/auth.php
index 6cf1f2819ec..91218ad193f 100644
--- a/auth/ldap/auth.php
+++ b/auth/ldap/auth.php
@@ -1671,8 +1671,8 @@ class auth_plugin_ldap extends auth_plugin_base {
                 if ($referer &&
                         $referer != $CFG->wwwroot &&
                         $referer != $CFG->wwwroot . '/' &&
-                        $referer != $CFG->httpswwwroot . '/login/' &&
-                        $referer != $CFG->httpswwwroot . '/login/index.php') {
+                        $referer != $CFG->wwwroot . '/login/' &&
+                        $referer != $CFG->wwwroot . '/login/index.php') {
                     $SESSION->wantsurl = $referer;
                 }
             }
@@ -1684,7 +1684,7 @@ class auth_plugin_ldap extends auth_plugin_base {
                     $sesskey = sesskey();
                     redirect($CFG->wwwroot.'/auth/ldap/ntlmsso_magic.php?sesskey='.$sesskey);
                 } else if ($this->config->ntlmsso_ie_fastpath == AUTH_NTLM_FASTPATH_YESFORM) {
-                    redirect($CFG->httpswwwroot.'/login/index.php?authldap_skipntlmsso=1');
+                    redirect($CFG-wwwroot.'/login/index.php?authldap_skipntlmsso=1');
                 }
             }
             redirect($CFG->wwwroot.'/auth/ldap/ntlmsso_attempt.php');
@@ -1699,7 +1699,7 @@ class auth_plugin_ldap extends auth_plugin_base {
         // we don't want to use at all. As we can't get rid of it, just point
         // $SESSION->wantsurl to $CFG->wwwroot (after all, we came from there).
         if (empty($SESSION->wantsurl)
-            && (get_local_referer() == $CFG->httpswwwroot.'/auth/ldap/ntlmsso_finish.php')) {
+            && (get_local_referer() == $CFG->wwwroot.'/auth/ldap/ntlmsso_finish.php')) {
 
             $SESSION->wantsurl = $CFG->wwwroot;
         }
diff --git a/auth/ldap/ntlmsso_attempt.php b/auth/ldap/ntlmsso_attempt.php
index 155866b14d7..3a7ad512906 100644
--- a/auth/ldap/ntlmsso_attempt.php
+++ b/auth/ldap/ntlmsso_attempt.php
@@ -32,6 +32,6 @@ echo $OUTPUT->header();
 
 $msg = '<p>'.get_string('ntlmsso_attempting', 'auth_ldap').'</p>'
     . '<img width="1", height="1" '
-    . ' src="' . $CFG->httpswwwroot . '/auth/ldap/ntlmsso_magic.php?sesskey='
+    . ' src="' . $CFG->wwwroot . '/auth/ldap/ntlmsso_magic.php?sesskey='
     . $sesskey . '" />';
-redirect($CFG->httpswwwroot . '/auth/ldap/ntlmsso_finish.php', $msg, 3);
+redirect($CFG->wwwroot . '/auth/ldap/ntlmsso_finish.php', $msg, 3);
diff --git a/auth/ldap/ntlmsso_finish.php b/auth/ldap/ntlmsso_finish.php
index e1b816f1d69..31732425259 100644
--- a/auth/ldap/ntlmsso_finish.php
+++ b/auth/ldap/ntlmsso_finish.php
@@ -29,6 +29,6 @@ if (!$authplugin->ntlmsso_finish()) {
     $PAGE->set_title("$site->fullname: $loginsite");
     $PAGE->set_heading($site->fullname);
     echo $OUTPUT->header();
-    redirect($CFG->httpswwwroot . '/login/index.php?authldap_skipntlmsso=1',
+    redirect($CFG->wwwroot . '/login/index.php?authldap_skipntlmsso=1',
              get_string('ntlmsso_failed','auth_ldap'), 3);
 }
diff --git a/auth/ldap/ntlmsso_magic.php b/auth/ldap/ntlmsso_magic.php
index fcbdf890d38..9b85989d400 100644
--- a/auth/ldap/ntlmsso_magic.php
+++ b/auth/ldap/ntlmsso_magic.php
@@ -26,7 +26,7 @@ $file = $CFG->dirroot.'/pix/spacer.gif';
 if ($authplugin->ntlmsso_magic($sesskey) && file_exists($file)) {
     if (!empty($authplugin->config->ntlmsso_ie_fastpath)) {
         if (core_useragent::is_ie()) {
-            redirect($CFG->httpswwwroot.'/auth/ldap/ntlmsso_finish.php');
+            redirect($CFG->wwwroot.'/auth/ldap/ntlmsso_finish.php');
         }
     }
 
diff --git a/auth/mnet/auth.php b/auth/mnet/auth.php
index d4293f459cd..1f269f77ff2 100644
--- a/auth/mnet/auth.php
+++ b/auth/mnet/auth.php
@@ -1073,7 +1073,7 @@ class auth_plugin_mnet extends auth_plugin_base {
         global $DB, $CFG;
 
         // strip off wwwroot, since the remote site will prefix it's return url with this
-        $wantsurl = preg_replace('/(' . preg_quote($CFG->wwwroot, '/') . '|' . preg_quote($CFG->httpswwwroot, '/') . ')/', '', $wantsurl);
+        $wantsurl = preg_replace('/(' . preg_quote($CFG->wwwroot, '/') . ')/', '', $wantsurl);
 
         $sql = "SELECT DISTINCT h.id, h.wwwroot, h.name, a.sso_jump_url, a.name as application
                   FROM {mnet_host} h
diff --git a/auth/oauth2/classes/auth.php b/auth/oauth2/classes/auth.php
index be9901285ce..65b399594d5 100644
--- a/auth/oauth2/classes/auth.php
+++ b/auth/oauth2/classes/auth.php
@@ -339,7 +339,7 @@ class auth extends \auth_plugin_base {
         $PAGE->set_title($title);
         $PAGE->set_heading($PAGE->course->fullname);
         echo $OUTPUT->header();
-        notice($message, "$CFG->httpswwwroot/index.php");
+        notice($message, "$CFG->wwwroot/index.php");
     }
 
     /**
@@ -363,7 +363,7 @@ class auth extends \auth_plugin_base {
             $errormsg = get_string('loginerror_nouserinfo', 'auth_oauth2');
             $SESSION->loginerrormsg = $errormsg;
             $client->log_out();
-            redirect(new moodle_url($CFG->httpswwwroot . '/login/index.php'));
+            redirect(new moodle_url($CFG->wwwroot . '/login/index.php'));
         }
         if (empty($userinfo['username']) || empty($userinfo['email'])) {
             // Trigger login failed event.
@@ -375,7 +375,7 @@ class auth extends \auth_plugin_base {
             $errormsg = get_string('loginerror_userincomplete', 'auth_oauth2');
             $SESSION->loginerrormsg = $errormsg;
             $client->log_out();
-            redirect(new moodle_url($CFG->httpswwwroot . '/login/index.php'));
+            redirect(new moodle_url($CFG->wwwroot . '/login/index.php'));
         }
 
         $userinfo['username'] = trim(core_text::strtolower($userinfo['username']));
@@ -416,7 +416,7 @@ class auth extends \auth_plugin_base {
                 $errormsg = get_string('confirmationpending', 'auth_oauth2');
                 $SESSION->loginerrormsg = $errormsg;
                 $client->log_out();
-                redirect(new moodle_url($CFG->httpswwwroot . '/login/index.php'));
+                redirect(new moodle_url($CFG->wwwroot . '/login/index.php'));
             }
         } else if (!empty($linkedlogin)) {
             // Trigger login failed event.
@@ -428,7 +428,7 @@ class auth extends \auth_plugin_base {
             $errormsg = get_string('confirmationpending', 'auth_oauth2');
             $SESSION->loginerrormsg = $errormsg;
             $client->log_out();
-            redirect(new moodle_url($CFG->httpswwwroot . '/login/index.php'));
+            redirect(new moodle_url($CFG->wwwroot . '/login/index.php'));
         }
 
         $issuer = $client->get_issuer();
@@ -442,7 +442,7 @@ class auth extends \auth_plugin_base {
             $errormsg = get_string('notloggedindebug', 'auth_oauth2', get_string('loginerror_invaliddomain', 'auth_oauth2'));
             $SESSION->loginerrormsg = $errormsg;
             $client->log_out();
-            redirect(new moodle_url($CFG->httpswwwroot . '/login/index.php'));
+            redirect(new moodle_url($CFG->wwwroot . '/login/index.php'));
         }
 
         if (!$userwasmapped) {
@@ -481,7 +481,7 @@ class auth extends \auth_plugin_base {
                     $errormsg = get_string('accountexists', 'auth_oauth2');
                     $SESSION->loginerrormsg = $errormsg;
                     $client->log_out();
-                    redirect(new moodle_url($CFG->httpswwwroot . '/login/index.php'));
+                    redirect(new moodle_url($CFG->wwwroot . '/login/index.php'));
                 }
 
                 if (email_is_not_allowed($userinfo['email'])) {
@@ -495,7 +495,7 @@ class auth extends \auth_plugin_base {
                     $errormsg = get_string('notloggedindebug', 'auth_oauth2', $reason);
                     $SESSION->loginerrormsg = $errormsg;
                     $client->log_out();
-                    redirect(new moodle_url($CFG->httpswwwroot . '/login/index.php'));
+                    redirect(new moodle_url($CFG->wwwroot . '/login/index.php'));
                 }
 
                 if (!empty($CFG->authpreventaccountcreation)) {
@@ -509,7 +509,7 @@ class auth extends \auth_plugin_base {
                     $errormsg = get_string('notloggedindebug', 'auth_oauth2', $reason);
                     $SESSION->loginerrormsg = $errormsg;
                     $client->log_out();
-                    redirect(new moodle_url($CFG->httpswwwroot . '/login/index.php'));
+                    redirect(new moodle_url($CFG->wwwroot . '/login/index.php'));
                 }
 
                 if ($issuer->get('requireconfirmation')) {
diff --git a/auth/shibboleth/login.php b/auth/shibboleth/login.php
index 4b41bd6895a..721af8079f9 100644
--- a/auth/shibboleth/login.php
+++ b/auth/shibboleth/login.php
@@ -41,17 +41,17 @@
         // Redirect to SessionInitiator with entityID as argument
         if (isset($IdPs[$selectedIdP][1]) && !empty($IdPs[$selectedIdP][1])) {
             // For Shibbolet 1.x Service Providers
-            header('Location: '.$IdPs[$selectedIdP][1].'?providerId='. urlencode($selectedIdP) .'&target='. urlencode($CFG->httpswwwroot.'/auth/shibboleth/index.php'));
+            header('Location: '.$IdPs[$selectedIdP][1].'?providerId='. urlencode($selectedIdP) .'&target='. urlencode($CFG->wwwroot.'/auth/shibboleth/index.php'));
 
