[wp-trac] [WordPress Trac] #35267: menu-item-object class allows CPTs/Taxonomies to use "custom" slug

[WordPress Trac]

#35267: menu-item-object class allows CPTs/Taxonomies to use "custom" slug
-----------------------------------------+------------------------------
 Reporter:  RachieVee                    |       Owner:
     Type:  defect (bug)                 |      Status:  new
 Priority:  normal                       |   Milestone:  Awaiting Review
Component:  Menus                        |     Version:  4.4
 Severity:  normal                       |  Resolution:
 Keywords:  has-screenshots 2nd-opinion  |     Focuses:
-----------------------------------------+------------------------------
Changes (by morganestes):

 * keywords:  has-screenshots => has-screenshots 2nd-opinion


Comment:

 After some research and discussion, it seems that 'custom' is used
 throughout the codebase to mostly refer to menu items (with the exception
 of its use in media-template.php and in permalinks). It's the default for
 'menu-item-type' in `wp_update_nav_menu_item()`, the type registered for
 the "Home" link in `load_available_items_query()`, and is the default for
 menu items in the Customizer. Allowing post types, terms, meta, etc. to
 register and use 'custom' as the name may cause collisions with these
 other objects when creating menus.

 I suggest either 1) changing the string from 'custom' to 'custom-link' to
 make it clearer what its purpose is inside the menu, and/or 2)
 blacklisting 'custom' from being registered for posts or terms.

 If we go the blacklist route, it looks like we'd have to add checks inside
 each of
 `register_(post_type|post_status|meta|taxonomy|taxonomy_for_object_type)`
 to prevent registration, since no blacklist appears to be in place yet.
 Another alternative would be to silently register 'custom' using
 `$_builtin` but do nothing with it, but that seems a bit hacky to me.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/35267#comment:2>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform