Customize: Custom Link URL validation for nav menu items doesn't allow jump links

[ravipatel]

Twenty Seventeen Menu Customization Link validation Need to allowed with # same like menu management.

[westonruter]

Good catch. This issue was introduced in #32816 via [41697]. We need to allow any URL that begins with #.

[westonruter]

Please test 42506.diff​.

[johnbillion]

This is also blocking URLs that contain domains without periods, for example http://localhost.

[westonruter]

Clearly the regular expression we incorporated was not robust enough, while also being overly complicated. In 42506.2.diff​ I've replaced it with a much simpler set of checks to confirm it roughly looks like a URL. Any further validation will then be handled on the server by WP_Customize_Nav_Menu_Item_Setting::sanitize() and esc_url_raw().

[westonruter]

@ravipatel Would you test 42506.2.diff​?

[SergeyBiryukov]

Tested 42506.2.diff​, works as expected.

[SergeyBiryukov]

@westonruter The new regex allows http:// though, which was previously disallowed. I guess it should still be disallowed.

[westonruter]

@SergeyBiryukov good catch. 42506.3.diff​ fixes that issue, and also prevents https:// from being allowed.

[SergeyBiryukov]

42506.3.diff​ looks good to me.

[westonruter]

In 42153:

Customize: Restore ability to add Custom Link nav menu items for jump links and other URLs that were previously allowed.

Simplify regular expression for checking URL validity to just do basic checks to confirm the value looks like a URL. Leave the complete validation to the server-side logic in WP_Customize_Nav_Menu_Item_Setting::sanitize() to avoid having to maintain two separate codebases for validating URLs.

Props westonruter, SergeyBiryukov for testing.
Amends [41697].
See #32816.
Fixes #42506 for trunk.

[westonruter]

In 42154:

Customize: Restore ability to add Custom Link nav menu items for jump links and other URLs that were previously allowed.

Simplify regular expression for checking URL validity to just do basic checks to confirm the value looks like a URL. Leave the complete validation to the server-side logic in WP_Customize_Nav_Menu_Item_Setting::sanitize() to avoid having to maintain two separate codebases for validating URLs.

Props westonruter, SergeyBiryukov for testing.
Amends [41697].
See #32816.
Fixes #42506 for 4.9.