             // For Shibbolet 2.x Service Providers
-            // header('Location: '.$IdPs[$selectedIdP][1].'?entityID='. urlencode($selectedIdP) .'&target='. urlencode($CFG->httpswwwroot.'/auth/shibboleth/index.php'));
+            // header('Location: '.$IdPs[$selectedIdP][1].'?entityID='. urlencode($selectedIdP) .'&target='. urlencode($CFG->wwwroot.'/auth/shibboleth/index.php'));
 
         } else {
             // For Shibbolet 1.x Service Providers
-            header('Location: /Shibboleth.sso?providerId='. urlencode($selectedIdP) .'&target='. urlencode($CFG->httpswwwroot.'/auth/shibboleth/index.php'));
+            header('Location: /Shibboleth.sso?providerId='. urlencode($selectedIdP) .'&target='. urlencode($CFG->wwwroot.'/auth/shibboleth/index.php'));
 
             // For Shibboleth 2.x Service Providers
-            // header('Location: /Shibboleth.sso/DS?entityID='. urlencode($selectedIdP) .'&target='. urlencode($CFG->httpswwwroot.'/auth/shibboleth/index.php'));
+            // header('Location: /Shibboleth.sso/DS?entityID='. urlencode($selectedIdP) .'&target='. urlencode($CFG->wwwroot.'/auth/shibboleth/index.php'));
         }
     } elseif (isset($_POST['idp']) && !isset($IdPs[$_POST['idp']]))  {
         $errormsg = get_string('auth_shibboleth_errormsg', 'auth_shibboleth');
diff --git a/comment/index.php b/comment/index.php
index c6e1a4233da..470d3a5417f 100644
--- a/comment/index.php
+++ b/comment/index.php
@@ -61,7 +61,7 @@ if ($action === 'delete') {
             die;
         } else {
             if ($manager->delete_comment($commentid)) {
-                redirect($CFG->httpswwwroot.'/comment/');
+                redirect($CFG->wwwroot.'/comment/');
             } else {
                 $err = 'cannotdeletecomment';
             }
@@ -81,7 +81,7 @@ echo $OUTPUT->header();
 echo $OUTPUT->heading(get_string('comments'));
 echo $OUTPUT->box_start('generalbox commentsreport');
 if (!empty($err)) {
-    print_error($err, 'error', $CFG->httpswwwroot.'/comment/');
+    print_error($err, 'error', $CFG->wwwroot.'/comment/');
 }
 if (empty($action)) {
     echo '<form method="post">';
diff --git a/lib/deprecatedlib.php b/lib/deprecatedlib.php
index 5beb8dd63e2..33e039816e0 100644
--- a/lib/deprecatedlib.php
+++ b/lib/deprecatedlib.php
@@ -534,9 +534,6 @@ function get_file_url($path, $options=null, $type='coursefile') {
        case 'rssfile':
             $url = $CFG->wwwroot."/rss/file.php";
             break;
-        case 'httpscoursefile':
-            $url = $CFG->httpswwwroot."/file.php";
-            break;
          case 'coursefile':
         default:
             $url = $CFG->wwwroot."/file.php";
diff --git a/lib/editor/tinymce/lib.php b/lib/editor/tinymce/lib.php
index e82709296b7..45c8b767b52 100644
--- a/lib/editor/tinymce/lib.php
+++ b/lib/editor/tinymce/lib.php
@@ -80,9 +80,9 @@ class tinymce_texteditor extends texteditor {
         global $PAGE, $CFG;
         // Note: use full moodle_url instance to prevent standard JS loader, make sure we are using https on profile page if required.
         if ($CFG->debugdeveloper) {
-            $PAGE->requires->js(new moodle_url($CFG->httpswwwroot.'/lib/editor/tinymce/tiny_mce/'.$this->version.'/tiny_mce_src.js'));
+            $PAGE->requires->js(new moodle_url($CFG->wwwroot.'/lib/editor/tinymce/tiny_mce/'.$this->version.'/tiny_mce_src.js'));
         } else {
-            $PAGE->requires->js(new moodle_url($CFG->httpswwwroot.'/lib/editor/tinymce/tiny_mce/'.$this->version.'/tiny_mce.js'));
+            $PAGE->requires->js(new moodle_url($CFG->wwwroot.'/lib/editor/tinymce/tiny_mce/'.$this->version.'/tiny_mce.js'));
         }
         $PAGE->requires->js_init_call('M.editor_tinymce.init_editor', array($elementid, $this->get_init_params($elementid, $options)), true);
         if ($fpoptions) {
@@ -127,8 +127,8 @@ class tinymce_texteditor extends texteditor {
             'mode' => "exact",
             'elements' => $elementid,
             'relative_urls' => false,
-            'document_base_url' => $CFG->httpswwwroot,
-            'moodle_plugin_base' => "$CFG->httpswwwroot/lib/editor/tinymce/plugins/",
+            'document_base_url' => $CFG->wwwroot,
+            'moodle_plugin_base' => "$CFG->wwwroot/lib/editor/tinymce/plugins/",
             'content_css' => $contentcss,
             'language' => $lang,
             'directionality' => $directionality,
@@ -257,7 +257,7 @@ class tinymce_texteditor extends texteditor {
      */
     public function get_tinymce_base_url() {
         global $CFG;
-        return new moodle_url("$CFG->httpswwwroot/lib/editor/tinymce/tiny_mce/$this->version/");
+        return new moodle_url("$CFG->wwwroot/lib/editor/tinymce/tiny_mce/$this->version/");
     }
 
 }
diff --git a/lib/editor/tinymce/plugins/spellchecker/lib.php b/lib/editor/tinymce/plugins/spellchecker/lib.php
index 330bbe44eae..230a8744a37 100644
--- a/lib/editor/tinymce/plugins/spellchecker/lib.php
+++ b/lib/editor/tinymce/plugins/spellchecker/lib.php
@@ -55,7 +55,7 @@ class tinymce_spellchecker extends editor_tinymce_plugin {
 
             // Add JS file, which uses default name.
             $this->add_js_plugin($params);
-            $params['spellchecker_rpc_url'] = $CFG->httpswwwroot .
+            $params['spellchecker_rpc_url'] = $CFG->wwwroot .
                     '/lib/editor/tinymce/plugins/spellchecker/rpc.php';
             $params['spellchecker_languages'] = $spelllanguagelist;
         }
diff --git a/lib/editor/tinymce/tests/editor_test.php b/lib/editor/tinymce/tests/editor_test.php
index 331c2d559fc..d2358db1801 100644
--- a/lib/editor/tinymce/tests/editor_test.php
+++ b/lib/editor/tinymce/tests/editor_test.php
@@ -74,7 +74,7 @@ class editor_tinymce_testcase extends advanced_testcase {
                 'xhtmlxtras,template,pagebreak',
             'gecko_spellcheck' => true,
             'theme_advanced_font_sizes' => "1,2,3,4,5,6,7",
-            'moodle_plugin_base' => "$CFG->httpswwwroot/lib/editor/tinymce/plugins/",
+            'moodle_plugin_base' => "$CFG->wwwroot/lib/editor/tinymce/plugins/",
             'theme_advanced_font_sizes' => "1,2,3,4,5,6,7",
             'theme_advanced_layout_manager' => "SimpleLayout",
             'theme_advanced_buttons1' => 'one,two,|,three,four',
diff --git a/lib/filelib.php b/lib/filelib.php
index 61b5bcec52a..0e17a8111a6 100644
--- a/lib/filelib.php
+++ b/lib/filelib.php
@@ -436,7 +436,7 @@ function file_prepare_draft_area(&$draftitemid, $contextid, $component, $fileare
             // at this point there should not be any draftfile links yet,
             // because this is a new text from database that should still contain the @@pluginfile@@ links
             // this happens when developers forget to post process the text
-            $text = str_replace("\"$CFG->httpswwwroot/draftfile.php", "\"$CFG->httpswwwroot/brokenfile.php#", $text);
+            $text = str_replace("\"$CFG->wwwroot/draftfile.php", "\"$CFG->wwwroot/brokenfile.php#", $text);
         }
     } else {
         // nothing to do
diff --git a/lib/filterlib.php b/lib/filterlib.php
index 516f3030eeb..0a9753ba4f6 100644
--- a/lib/filterlib.php
+++ b/lib/filterlib.php
@@ -1527,7 +1527,7 @@ function filter_add_javascript($text) {
     <script type=\"text/javascript\">
     <!--
         function openpopup(url,name,options,fullscreen) {
-          fullurl = \"".$CFG->httpswwwroot."\" + url;
+          fullurl = \"".$CFG->wwwroot."\" + url;
           windowobj = window.open(fullurl,name,options);
           if (fullscreen) {
             windowobj.moveTo(0,0);
diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index d5c6c35f5f4..774f7d43dcc 100644
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -4445,7 +4445,7 @@ function complete_user_login($user) {
             } else {
                 require_once($CFG->dirroot . '/login/lib.php');
                 $SESSION->wantsurl = core_login_get_return_url();
-                redirect($CFG->httpswwwroot.'/login/change_password.php');
+                redirect($CFG->wwwroot.'/login/change_password.php');
             }
         } else {
             print_error('nopasswordchangeforced', 'auth');
@@ -6160,7 +6160,7 @@ function reset_password_and_mail($user) {
     $a->sitename    = format_string($site->fullname);
     $a->username    = $user->username;
     $a->newpassword = $newpassword;
-    $a->link        = $CFG->httpswwwroot .'/login/change_password.php';
+    $a->link        = $CFG->wwwroot .'/login/change_password.php';
     $a->signoff     = generate_email_signoff();
 
