Customizer load wrong page for customizing the "Page".

[okvee]

Tested with WordPress 6.6-alpha-58225
All plugins are disabled/deactivated.
Themes that have this problem: all classic themes that support customizer such as Twenty Twenty, Twenty Twenty-One.

Step to reproduce:

1. Create new page with unicode language for example หน้าภาษาไทย. Enter any content language.
2. Publish and view the page.
3. Click on customize.
4. The customizer load home page instead of selected page (หน้าภาษาไทย). Some WordPress installation, they are showing 404 error page.

This is working correctly on version 6.5.3 but not with 6.6x

[yahaly]

Reproduction Report

This report validates that the issue can be reproduced.

Environment

• Server: Apache/2.4.58 (Win64)
• PHP: 8.2.12 (Supports 64bit values)
• WordPress: 6.6-beta2-58392-src
• Browser: Chrome 99.0.4844.84
• OS: Windows 10 Pro
• Theme: Twenty Twenty, Twenty Twenty-One
• Plugins: None activated

Actual Results

• ✅ Error condition occurs (reproduced).

Additional Notes

• Any additional details worth mention.

Steps to Reproduce

1. Choose Twenty Twenty theme.
2. Create new page with unicode language for example หน้าภาษาไทย. Enter content หน้าภาษาไทย.
3. Publish and view the page.
4. Click on customize.
5. 🐞 Bug occurs. The customizer load home page instead of selected page (หน้าภาษาไทย).

Expected Results

When testing a patch to validate it works as expected:

• ✅ Customizer opening on หน้าภาษาไทย page.

When reproducing a bug:

• ❌ Customizer opening on main page.

Supplemental Artifacts

Twenty Twenty: Video(https://www.loom.com/share/76165b8c96d24034a2c3ac61462dcffe)?
Twenty Twenty-One: Video(https://www.loom.com/share/013b58d484dc46e7977117b20cff3920)?

[hellofromTonya]

Hello @okvee,

Welcome to WordPress Core's Trac.

I too am able to reproduce this issue on 6.6.0, 6.6.2, and 6.7 Beta 1. Also confirmed it worked on 6.5.5, indicating the bug was introduced during the 6.6.0 cycle.

Moving it into 6.6.3 and adding keywords to denote current status.

Replaced sanitize_text_field() with esc_url_raw() for sanitizing URLs passed via $_REQUEST['url']. This change fixes an issue where the URL example.com/หน้าภาษาไทย would incorrectly return example.com// due to improper sanitization when clicking on the Customize button through the admin bar.

This ensures that URLs containing non-Latin characters are correctly preserved and prevents unexpected behavior in the customizer.

Happy to hear feedback on this approach or if there's a better way to handle this scenario! Let me know if this change introduces any concerns.

Yes, it's working properly.

[amin7]

Test Report

Patch tested: ​https://patch-diff.githubusercontent.com/raw/WordPress/wordpress-develop/pull/7512.diff

Environment

WordPress: 6.7-beta3
PHP: 8.1.23
Database: MySQL 8.0.16
Browser: Chrome 129.0.0.0
OS: Windows 11
Theme: Twenty Twenty 2.7
MU Plugins: None activated

---

Before patch

Check the screencast: ​https://d.pr/v/FK8lGl

---

After patch
Check the screencast ​https://d.pr/v/2uUJ48

---

Results
✅ Issue is resolved with the patch.

[desrosj]

Introduced in [58069] as part of #38073.

[johnbillion]

cc @swissspidy

[swissspidy]

Might need esc_url_raw for the return URL as well, but haven't tested it.

[desrosj]

Since 6.7 RC1 is due out any moment and there are no plans to ship a 6.6.3, I'm going to punt this so it can be properly considered.

[desrosj]

Because of a few bug reports opened since 6.7 was released, the Core team is evaluating the need for a short 6.7.1 cycle (possibly next week).

To help prepare for this scenario in case it's decided to move forward, I'm going to punt this to the 6.7.2 milestone. This issue was not introduced in 6.7, so it now falls outside of the focus for 6.7.1 as currently defined.

[jorbin]

Based on @hellofromTonya's comment, I think this is not a candidate for 6.7.2

I committed the change proposed by @swissspidy as it fixes the same issue which was occurring when we try to return back to the front-end page.

[audrasjb]

Self assigning for commit.

[audrasjb]

In 59945:

Customize: Properly escape URLs passed by url and return parameters.

This changeset replaces sanitize_text_field() with esc_url_raw() for URLs passed via url and return query vars. This fixes an issue where the URL example.com/หน้าภาษาไทย would incorrectly return example.com// due to improper sanitization when clicking on the Customize button through the admin bar.

Props okvee, yahaly, hellofromTonya, veryard, dilip2615, amin7, swissspidy, audrasjb.
Fixes #61317.