Hitting Enter on the create/edit link dialogue can create dodgy links in some situations

[andfinally]

This ticket's about the correctURL method of the #wp-link dialogue, which prepends ​http:// to a URL if it's not been done once already, and if it doesn't start with http:, https:, ? # or /. When you enter a URL and hit the Enter key, the modal closes and the dialogue creates the link before the blur event on the URL input #wp-link-url can correct it.

To reproduce:
===========

• Select some text in the visual tab.
• Click insert/edit link button or Alt-Shift-A to open the link dialogue.
• Type 'www.tt.com' in the URL input.
• Press your Enter key to dismiss the dialogue.

Expected behaviour:
=================

• The link is created with href attribute set to ​http://www.tt.com.

What happens instead:
===================

• The link is created with href attribute www.tt.com.

Explanation
==========

The JS for the #wp-link dialogue (wplink.min.js) has a method called correctURL. This checks the URL entered in the #wp-link-input: if it doesn't start with a string ending in : (such as http:) or with ?, # or /, prepends ​http:// to it. This method is called when the user pastes into the URL input, or on blurs that input. So when you enter a dodgy URL in the input it is usually corrected.

In case anyone should really want to create a link with a dodgy URL, the JS saves the last URL corrected in the variable correctedURL. If the input's value matches the value of that variable, correctURL doesn't mess with it. This means that if you enter a dodgy URL twice it won't be corrected the second time.

In the case I'm describing, when you hit Enter the mceUpdate function is called and the link created in tinyMCE before the blur event on the URL input has the chance to call correctURL and prepend the ​http://.

This has resulted in authors inadvertently creating links like

<a href="www.DeconstructingVideoGames.com" sl-processed="1">Nick the Gent</a>

in their posts.

I'm able to reproduce this behaviour on the latest nightly build of WP 4.3, on the Twenty Fifteen theme, with all plugins off.

[andfinally]

Patch for correctURL issue on hitting Enter on wp-link dialogue

[andfinally]

I suggest the attached patch to deal with this case. I've made correctURL a method of wpLink, and I'm calling it inside mceUpdate. (As an alternative, it could be called by the inputs.submit.click handler.) It's good to keep the correction on paste or blur of the URL input so the user is alerted to the change that's being applied. If mcdUpdate calls correctURL on a URL that's already been corrected, the condition comparing the URL with correctedURL should stop the second execution of the function.

This method also maintains the behaviour allowing the user to enter a non-protocol address if he repeats the entry after it's corrected.

[JoTGi]

Hi there,
My first time testing a bug report. I've been able to reproduce the bug described by @andfinally with the process described above. I've applied the patch and it seems to be solving the error described. Tested with 4.3-alpha-32280-src.

[azaozz]

Reproduced too, lets fix this.

[azaozz]

In 32992:

wpLink: always attempt to correct the URL before getting the URL field value. Fixes an edge case where the URL was not corrected when the user submitted the form by pressing Enter.
Props andfinally. Fixes #32412.