     $message = get_string('newpasswordtext', '', $a);
@@ -6241,7 +6241,7 @@ function send_password_change_confirmation_email($user, $resetrecord) {
     $data->lastname  = $user->lastname;
     $data->username  = $user->username;
     $data->sitename  = format_string($site->fullname);
-    $data->link      = $CFG->httpswwwroot .'/login/forgot_password.php?token='. $resetrecord->token;
+    $data->link      = $CFG->wwwroot .'/login/forgot_password.php?token='. $resetrecord->token;
     $data->admin     = generate_email_signoff();
     $data->resetminutes = $pwresetmins;
 
diff --git a/lib/outputcomponents.php b/lib/outputcomponents.php
index fac5c37ab8e..0d7ff425e56 100644
--- a/lib/outputcomponents.php
+++ b/lib/outputcomponents.php
@@ -432,7 +432,6 @@ class user_picture implements renderable {
             // If the currently requested page is https then we'll return an
             // https gravatar page.
             if (is_https()) {
-                $gravatardefault = str_replace($CFG->wwwroot, $CFG->httpswwwroot, $gravatardefault); // Replace by secure url.
                 return new moodle_url("https://secure.gravatar.com/avatar/{$md5}", array('s' => $size, 'd' => $gravatardefault));
             } else {
                 return new moodle_url("http://www.gravatar.com/avatar/{$md5}", array('s' => $size, 'd' => $gravatardefault));
@@ -520,7 +519,7 @@ class help_icon implements renderable, templatable {
         $data->icon = (new pix_icon('help', $alt, 'core', ['class' => 'iconhelp']))->export_for_template($output);
         $data->linktext = $this->linktext;
         $data->title = get_string('helpprefix2', '', trim($title, ". \t"));
-        $data->url = (new moodle_url($CFG->httpswwwroot . '/help.php', [
+        $data->url = (new moodle_url($CFG->wwwroot . '/help.php', [
             'component' => $this->component,
             'identifier' => $this->identifier,
             'lang' => current_language()
diff --git a/lib/outputlib.php b/lib/outputlib.php
index e99177d6132..720490c0fd2 100644
--- a/lib/outputlib.php
+++ b/lib/outputlib.php
@@ -894,7 +894,7 @@ class theme_config {
         global $CFG;
         $rev = theme_get_revision();
         if ($rev > -1) {
-            $url = new moodle_url("$CFG->httpswwwroot/theme/styles.php");
+            $url = new moodle_url("$CFG->wwwroot/theme/styles.php");
             if (!empty($CFG->slasharguments)) {
                 $url->set_slashargument('/'.$this->name.'/'.$rev.'/editor', 'noparam', true);
             } else {
@@ -902,7 +902,7 @@ class theme_config {
             }
         } else {
             $params = array('theme'=>$this->name, 'type'=>'editor');
-            $url = new moodle_url($CFG->httpswwwroot.'/theme/styles_debug.php', $params);
+            $url = new moodle_url($CFG->wwwroot.'/theme/styles_debug.php', $params);
         }
         return $url;
     }
@@ -966,7 +966,7 @@ class theme_config {
 
         if ($rev > -1) {
             $filename = right_to_left() ? 'all-rtl' : 'all';
-            $url = new moodle_url("$CFG->httpswwwroot/theme/styles.php");
+            $url = new moodle_url("$CFG->wwwroot/theme/styles.php");
             $themesubrevision = theme_get_sub_revision_for_theme($this->name);
 
             // Provide the sub revision to allow us to invalidate cached theme CSS
@@ -1002,7 +1002,7 @@ class theme_config {
             $urls[] = $url;
 
         } else {
-            $baseurl = new moodle_url($CFG->httpswwwroot.'/theme/styles_debug.php');
+            $baseurl = new moodle_url($CFG->wwwroot.'/theme/styles_debug.php');
 
             $css = $this->get_css_files(true);
             if (!$svg) {
@@ -1686,11 +1686,11 @@ class theme_config {
         }
 
         if (!empty($CFG->slasharguments) and $rev > 0) {
-            $url = new moodle_url("$CFG->httpswwwroot/theme/javascript.php");
+            $url = new moodle_url("$CFG->wwwroot/theme/javascript.php");
             $url->set_slashargument('/'.$this->name.'/'.$rev.'/'.$params['type'], 'noparam', true);
             return $url;
         } else {
-            return new moodle_url($CFG->httpswwwroot.'/theme/javascript.php', $params);
+            return new moodle_url($CFG->wwwroot.'/theme/javascript.php', $params);
         }
     }
 
@@ -1922,7 +1922,7 @@ class theme_config {
 
         $params['image'] = $imagename;
 
-        $url = new moodle_url("$CFG->httpswwwroot/theme/image.php");
+        $url = new moodle_url("$CFG->wwwroot/theme/image.php");
         if (!empty($CFG->slasharguments) and $rev > 0) {
             $path = '/'.$params['theme'].'/'.$params['component'].'/'.$params['rev'].'/'.$params['image'];
             if (!$svg) {
@@ -1968,7 +1968,7 @@ class theme_config {
 
         $params['font'] = $font;
 
-        $url = new moodle_url("$CFG->httpswwwroot/theme/font.php");
+        $url = new moodle_url("$CFG->wwwroot/theme/font.php");
         if (!empty($CFG->slasharguments) and $rev > 0) {
             $path = '/'.$params['theme'].'/'.$params['component'].'/'.$params['rev'].'/'.$params['font'];
             $url->set_slashargument($path, 'noparam', true);
diff --git a/lib/outputrequirementslib.php b/lib/outputrequirementslib.php
index e52b517cf96..030437344a2 100644
--- a/lib/outputrequirementslib.php
+++ b/lib/outputrequirementslib.php
@@ -187,8 +187,8 @@ class page_requirements_manager {
         }
 
         // Set up some loader options.
-        $this->yui3loader->local_base = $CFG->httpswwwroot . '/lib/yuilib/'. $CFG->yui3version . '/';
-        $this->yui3loader->local_comboBase = $CFG->httpswwwroot . '/theme/yui_combo.php'.$sep;
+        $this->yui3loader->local_base = $CFG->wwwroot . '/lib/yuilib/'. $CFG->yui3version . '/';
+        $this->yui3loader->local_comboBase = $CFG->wwwroot . '/theme/yui_combo.php'.$sep;
 
         if (!empty($CFG->useexternalyui)) {
             $this->yui3loader->base = 'http://yui.yahooapis.com/' . $CFG->yui3version . '/';
@@ -220,8 +220,8 @@ class page_requirements_manager {
         $configname = $this->YUI_config->set_config_source('lib/yui/config/yui2.js');
         $this->YUI_config->add_group('yui2', array(
             // Loader configuration for our 2in3, for now ignores $CFG->useexternalyui.
-            'base' => $CFG->httpswwwroot . '/lib/yuilib/2in3/' . $CFG->yui2version . '/build/',
-            'comboBase' => $CFG->httpswwwroot . '/theme/yui_combo.php'.$sep,
+            'base' => $CFG->wwwroot . '/lib/yuilib/2in3/' . $CFG->yui2version . '/build/',
+            'comboBase' => $CFG->wwwroot . '/theme/yui_combo.php'.$sep,
             'combine' => $this->yui3loader->combine,
             'ext' => false,
             'root' => '2in3/' . $CFG->yui2version .'/build/',
@@ -235,9 +235,9 @@ class page_requirements_manager {
         $configname = $this->YUI_config->set_config_source('lib/yui/config/moodle.js');
         $this->YUI_config->add_group('moodle', array(
             'name' => 'moodle',
-            'base' => $CFG->httpswwwroot . '/theme/yui_combo.php' . $sep . 'm/' . $jsrev . '/',
+            'base' => $CFG->wwwroot . '/theme/yui_combo.php' . $sep . 'm/' . $jsrev . '/',
             'combine' => $this->yui3loader->combine,
-            'comboBase' => $CFG->httpswwwroot . '/theme/yui_combo.php'.$sep,
+            'comboBase' => $CFG->wwwroot . '/theme/yui_combo.php'.$sep,
             'ext' => false,
             'root' => 'm/'.$jsrev.'/', // Add the rev to the root path so that we can control caching.
             'patterns' => array(
@@ -250,9 +250,9 @@ class page_requirements_manager {
 
         $this->YUI_config->add_group('gallery', array(
             'name' => 'gallery',
-            'base' => $CFG->httpswwwroot . '/lib/yuilib/gallery/',
+            'base' => $CFG->wwwroot . '/lib/yuilib/gallery/',
             'combine' => $this->yui3loader->combine,
-            'comboBase' => $CFG->httpswwwroot . '/theme/yui_combo.php' . $sep,
+            'comboBase' => $CFG->wwwroot . '/theme/yui_combo.php' . $sep,
             'ext' => false,
             'root' => 'gallery/' . $jsrev . '/',
             'patterns' => array(
@@ -309,9 +309,6 @@ class page_requirements_manager {
         global $CFG;
 
         if (empty($this->M_cfg)) {
-            // JavaScript should always work with $CFG->httpswwwroot rather than $CFG->wwwroot.
-            // Otherwise, in some situations, users will get warnings about insecure content
-            // on secure pages from their web browser.
 
             $iconsystem = \core\output\icon_system::instance();
 
@@ -322,7 +319,7 @@ class page_requirements_manager {
             }
 
             $this->M_cfg = array(
-                'wwwroot'             => $CFG->httpswwwroot, // Yes, really. See above.
+                'wwwroot'             => $CFG->wwwroot,
                 'sesskey'             => sesskey(),
                 'themerev'            => theme_get_revision(),
                 'slasharguments'      => (int)(!empty($CFG->slasharguments)),
@@ -554,14 +551,14 @@ class page_requirements_manager {
                 continue;
             }
             if (!empty($CFG->slasharguments)) {
-                $url = new moodle_url("$CFG->httpswwwroot/theme/jquery.php");
+                $url = new moodle_url("$CFG->wwwroot/theme/jquery.php");
                 $url->set_slashargument("/$component/$file");
 
