Customizer links should use canonical admin URL

[helen]

Now that we're removing some query args for notices (#23367), we need to ensure those aren't kept by the customizer return arg, lest users wonder why closing out of the customizer greets them with a message like "1 post moved to Trash".

[johnbillion]

Maybe the list of removable query args in wp_admin_canonical_url() does need to be in its own function.

[helen]

I think we probably need a true canonical admin URL, see #31603.

[westonruter]

#32280 was marked as a duplicate.

[westonruter]

Issue #32280 is regarding the behavior of clicking the Customize link just after having downloaded a plugin. Those query params need to be stripped as well from the return URL.

[dlh]

Missed one.

[dlh]

31850.2.diff​ would remove the wp_removable_query_args() from the locations I could find where the Customize return parameter was derived from $_SERVER['REQUEST_URI'].

[westonruter]

@dlh to confirm, in practice a user will now never encounter the problem that this ticket originally describes because the WP_Customize_Manager::set_return_url() method does remove_query_arg( wp_removable_query_args(), $return_url ) itself. So the only benefit of 31850.2.diff​ is that it removes the removable query params from the return query param as it appears in the URL? As such, it would purely be a technical-cosmetic change?

[dlh]

@westonruter As far as I can tell, yes, your description is accurate.

[swissspidy]

remove_query_arg( wp_removable_query_args(), $url ) is also used by WP_Customize_Manager::set_return_url() and two other places in core. Would a new remove_removable_query_args() function make sense to make this more DRY?

[westonruter]

@swissspidy I think the cost of adding yet another global function outweighs the benefits of DRY in this case, since the duplicated code is almost inconsequential.

[westonruter]

Refresh patch

[westonruter]

In 40313:

Customize: Prevent links to customize.php from being generated which have query vars from wp_removable_query_args() present.

Props dlh.
See #23367, #32692.
Fixes #31850.

[westonruter]

Re-opening for consideration in 4.7.4

[swissspidy]

In 40331:

Customize: Prevent links to customize.php from being generated which have query vars from wp_removable_query_args() present.

Props dlh.
See #23367, #32692.
Fixes #31850.

Merges [40313] to the 4.7 branch.