             } else {
                 // This is not really good, we need slasharguments for relative links, this means no caching...
                 $path = realpath("$componentdir/jquery/$file");
                 if (strpos($path, $CFG->dirroot) === 0) {
-                    $url = $CFG->httpswwwroot.preg_replace('/^'.preg_quote($CFG->dirroot, '/').'/', '', $path);
+                    $url = $CFG->wwwroot.preg_replace('/^'.preg_quote($CFG->dirroot, '/').'/', '', $path);
                     // Replace all occurences of backslashes characters in url to forward slashes.
                     $url = str_replace('\\', '/', $url);
                     $url = new moodle_url($url);
@@ -708,14 +705,14 @@ class page_requirements_manager {
             if (substr($url, -3) === '.js') {
                 $jsrev = $this->get_jsrev();
                 if (empty($CFG->slasharguments)) {
-                    return new moodle_url($CFG->httpswwwroot.'/lib/javascript.php', array('rev'=>$jsrev, 'jsfile'=>$url));
+                    return new moodle_url($CFG->wwwroot.'/lib/javascript.php', array('rev'=>$jsrev, 'jsfile'=>$url));
                 } else {
-                    $returnurl = new moodle_url($CFG->httpswwwroot.'/lib/javascript.php');
+                    $returnurl = new moodle_url($CFG->wwwroot.'/lib/javascript.php');
                     $returnurl->set_slashargument('/'.$jsrev.$url);
                     return $returnurl;
                 }
             } else {
-                return new moodle_url($CFG->httpswwwroot.$url);
+                return new moodle_url($CFG->wwwroot.$url);
             }
         } else {
             throw new coding_exception('Invalid JS url, it has to be shortened url starting with / or moodle_url instance.', $url);
@@ -914,7 +911,7 @@ class page_requirements_manager {
         if ($stylesheet instanceof moodle_url) {
             // ok
         } else if (strpos($stylesheet, '/') === 0) {
-            $stylesheet = new moodle_url($CFG->httpswwwroot.$stylesheet);
+            $stylesheet = new moodle_url($CFG->wwwroot.$stylesheet);
         } else {
             throw new coding_exception('Invalid stylesheet parameter.', $stylesheet);
         }
@@ -1318,9 +1315,9 @@ class page_requirements_manager {
         $output = '';
         $jsrev = $this->get_jsrev();
 
-        $jsloader = new moodle_url($CFG->httpswwwroot . '/lib/javascript.php');
+        $jsloader = new moodle_url($CFG->wwwroot . '/lib/javascript.php');
         $jsloader->set_slashargument('/' . $jsrev . '/');
-        $requirejsloader = new moodle_url($CFG->httpswwwroot . '/lib/requirejs.php');
+        $requirejsloader = new moodle_url($CFG->wwwroot . '/lib/requirejs.php');
         $requirejsloader->set_slashargument('/' . $jsrev . '/');
 
         $requirejsconfig = file_get_contents($CFG->dirroot . '/lib/requirejs/moodle-config.js');
diff --git a/lib/pagelib.php b/lib/pagelib.php
index 1ec4206388d..bd0c9f063f9 100644
--- a/lib/pagelib.php
+++ b/lib/pagelib.php
@@ -1301,8 +1301,8 @@ class moodle_page {
 
         if (is_string($url) && strpos($url, 'http') !== 0) {
             if (strpos($url, '/') === 0) {
-                // We have to use httpswwwroot here, because of loginhttps pages.
-                $url = $CFG->httpswwwroot . $url;
+                // Add the wwwroot to the relative url.
+                $url = $CFG->wwwroot . $url;
             } else {
                 throw new coding_exception('Invalid parameter $url, has to be full url or in shortened form starting with /.');
             }
@@ -1311,10 +1311,10 @@ class moodle_page {
         $this->_url = new moodle_url($url, $params);
 
         $fullurl = $this->_url->out_omit_querystring();
-        if (strpos($fullurl, "$CFG->httpswwwroot/") !== 0) {
-            debugging('Most probably incorrect set_page() url argument, it does not match the httpswwwroot!');
+        if (strpos($fullurl, "$CFG->wwwroot/") !== 0) {
+            debugging('Most probably incorrect set_page() url argument, it does not match the wwwroot!');
         }
-        $shorturl = str_replace("$CFG->httpswwwroot/", '', $fullurl);
+        $shorturl = str_replace("$CFG->wwwroot/", '', $fullurl);
 
         if (is_null($this->_pagetype)) {
             $this->initialise_default_pagetype($shorturl);
diff --git a/lib/phpunit/tests/basic_test.php b/lib/phpunit/tests/basic_test.php
index 9a736d688ee..9989a8ce513 100644
--- a/lib/phpunit/tests/basic_test.php
+++ b/lib/phpunit/tests/basic_test.php
@@ -52,6 +52,7 @@ class core_phpunit_basic_testcase extends basic_testcase {
      */
     public function test_bootstrap() {
         global $CFG;
+        // The use of httpswwwroot is deprecated, but we are still setting it for backwards compatibility.
         $this->assertTrue(isset($CFG->httpswwwroot));
         $this->assertEquals($CFG->httpswwwroot, $CFG->wwwroot);
         $this->assertEquals($CFG->prefix, $CFG->phpunit_prefix);
diff --git a/lib/questionlib.php b/lib/questionlib.php
index af4b916bbb5..57021a71491 100644
--- a/lib/questionlib.php
+++ b/lib/questionlib.php
@@ -1916,7 +1916,7 @@ function core_question_question_preview_pluginfile($previewcontext, $questionid,
 function question_make_export_url($contextid, $categoryid, $format, $withcategories,
         $withcontexts, $filename) {
     global $CFG;
-    $urlbase = "$CFG->httpswwwroot/pluginfile.php";
+    $urlbase = "$CFG->wwwroot/pluginfile.php";
     return moodle_url::make_file_url($urlbase,
             "/$contextid/question/export/{$categoryid}/{$format}/{$withcategories}" .
             "/{$withcontexts}/{$filename}", true);
diff --git a/lib/setup.php b/lib/setup.php
index 964567c2db4..29cf769bf73 100644
--- a/lib/setup.php
+++ b/lib/setup.php
@@ -528,8 +528,8 @@ global $FULLSCRIPT;
  */
 global $SCRIPT;
 
-// Set httpswwwroot default value (this variable will replace $CFG->wwwroot
-// inside some URLs used in HTTPSPAGEREQUIRED pages.
+// Set httpswwwroot to $CFG->wwwroot for backwards compatibility
+// The loginhttps option is deprecated, so httpswwwroot is no longer necessary. See MDL-42834.
 $CFG->httpswwwroot = $CFG->wwwroot;
 
 require_once($CFG->libdir .'/setuplib.php');        // Functions that MUST be loaded first
diff --git a/lib/tests/outputcomponents_test.php b/lib/tests/outputcomponents_test.php
index 0cf59b5d0f9..de5ec1ebd4b 100644
--- a/lib/tests/outputcomponents_test.php
+++ b/lib/tests/outputcomponents_test.php
@@ -126,7 +126,6 @@ class core_outputcomponents_testcase extends advanced_testcase {
         $this->assertEquals(1, $CFG->themerev);
         $this->assertEquals(0, $CFG->themedesignermode);
         $this->assertSame('https://www.example.com/moodle', $CFG->wwwroot);
-        $this->assertSame($CFG->wwwroot, $CFG->httpswwwroot);
         $this->assertEquals(0, $CFG->enablegravatar);
         $this->assertSame('mm', $CFG->gravatardefaulturl);
 
@@ -207,7 +206,6 @@ class core_outputcomponents_testcase extends advanced_testcase {
 
         // Http version.
         $CFG->wwwroot = str_replace('https:', 'http:', $CFG->wwwroot);
-        $CFG->httpswwwroot = str_replace('https:', 'http:', $CFG->wwwroot);
 
         // Verify defaults to misteryman (mm).
         $up2 = new user_picture($user2);
@@ -222,13 +220,13 @@ class core_outputcomponents_testcase extends advanced_testcase {
         $this->assertSame($CFG->wwwroot.'/pluginfile.php/'.$context1->id.'/user/icon/boost/f2?rev=11', $up1->get_url($page, $renderer)->out(false));
 
         // Https version.
-        $CFG->httpswwwroot = str_replace('http:', 'https:', $CFG->wwwroot);
+        $CFG->wwwroot = str_replace('http:', 'https:', $CFG->wwwroot);
 
         $up1 = new user_picture($user1);
-        $this->assertSame($CFG->httpswwwroot.'/pluginfile.php/'.$context1->id.'/user/icon/boost/f2?rev=11', $up1->get_url($page, $renderer)->out(false));
+        $this->assertSame($CFG->wwwroot.'/pluginfile.php/'.$context1->id.'/user/icon/boost/f2?rev=11', $up1->get_url($page, $renderer)->out(false));
 
         $up3 = new user_picture($user3);
-        $this->assertSame($CFG->httpswwwroot.'/theme/image.php/boost/core/1/u/f2', $up3->get_url($page, $renderer)->out(false));
+        $this->assertSame($CFG->wwwroot.'/theme/image.php/boost/core/1/u/f2', $up3->get_url($page, $renderer)->out(false));
 
         $up2 = new user_picture($user2);
         $this->assertSame('https://secure.gravatar.com/avatar/ab53a2911ddf9b4817ac01ddcd3d975f?s=35&d=https%3A%2F%2Fwww.example.com%2Fmoodle%2Fpix%2Fu%2Ff2.png', $up2->get_url($page, $renderer)->out(false));
@@ -271,7 +269,7 @@ class core_outputcomponents_testcase extends advanced_testcase {
 
         // Test non-slashargument images.
         set_config('theme', 'clean');
-        $CFG->httpswwwroot = $CFG->wwwroot;
+        $CFG->wwwroot = str_replace('https:', 'http:', $CFG->wwwroot);
         $CFG->slasharguments = 0;
         $page = new moodle_page();
         $page->set_url('/user/profile.php');
diff --git a/lib/tests/sessionlib_test.php b/lib/tests/sessionlib_test.php
index c77fdfbc977..70b91ca25ba 100644
--- a/lib/tests/sessionlib_test.php
+++ b/lib/tests/sessionlib_test.php
@@ -165,7 +165,6 @@ class core_sessionlib_testcase extends advanced_testcase {
                 // Non ssl, not set.
                 'config' => array(
                     'wwwroot'       => 'http://example.com',
-                    'httpswwwroot'  => 'http://example.com',
                     'sslproxy'      => null,
                     'cookiesecure'  => null,
                 ),
@@ -175,7 +174,6 @@ class core_sessionlib_testcase extends advanced_testcase {
                 // Non ssl, off and ignored.
                 'config' => array(
                     'wwwroot'       => 'http://example.com',
-                    'httpswwwroot'  => 'http://example.com',
                     'sslproxy'      => null,
                     'cookiesecure'  => false,
                 ),
@@ -185,7 +183,6 @@ class core_sessionlib_testcase extends advanced_testcase {
                 // Non ssl, on and ignored.
                 'config' => array(
                     'wwwroot'       => 'http://example.com',
-                    'httpswwwroot'  => 'http://example.com',
                     'sslproxy'      => null,
                     'cookiesecure'  => true,
                 ),
@@ -195,7 +192,6 @@ class core_sessionlib_testcase extends advanced_testcase {
                 // SSL via proxy, off.
                 'config' => array(
                     'wwwroot'       => 'http://example.com',
-                    'httpswwwroot'  => 'http://example.com',
                     'sslproxy'      => true,
                     'cookiesecure'  => false,
                 ),
@@ -205,7 +201,6 @@ class core_sessionlib_testcase extends advanced_testcase {
                 // SSL via proxy, on.
                 'config' => array(
                     'wwwroot'       => 'http://example.com',
-                    'httpswwwroot'  => 'http://example.com',
                     'sslproxy'      => true,
                     'cookiesecure'  => true,
                 ),
@@ -215,7 +210,6 @@ class core_sessionlib_testcase extends advanced_testcase {
                 // SSL and off.
                 'config' => array(
                     'wwwroot'       => 'https://example.com',
-                    'httpswwwroot'  => 'https://example.com',
                     'sslproxy'      => null,
                     'cookiesecure'  => false,
                 ),
@@ -225,7 +219,6 @@ class core_sessionlib_testcase extends advanced_testcase {
                 // SSL and on.
                 'config' => array(
                     'wwwroot'       => 'https://example.com',
-                    'httpswwwroot'  => 'https://example.com',
                     'sslproxy'      => null,
                     'cookiesecure'  => true,
                 ),
@@ -243,10 +236,10 @@ class core_sessionlib_testcase extends advanced_testcase {
      * @param bool $secure Wether cookies should be secure or not
      */
     public function test_is_moodle_cookie_secure($config, $secure) {
-
+        global $CFG;
         $this->resetAfterTest();
         foreach ($config as $key => $value) {
-            set_config($key, $value);
+            $CFG->$key = $value;
         }
         $this->assertEquals($secure, is_moodle_cookie_secure());
     }
diff --git a/lib/upgrade.txt b/lib/upgrade.txt
index a2b7ca8441c..c3f824a8aaa 100644
--- a/lib/upgrade.txt
+++ b/lib/upgrade.txt
@@ -57,6 +57,7 @@ information provided here is intended especially for developers.
 * The option for Login HTTPS (authentication-only SSL) has been removed
 * $CFG->loginhttps is now deprecated, do not use it.
 * $PAGE->https_required and $PAGE->verify_https_required() are now deprecated. They are no longer used and will throw a coding_exception.
+* $CFG->httpswwwroot is now deprecated and will always result in the same value as wwwroot.
 
 === 3.3.1 ===
 
diff --git a/lib/weblib.php b/lib/weblib.php
index 0cea44cb4b7..e8e2e95de39 100644
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -203,7 +203,7 @@ function qualified_me() {
 /**
  * Determines whether or not the Moodle site is being served over HTTPS.
  *
- * This is done simply by checking the value of $CFG->httpswwwroot, which seems
+ * This is done simply by checking the value of $CFG->wwwroot, which seems
  * to be the only reliable method.
  *
  * @return boolean True if site is served over HTTPS, false otherwise.
@@ -211,7 +211,7 @@ function qualified_me() {
 function is_https() {
     global $CFG;
 
-    return (strpos($CFG->httpswwwroot, 'https://') === 0);
+    return (strpos($CFG->wwwroot, 'https://') === 0);
 }
 
 /**
@@ -347,12 +347,9 @@ class moodle_url {
 
             // Normalise shortened form of our url ex.: '/course/view.php'.
             if (strpos($url, '/') === 0) {
-                // We must not use httpswwwroot here, because it might be url of other page,
-                // devs have to use httpswwwroot explicitly when creating new moodle_url.
                 $url = $CFG->wwwroot.$url;
             }
 
-            // Now fix the admin links if needed, no need to mess with httpswwwroot.
             if ($CFG->admin !== 'admin') {
                 if (strpos($url, "$CFG->wwwroot/admin/") === 0) {
                     $url = str_replace("$CFG->wwwroot/admin/", "$CFG->wwwroot/$CFG->admin/", $url);
@@ -781,7 +778,7 @@ class moodle_url {
     public static function make_pluginfile_url($contextid, $component, $area, $itemid, $pathname, $filename,
                                                $forcedownload = false) {
         global $CFG;
-        $urlbase = "$CFG->httpswwwroot/pluginfile.php";
+        $urlbase = "$CFG->wwwroot/pluginfile.php";
         if ($itemid === null) {
             return self::make_file_url($urlbase, "/$contextid/$component/$area".$pathname.$filename, $forcedownload);
         } else {
@@ -807,7 +804,7 @@ class moodle_url {
     public static function make_webservice_pluginfile_url($contextid, $component, $area, $itemid, $pathname, $filename,
                                                $forcedownload = false) {
         global $CFG;
-        $urlbase = "$CFG->httpswwwroot/webservice/pluginfile.php";
+        $urlbase = "$CFG->wwwroot/webservice/pluginfile.php";
         if ($itemid === null) {
             return self::make_file_url($urlbase, "/$contextid/$component/$area".$pathname.$filename, $forcedownload);
         } else {
@@ -826,7 +823,7 @@ class moodle_url {
      */
     public static function make_draftfile_url($draftid, $pathname, $filename, $forcedownload = false) {
         global $CFG, $USER;
-        $urlbase = "$CFG->httpswwwroot/draftfile.php";
+        $urlbase = "$CFG->wwwroot/draftfile.php";
         $context = context_user::instance($USER->id);
 
         return self::make_file_url($urlbase, "/$context->id/user/draft/$draftid".$pathname.$filename, $forcedownload);
@@ -861,15 +858,11 @@ class moodle_url {
         global $CFG;
 
         $url = $this->out($escaped, $overrideparams);
-        $httpswwwroot = str_replace("http://", "https://", $CFG->wwwroot);
 
-        // Url should be equal to wwwroot or httpswwwroot. If not then throw exception.
+        // Url should be equal to wwwroot. If not then throw exception.
         if (($url === $CFG->wwwroot) || (strpos($url, $CFG->wwwroot.'/') === 0)) {
             $localurl = substr($url, strlen($CFG->wwwroot));
             return !empty($localurl) ? $localurl : '';
-        } else if (($url === $httpswwwroot) || (strpos($url, $httpswwwroot.'/') === 0)) {
-            $localurl = substr($url, strlen($httpswwwroot));
-            return !empty($localurl) ? $localurl : '';
         } else {
             throw new coding_exception('out_as_local_url called on a non-local URL');
         }
@@ -1318,7 +1311,7 @@ function format_text($text, $format = FORMAT_MOODLE, $options = null, $courseidd
         // this happens when developers forget to post process the text.
         // The only potential problem is that somebody might try to format
         // the text before storing into database which would be itself big bug..
-        $text = str_replace("\"$CFG->httpswwwroot/draftfile.php", "\"$CFG->httpswwwroot/brokenfile.php#", $text);
+        $text = str_replace("\"$CFG->wwwroot/draftfile.php", "\"$CFG->wwwroot/brokenfile.php#", $text);
 
         if ($CFG->debugdeveloper) {
             if (strpos($text, '@@PLUGINFILE@@/') !== false) {
diff --git a/login/change_password.php b/login/change_password.php
index 32e79531659..f5ce3e9ea4c 100644
--- a/login/change_password.php
+++ b/login/change_password.php
@@ -61,7 +61,7 @@ if (!$course = $DB->get_record('course', array('id'=>$id))) {
 // require proper login; guest user can not change password
 if (!isloggedin() or isguestuser()) {
     if (empty($SESSION->wantsurl)) {
-        $SESSION->wantsurl = $CFG->httpswwwroot.'/login/change_password.php';
+        $SESSION->wantsurl = $CFG->wwwroot.'/login/change_password.php';
     }
     redirect(get_login_url());
 }
diff --git a/login/forgot_password.php b/login/forgot_password.php
index 5f23664903e..ba54ce2f8dc 100644
--- a/login/forgot_password.php
+++ b/login/forgot_password.php
@@ -82,7 +82,7 @@ if (empty($token)) {
     // The session var is intentionally used only during the lifespan of one request (the redirect) and is unset above.
     if (!$tokeninsession && $_SERVER['REQUEST_METHOD'] === 'GET') {
         $SESSION->password_reset_token = $token;
-        redirect($CFG->httpswwwroot . '/login/forgot_password.php');
+        redirect($CFG->wwwroot . '/login/forgot_password.php');
     } else {
         // Continue with the password reset process.
         core_login_process_password_set($token);
diff --git a/login/index.php b/login/index.php
index 322575b2527..65365604898 100644
--- a/login/index.php
+++ b/login/index.php
@@ -33,7 +33,7 @@ $testsession = optional_param('testsession', 0, PARAM_INT); // test session work
 $anchor      = optional_param('anchor', '', PARAM_RAW);      // Used to restore hash anchor to wantsurl.
 
 $context = context_system::instance();
-$PAGE->set_url("$CFG->httpswwwroot/login/index.php");
+$PAGE->set_url("$CFG->wwwroot/login/index.php");
 $PAGE->set_context($context);
 $PAGE->set_pagelayout('login');
 
@@ -206,12 +206,12 @@ if ($frm and isset($frm->username)) {                             // Login WITH
             if ($userauth->can_change_password()) {
                 $passwordchangeurl = $userauth->change_password_url();
                 if (!$passwordchangeurl) {
-                    $passwordchangeurl = $CFG->httpswwwroot.'/login/change_password.php';
+                    $passwordchangeurl = $CFG->wwwroot.'/login/change_password.php';
                 } else {
                     $externalchangepassword = true;
                 }
             } else {
-                $passwordchangeurl = $CFG->httpswwwroot.'/login/change_password.php';
+                $passwordchangeurl = $CFG->wwwroot.'/login/change_password.php';
             }
             $days2expire = $userauth->password_expire($USER->username);
             $PAGE->set_title("$site->fullname: $loginsite");
@@ -271,9 +271,9 @@ if (empty($SESSION->wantsurl)) {
     if ($referer &&
             $referer != $CFG->wwwroot &&
             $referer != $CFG->wwwroot . '/' &&
-            $referer != $CFG->httpswwwroot . '/login/' &&
-            strpos($referer, $CFG->httpswwwroot . '/login/?') !== 0 &&
-            strpos($referer, $CFG->httpswwwroot . '/login/index.php') !== 0) { // There might be some extra params such as ?lang=.
+            $referer != $CFG->wwwroot . '/login/' &&
+            strpos($referer, $CFG->wwwroot . '/login/?') !== 0 &&
+            strpos($referer, $CFG->wwwroot . '/login/index.php') !== 0) { // There might be some extra params such as ?lang=.
         $SESSION->wantsurl = $referer;
     }
 }
@@ -328,7 +328,7 @@ if (!empty($SESSION->loginerrormsg)) {
     if ($errormsg) {
         $SESSION->loginerrormsg = $errormsg;
     }
-    redirect(new moodle_url($CFG->httpswwwroot . '/login/index.php'));
+    redirect(new moodle_url($CFG->wwwroot . '/login/index.php'));
 }
 
 $PAGE->set_title("$site->fullname: $loginsite");
@@ -339,8 +339,8 @@ echo $OUTPUT->header();
 if (isloggedin() and !isguestuser()) {
     // prevent logging when already logged in, we do not want them to relogin by accident because sesskey would be changed
     echo $OUTPUT->box_start();
-    $logout = new single_button(new moodle_url($CFG->httpswwwroot.'/login/logout.php', array('sesskey'=>sesskey(),'loginpage'=>1)), get_string('logout'), 'post');
-    $continue = new single_button(new moodle_url($CFG->httpswwwroot.'/login/index.php', array('cancel'=>1)), get_string('cancel'), 'get');
+    $logout = new single_button(new moodle_url($CFG->wwwroot.'/login/logout.php', array('sesskey'=>sesskey(),'loginpage'=>1)), get_string('logout'), 'post');
+    $continue = new single_button(new moodle_url('/'), get_string('cancel'), 'get');
     echo $OUTPUT->confirm(get_string('alreadyloggedin', 'error', fullname($USER)), $logout, $continue);
     echo $OUTPUT->box_end();
 } else {
diff --git a/login/lib.php b/login/lib.php
index c2879d2dec7..231b7a969ee 100644
--- a/login/lib.php
+++ b/login/lib.php
@@ -209,7 +209,7 @@ function core_login_process_password_set($token) {
              WHERE upr.token = ?";
     $user = $DB->get_record_sql($sql, array($token));
 
-    $forgotpasswordurl = "{$CFG->httpswwwroot}/login/forgot_password.php";
+    $forgotpasswordurl = "{$CFG->wwwroot}/login/forgot_password.php";
     if (empty($user) or ($user->timerequested < (time() - $pwresettime - DAYSECS))) {
         // There is no valid reset request record - not even a recently expired one.
         // (suspicious)
diff --git a/login/signup.php b/login/signup.php
index 72746856afb..811bd87e44e 100644
--- a/login/signup.php
+++ b/login/signup.php
@@ -50,7 +50,7 @@ if (isloggedin() and !isguestuser()) {
     // Prevent signing up when already logged in.
     echo $OUTPUT->header();
     echo $OUTPUT->box_start();
-    $logout = new single_button(new moodle_url($CFG->httpswwwroot . '/login/logout.php',
+    $logout = new single_button(new moodle_url($CFG->wwwroot . '/login/logout.php',
         array('sesskey' => sesskey(), 'loginpage' => 1)), get_string('logout'), 'post');
     $continue = new single_button(new moodle_url('/'), get_string('cancel'), 'get');
     echo $OUTPUT->confirm(get_string('cannotsignup', 'error', fullname($USER)), $logout, $continue);
diff --git a/mod/chat/gui_ajax/index.php b/mod/chat/gui_ajax/index.php
index 8f737859195..c78f0c0e75c 100644
--- a/mod/chat/gui_ajax/index.php
+++ b/mod/chat/gui_ajax/index.php
@@ -70,8 +70,8 @@ $module = array(
                          array('modulename', 'chat'), array('beep', 'chat'), array('talk', 'chat'))
 );
 $modulecfg = array(
-    'home' => $CFG->httpswwwroot.'/mod/chat/view.php?id='.$cm->id,
-    'chaturl' => $CFG->httpswwwroot.'/mod/chat/gui_ajax/index.php?id='.$id,
+    'home' => $CFG->wwwroot.'/mod/chat/view.php?id='.$cm->id,
+    'chaturl' => $CFG->wwwroot.'/mod/chat/gui_ajax/index.php?id='.$id,
     'theme' => $theme,
     'userid' => $USER->id,
     'sid' => $chatsid,
diff --git a/mod/lti/locallib.php b/mod/lti/locallib.php
index 07fa6d66ce1..89ee9991c6c 100644
--- a/mod/lti/locallib.php
+++ b/mod/lti/locallib.php
@@ -2378,7 +2378,7 @@ function lti_get_launch_container($lti, $toolconfig) {
 
 function lti_request_is_using_ssl() {
     global $CFG;
-    return (stripos($CFG->httpswwwroot, 'https://') === 0);
+    return (stripos($CFG->wwwroot, 'https://') === 0);
 }
 
 function lti_ensure_url_is_https($url) {
diff --git a/repository/draftfiles_manager.php b/repository/draftfiles_manager.php
index 360f08b300a..7a25e641ea4 100644
--- a/repository/draftfiles_manager.php
+++ b/repository/draftfiles_manager.php
@@ -73,7 +73,7 @@ $fs = get_file_storage();
 
 $params = array('ctx_id' => $contextid, 'itemid' => $itemid, 'env' => $env, 'course'=>$courseid, 'maxbytes'=>$maxbytes, 'areamaxbytes'=>$areamaxbytes, 'maxfiles'=>$maxfiles, 'subdirs'=>$subdirs, 'sesskey'=>sesskey());
 $PAGE->set_url('/repository/draftfiles_manager.php', $params);
-$filepicker_url = new moodle_url($CFG->httpswwwroot."/repository/filepicker.php", $params);
+$filepicker_url = new moodle_url($CFG->wwwroot."/repository/filepicker.php", $params);
 
 $params['action'] = 'browse';
 $home_url = new moodle_url('/repository/draftfiles_manager.php', $params);
diff --git a/repository/dropbox/lib.php b/repository/dropbox/lib.php
index 0f7f2096fe3..8b8ff6f9a13 100644
--- a/repository/dropbox/lib.php
+++ b/repository/dropbox/lib.php
@@ -591,7 +591,7 @@ class repository_dropbox extends repository {
     public static function get_oauth2callbackurl() {
         global $CFG;
 
-        return new moodle_url($CFG->httpswwwroot . '/admin/oauth2callback.php');
+        return new moodle_url($CFG->wwwroot . '/admin/oauth2callback.php');
     }
 
     /**
diff --git a/repository/filepicker.php b/repository/filepicker.php
index 4ce0236020a..0632a279874 100644
--- a/repository/filepicker.php
+++ b/repository/filepicker.php
@@ -101,7 +101,7 @@ $home_url = new moodle_url('/repository/draftfiles_manager.php', $params);
 
 $params['savepath'] = $savepath;
 $params['repo_id'] = $repo_id;
-$url = new moodle_url($CFG->httpswwwroot."/repository/filepicker.php", $params);
+$url = new moodle_url($CFG->wwwroot."/repository/filepicker.php", $params);
 $PAGE->set_url('/repository/filepicker.php', $params);
 
 switch ($action) {
@@ -212,7 +212,7 @@ case 'sign':
                 // TODO MDL-28482: need a better solution
                 // paging_bar is not a good option because it starts page numbering from 0 and
                 // repositories number pages starting from 1.
-                $pagingurl = new moodle_url("$CFG->httpswwwroot/repository/filepicker.php?action=list&itemid=$itemid&ctx_id=$contextid&repo_id=$repo_id&course=$courseid&sesskey=".  sesskey());
+                $pagingurl = new moodle_url("$CFG->wwwroot/repository/filepicker.php?action=list&itemid=$itemid&ctx_id=$contextid&repo_id=$repo_id&course=$courseid&sesskey=".  sesskey());
                 if (!isset($list['perpage']) && !isset($list['total'])) {
                     $list['perpage'] = 10; // instead of setting perpage&total we use number of pages, the result is the same
                 }
diff --git a/theme/styles_debug.php b/theme/styles_debug.php
index f35f54af0b0..e52dd8213b1 100644
--- a/theme/styles_debug.php
+++ b/theme/styles_debug.php
@@ -56,7 +56,7 @@ if ($type === 'editor') {
     css_send_uncached_css($csscontent);
 }
 
-$chunkurl = new moodle_url($CFG->httpswwwroot . '/theme/styles_debug.php', array('theme' => $themename,
+$chunkurl = new moodle_url($CFG->wwwroot . '/theme/styles_debug.php', array('theme' => $themename,
     'type' => $type, 'subtype' => $subtype, 'sheet' => $sheet, 'usesvg' => $usesvg, 'rtl' => $rtl));
 
 // We need some kind of caching here because otherwise the page navigation becomes
diff --git a/user/edit.php b/user/edit.php
index bb4a440c561..f837016ed7e 100644
--- a/user/edit.php
+++ b/user/edit.php
@@ -44,7 +44,7 @@ if ($course->id != SITEID) {
     require_login($course);
 } else if (!isloggedin()) {
     if (empty($SESSION->wantsurl)) {
-        $SESSION->wantsurl = $CFG->httpswwwroot.'/user/edit.php';
+        $SESSION->wantsurl = $CFG->wwwroot.'/user/edit.php';
     }
     redirect(get_login_url());
 } else {
diff --git a/user/editlib.php b/user/editlib.php
index 83682747117..6a42d72fa8d 100644
--- a/user/editlib.php
+++ b/user/editlib.php
@@ -57,7 +57,7 @@ function useredit_setup_preference_page($userid, $courseid) {
         require_login($course);
     } else if (!isloggedin()) {
         if (empty($SESSION->wantsurl)) {
-            $SESSION->wantsurl = $CFG->httpswwwroot.'/user/preferences.php';
+            $SESSION->wantsurl = $CFG->wwwroot.'/user/preferences.php';
         }
         redirect(get_login_url());
     } else {

From 7eb50b3290e254849fc961b3fabee2feb3aab040 Mon Sep 17 00:00:00 2001
From: John Okely <jlokely@gmail.com>
Date: Tue, 12 Sep 2017 14:05:51 +0800
Subject: [PATCH 6/6] MDL-42834 admin: Remove wwwroot if used with moodle_url

---
 admin/user.php                    |  4 ++--
 auth/classes/output/login.php     |  4 ++--
 auth/oauth2/classes/auth.php      | 18 ++++++++----------
 lib/editor/tinymce/lib.php        |  6 +++---
 lib/outputcomponents.php          |  2 +-
 lib/outputlib.php                 | 16 ++++++++--------
 lib/outputrequirementslib.php     | 14 +++++++-------
 login/index.php                   |  4 ++--
 login/signup.php                  |  2 +-
 repository/draftfiles_manager.php |  2 +-
 repository/dropbox/lib.php        |  2 +-
 repository/filepicker.php         |  4 ++--
 theme/styles_debug.php            |  2 +-
 13 files changed, 39 insertions(+), 41 deletions(-)

diff --git a/admin/user.php b/admin/user.php
index 834c0804545..65bf4e63ec9 100644
--- a/admin/user.php
+++ b/admin/user.php
@@ -333,7 +333,7 @@
             if (has_capability('moodle/user:update', $sitecontext)) {
                 // prevent editing of admins by non-admins
                 if (is_siteadmin($USER) or !is_siteadmin($user)) {
-                    $url = new moodle_url($CFG->wwwroot.'/user/editadvanced.php', array('id'=>$user->id, 'course'=>$site->id));
+                    $url = new moodle_url('/user/editadvanced.php', array('id'=>$user->id, 'course'=>$site->id));
                     $buttons[] = html_writer::link($url, $OUTPUT->pix_icon('t/edit', $stredit));
                 }
             }
@@ -392,7 +392,7 @@
         echo $OUTPUT->paging_bar($usercount, $page, $perpage, $baseurl);
     }
     if (has_capability('moodle/user:create', $sitecontext)) {
-        $url = new moodle_url($CFG->wwwroot . '/user/editadvanced.php', array('id' => -1));
+        $url = new moodle_url('/user/editadvanced.php', array('id' => -1));
         echo $OUTPUT->single_button($url, get_string('addnewuser'), 'get');
     }
 
diff --git a/auth/classes/output/login.php b/auth/classes/output/login.php
index e42707a5dee..9ec9c329cbb 100644
--- a/auth/classes/output/login.php
+++ b/auth/classes/output/login.php
@@ -90,8 +90,8 @@ class login implements renderable, templatable {
         $this->autofocusform = !empty($CFG->loginpageautofocus);
         $this->rememberusername = isset($CFG->rememberusername) and $CFG->rememberusername == 2;
 
-        $this->forgotpasswordurl = new moodle_url($CFG->wwwroot . '/login/forgot_password.php');
-        $this->loginurl = new moodle_url($CFG->wwwroot . '/login/index.php');
+        $this->forgotpasswordurl = new moodle_url('/login/forgot_password.php');
+        $this->loginurl = new moodle_url('/login/index.php');
         $this->signupurl = new moodle_url('/login/signup.php');
 
         // Authentication instructions.
diff --git a/auth/oauth2/classes/auth.php b/auth/oauth2/classes/auth.php
index 65b399594d5..1761768c223 100644
--- a/auth/oauth2/classes/auth.php
+++ b/auth/oauth2/classes/auth.php
@@ -363,7 +363,7 @@ class auth extends \auth_plugin_base {
             $errormsg = get_string('loginerror_nouserinfo', 'auth_oauth2');
             $SESSION->loginerrormsg = $errormsg;
             $client->log_out();
-            redirect(new moodle_url($CFG->wwwroot . '/login/index.php'));
+            redirect(new moodle_url('/login/index.php'));
         }
         if (empty($userinfo['username']) || empty($userinfo['email'])) {
             // Trigger login failed event.
@@ -375,7 +375,7 @@ class auth extends \auth_plugin_base {
             $errormsg = get_string('loginerror_userincomplete', 'auth_oauth2');
             $SESSION->loginerrormsg = $errormsg;
             $client->log_out();
-            redirect(new moodle_url($CFG->wwwroot . '/login/index.php'));
+            redirect(new moodle_url('/login/index.php'));
         }
 
         $userinfo['username'] = trim(core_text::strtolower($userinfo['username']));
@@ -416,7 +416,7 @@ class auth extends \auth_plugin_base {
                 $errormsg = get_string('confirmationpending', 'auth_oauth2');
                 $SESSION->loginerrormsg = $errormsg;
                 $client->log_out();
-                redirect(new moodle_url($CFG->wwwroot . '/login/index.php'));
+                redirect(new moodle_url('/login/index.php'));
             }
         } else if (!empty($linkedlogin)) {
             // Trigger login failed event.
@@ -428,7 +428,7 @@ class auth extends \auth_plugin_base {
             $errormsg = get_string('confirmationpending', 'auth_oauth2');
             $SESSION->loginerrormsg = $errormsg;
             $client->log_out();
-            redirect(new moodle_url($CFG->wwwroot . '/login/index.php'));
+            redirect(new moodle_url('/login/index.php'));
         }
 
         $issuer = $client->get_issuer();
@@ -442,7 +442,7 @@ class auth extends \auth_plugin_base {
             $errormsg = get_string('notloggedindebug', 'auth_oauth2', get_string('loginerror_invaliddomain', 'auth_oauth2'));
             $SESSION->loginerrormsg = $errormsg;
             $client->log_out();
-            redirect(new moodle_url($CFG->wwwroot . '/login/index.php'));
+            redirect(new moodle_url('/login/index.php'));
         }
 
         if (!$userwasmapped) {
@@ -481,7 +481,7 @@ class auth extends \auth_plugin_base {
                     $errormsg = get_string('accountexists', 'auth_oauth2');
                     $SESSION->loginerrormsg = $errormsg;
                     $client->log_out();
-                    redirect(new moodle_url($CFG->wwwroot . '/login/index.php'));
+                    redirect(new moodle_url('/login/index.php'));
                 }
 
                 if (email_is_not_allowed($userinfo['email'])) {
@@ -495,7 +495,7 @@ class auth extends \auth_plugin_base {
                     $errormsg = get_string('notloggedindebug', 'auth_oauth2', $reason);
                     $SESSION->loginerrormsg = $errormsg;
                     $client->log_out();
-                    redirect(new moodle_url($CFG->wwwroot . '/login/index.php'));
+                    redirect(new moodle_url('/login/index.php'));
                 }
 
                 if (!empty($CFG->authpreventaccountcreation)) {
@@ -509,7 +509,7 @@ class auth extends \auth_plugin_base {
                     $errormsg = get_string('notloggedindebug', 'auth_oauth2', $reason);
                     $SESSION->loginerrormsg = $errormsg;
                     $client->log_out();
-                    redirect(new moodle_url($CFG->wwwroot . '/login/index.php'));
+                    redirect(new moodle_url('/login/index.php'));
                 }
 
                 if ($issuer->get('requireconfirmation')) {
@@ -542,5 +542,3 @@ class auth extends \auth_plugin_base {
         redirect($redirecturl);
     }
 }
-
-
diff --git a/lib/editor/tinymce/lib.php b/lib/editor/tinymce/lib.php
index 45c8b767b52..a886e1ef705 100644
--- a/lib/editor/tinymce/lib.php
+++ b/lib/editor/tinymce/lib.php
@@ -80,9 +80,9 @@ class tinymce_texteditor extends texteditor {
         global $PAGE, $CFG;
         // Note: use full moodle_url instance to prevent standard JS loader, make sure we are using https on profile page if required.
         if ($CFG->debugdeveloper) {
-            $PAGE->requires->js(new moodle_url($CFG->wwwroot.'/lib/editor/tinymce/tiny_mce/'.$this->version.'/tiny_mce_src.js'));
+            $PAGE->requires->js(new moodle_url('/lib/editor/tinymce/tiny_mce/'.$this->version.'/tiny_mce_src.js'));
         } else {
-            $PAGE->requires->js(new moodle_url($CFG->wwwroot.'/lib/editor/tinymce/tiny_mce/'.$this->version.'/tiny_mce.js'));
+            $PAGE->requires->js(new moodle_url('/lib/editor/tinymce/tiny_mce/'.$this->version.'/tiny_mce.js'));
         }
         $PAGE->requires->js_init_call('M.editor_tinymce.init_editor', array($elementid, $this->get_init_params($elementid, $options)), true);
         if ($fpoptions) {
@@ -257,7 +257,7 @@ class tinymce_texteditor extends texteditor {
      */
     public function get_tinymce_base_url() {
         global $CFG;
-        return new moodle_url("$CFG->wwwroot/lib/editor/tinymce/tiny_mce/$this->version/");
+        return new moodle_url("/lib/editor/tinymce/tiny_mce/$this->version/");
     }
 
 }
diff --git a/lib/outputcomponents.php b/lib/outputcomponents.php
index 0d7ff425e56..888edfd0512 100644
--- a/lib/outputcomponents.php
+++ b/lib/outputcomponents.php
@@ -519,7 +519,7 @@ class help_icon implements renderable, templatable {
         $data->icon = (new pix_icon('help', $alt, 'core', ['class' => 'iconhelp']))->export_for_template($output);
         $data->linktext = $this->linktext;
         $data->title = get_string('helpprefix2', '', trim($title, ". \t"));
-        $data->url = (new moodle_url($CFG->wwwroot . '/help.php', [
+        $data->url = (new moodle_url('/help.php', [
             'component' => $this->component,
             'identifier' => $this->identifier,
             'lang' => current_language()
diff --git a/lib/outputlib.php b/lib/outputlib.php
index 720490c0fd2..6d101b37660 100644
--- a/lib/outputlib.php
+++ b/lib/outputlib.php
@@ -894,7 +894,7 @@ class theme_config {
         global $CFG;
         $rev = theme_get_revision();
         if ($rev > -1) {
-            $url = new moodle_url("$CFG->wwwroot/theme/styles.php");
+            $url = new moodle_url("/theme/styles.php");
             if (!empty($CFG->slasharguments)) {
                 $url->set_slashargument('/'.$this->name.'/'.$rev.'/editor', 'noparam', true);
             } else {
@@ -902,7 +902,7 @@ class theme_config {
             }
         } else {
             $params = array('theme'=>$this->name, 'type'=>'editor');
-            $url = new moodle_url($CFG->wwwroot.'/theme/styles_debug.php', $params);
+            $url = new moodle_url('/theme/styles_debug.php', $params);
         }
         return $url;
     }
@@ -966,7 +966,7 @@ class theme_config {
 
         if ($rev > -1) {
             $filename = right_to_left() ? 'all-rtl' : 'all';
-            $url = new moodle_url("$CFG->wwwroot/theme/styles.php");
+            $url = new moodle_url("/theme/styles.php");
             $themesubrevision = theme_get_sub_revision_for_theme($this->name);
 
             // Provide the sub revision to allow us to invalidate cached theme CSS
@@ -1002,7 +1002,7 @@ class theme_config {
             $urls[] = $url;
 
         } else {
-            $baseurl = new moodle_url($CFG->wwwroot.'/theme/styles_debug.php');
+            $baseurl = new moodle_url('/theme/styles_debug.php');
 
             $css = $this->get_css_files(true);
             if (!$svg) {
@@ -1686,11 +1686,11 @@ class theme_config {
         }
 
         if (!empty($CFG->slasharguments) and $rev > 0) {
-            $url = new moodle_url("$CFG->wwwroot/theme/javascript.php");
+            $url = new moodle_url("/theme/javascript.php");
             $url->set_slashargument('/'.$this->name.'/'.$rev.'/'.$params['type'], 'noparam', true);
             return $url;
         } else {
-            return new moodle_url($CFG->wwwroot.'/theme/javascript.php', $params);
+            return new moodle_url('/theme/javascript.php', $params);
         }
     }
 
@@ -1922,7 +1922,7 @@ class theme_config {
 
         $params['image'] = $imagename;
 
-        $url = new moodle_url("$CFG->wwwroot/theme/image.php");
+        $url = new moodle_url("/theme/image.php");
         if (!empty($CFG->slasharguments) and $rev > 0) {
             $path = '/'.$params['theme'].'/'.$params['component'].'/'.$params['rev'].'/'.$params['image'];
             if (!$svg) {
@@ -1968,7 +1968,7 @@ class theme_config {
 
         $params['font'] = $font;
 
-        $url = new moodle_url("$CFG->wwwroot/theme/font.php");
+        $url = new moodle_url("/theme/font.php");
         if (!empty($CFG->slasharguments) and $rev > 0) {
             $path = '/'.$params['theme'].'/'.$params['component'].'/'.$params['rev'].'/'.$params['font'];
             $url->set_slashargument($path, 'noparam', true);
diff --git a/lib/outputrequirementslib.php b/lib/outputrequirementslib.php
index 030437344a2..de67b5186cf 100644
--- a/lib/outputrequirementslib.php
+++ b/lib/outputrequirementslib.php
@@ -551,7 +551,7 @@ class page_requirements_manager {
                 continue;
             }
             if (!empty($CFG->slasharguments)) {
-                $url = new moodle_url("$CFG->wwwroot/theme/jquery.php");
+                $url = new moodle_url("/theme/jquery.php");
                 $url->set_slashargument("/$component/$file");
 
             } else {
@@ -705,14 +705,14 @@ class page_requirements_manager {
             if (substr($url, -3) === '.js') {
                 $jsrev = $this->get_jsrev();
                 if (empty($CFG->slasharguments)) {
-                    return new moodle_url($CFG->wwwroot.'/lib/javascript.php', array('rev'=>$jsrev, 'jsfile'=>$url));
+                    return new moodle_url('/lib/javascript.php', array('rev'=>$jsrev, 'jsfile'=>$url));
                 } else {
-                    $returnurl = new moodle_url($CFG->wwwroot.'/lib/javascript.php');
+                    $returnurl = new moodle_url('/lib/javascript.php');
                     $returnurl->set_slashargument('/'.$jsrev.$url);
                     return $returnurl;
                 }
             } else {
-                return new moodle_url($CFG->wwwroot.$url);
+                return new moodle_url($url);
             }
         } else {
             throw new coding_exception('Invalid JS url, it has to be shortened url starting with / or moodle_url instance.', $url);
@@ -911,7 +911,7 @@ class page_requirements_manager {
         if ($stylesheet instanceof moodle_url) {
             // ok
         } else if (strpos($stylesheet, '/') === 0) {
-            $stylesheet = new moodle_url($CFG->wwwroot.$stylesheet);
+            $stylesheet = new moodle_url($stylesheet);
         } else {
             throw new coding_exception('Invalid stylesheet parameter.', $stylesheet);
         }
@@ -1315,9 +1315,9 @@ class page_requirements_manager {
         $output = '';
         $jsrev = $this->get_jsrev();
 
-        $jsloader = new moodle_url($CFG->wwwroot . '/lib/javascript.php');
+        $jsloader = new moodle_url('/lib/javascript.php');
         $jsloader->set_slashargument('/' . $jsrev . '/');
-        $requirejsloader = new moodle_url($CFG->wwwroot . '/lib/requirejs.php');
+        $requirejsloader = new moodle_url('/lib/requirejs.php');
         $requirejsloader->set_slashargument('/' . $jsrev . '/');
 
         $requirejsconfig = file_get_contents($CFG->dirroot . '/lib/requirejs/moodle-config.js');
diff --git a/login/index.php b/login/index.php
index 65365604898..9ab9abb7813 100644
--- a/login/index.php
+++ b/login/index.php
@@ -328,7 +328,7 @@ if (!empty($SESSION->loginerrormsg)) {
     if ($errormsg) {
         $SESSION->loginerrormsg = $errormsg;
     }
-    redirect(new moodle_url($CFG->wwwroot . '/login/index.php'));
+    redirect(new moodle_url('/login/index.php'));
 }
 
 $PAGE->set_title("$site->fullname: $loginsite");
@@ -339,7 +339,7 @@ echo $OUTPUT->header();
 if (isloggedin() and !isguestuser()) {
     // prevent logging when already logged in, we do not want them to relogin by accident because sesskey would be changed
     echo $OUTPUT->box_start();
-    $logout = new single_button(new moodle_url($CFG->wwwroot.'/login/logout.php', array('sesskey'=>sesskey(),'loginpage'=>1)), get_string('logout'), 'post');
+    $logout = new single_button(new moodle_url('/login/logout.php', array('sesskey'=>sesskey(),'loginpage'=>1)), get_string('logout'), 'post');
     $continue = new single_button(new moodle_url('/'), get_string('cancel'), 'get');
     echo $OUTPUT->confirm(get_string('alreadyloggedin', 'error', fullname($USER)), $logout, $continue);
     echo $OUTPUT->box_end();
diff --git a/login/signup.php b/login/signup.php
index 811bd87e44e..ee6a140c8c2 100644
--- a/login/signup.php
+++ b/login/signup.php
@@ -50,7 +50,7 @@ if (isloggedin() and !isguestuser()) {
     // Prevent signing up when already logged in.
     echo $OUTPUT->header();
     echo $OUTPUT->box_start();
-    $logout = new single_button(new moodle_url($CFG->wwwroot . '/login/logout.php',
+    $logout = new single_button(new moodle_url('/login/logout.php',
         array('sesskey' => sesskey(), 'loginpage' => 1)), get_string('logout'), 'post');
     $continue = new single_button(new moodle_url('/'), get_string('cancel'), 'get');
     echo $OUTPUT->confirm(get_string('cannotsignup', 'error', fullname($USER)), $logout, $continue);
diff --git a/repository/draftfiles_manager.php b/repository/draftfiles_manager.php
index 7a25e641ea4..29cfae24323 100644
--- a/repository/draftfiles_manager.php
+++ b/repository/draftfiles_manager.php
@@ -73,7 +73,7 @@ $fs = get_file_storage();
 
 $params = array('ctx_id' => $contextid, 'itemid' => $itemid, 'env' => $env, 'course'=>$courseid, 'maxbytes'=>$maxbytes, 'areamaxbytes'=>$areamaxbytes, 'maxfiles'=>$maxfiles, 'subdirs'=>$subdirs, 'sesskey'=>sesskey());
 $PAGE->set_url('/repository/draftfiles_manager.php', $params);
-$filepicker_url = new moodle_url($CFG->wwwroot."/repository/filepicker.php", $params);
+$filepicker_url = new moodle_url("/repository/filepicker.php", $params);
 
 $params['action'] = 'browse';
 $home_url = new moodle_url('/repository/draftfiles_manager.php', $params);
diff --git a/repository/dropbox/lib.php b/repository/dropbox/lib.php
index 8b8ff6f9a13..061e6cd9fd4 100644
--- a/repository/dropbox/lib.php
+++ b/repository/dropbox/lib.php
@@ -591,7 +591,7 @@ class repository_dropbox extends repository {
     public static function get_oauth2callbackurl() {
         global $CFG;
 
-        return new moodle_url($CFG->wwwroot . '/admin/oauth2callback.php');
+        return new moodle_url('/admin/oauth2callback.php');
     }
 
     /**
diff --git a/repository/filepicker.php b/repository/filepicker.php
index 0632a279874..112e653f4b8 100644
--- a/repository/filepicker.php
+++ b/repository/filepicker.php
@@ -101,7 +101,7 @@ $home_url = new moodle_url('/repository/draftfiles_manager.php', $params);
 
 $params['savepath'] = $savepath;
 $params['repo_id'] = $repo_id;
-$url = new moodle_url($CFG->wwwroot."/repository/filepicker.php", $params);
+$url = new moodle_url("/repository/filepicker.php", $params);
 $PAGE->set_url('/repository/filepicker.php', $params);
 
 switch ($action) {
@@ -212,7 +212,7 @@ case 'sign':
                 // TODO MDL-28482: need a better solution
                 // paging_bar is not a good option because it starts page numbering from 0 and
                 // repositories number pages starting from 1.
-                $pagingurl = new moodle_url("$CFG->wwwroot/repository/filepicker.php?action=list&itemid=$itemid&ctx_id=$contextid&repo_id=$repo_id&course=$courseid&sesskey=".  sesskey());
+                $pagingurl = new moodle_url("/repository/filepicker.php?action=list&itemid=$itemid&ctx_id=$contextid&repo_id=$repo_id&course=$courseid&sesskey=".  sesskey());
                 if (!isset($list['perpage']) && !isset($list['total'])) {
                     $list['perpage'] = 10; // instead of setting perpage&total we use number of pages, the result is the same
                 }
diff --git a/theme/styles_debug.php b/theme/styles_debug.php
index e52dd8213b1..0a61c9f2574 100644
--- a/theme/styles_debug.php
+++ b/theme/styles_debug.php
@@ -56,7 +56,7 @@ if ($type === 'editor') {
     css_send_uncached_css($csscontent);
 }
 
-$chunkurl = new moodle_url($CFG->wwwroot . '/theme/styles_debug.php', array('theme' => $themename,
+$chunkurl = new moodle_url('/theme/styles_debug.php', array('theme' => $themename,
     'type' => $type, 'subtype' => $subtype, 'sheet' => $sheet, 'usesvg' => $usesvg, 'rtl' => $rtl));
 
 // We need some kind of caching here because otherwise the page navigation becomes