[wp-trac] [WordPress Trac] #32412: Hitting Enter on the create/edit link dialogue can create dodgy links in some situations

[WordPress Trac]

#32412: Hitting Enter on the create/edit link dialogue can create dodgy links in
some situations
--------------------------------------------+-----------------------------
 Reporter:  andfinally                      |      Owner:
     Type:  defect (bug)                    |     Status:  new
 Priority:  normal                          |  Milestone:  Awaiting Review
Component:  Editor                          |    Version:  trunk
 Severity:  normal                          |   Keywords:
  Focuses:  ui, javascript, administration  |
--------------------------------------------+-----------------------------
 This ticket's about the correctURL method of the #wp-link dialogue, which
 prepends http:// to a URL if it's not been done once already, and if it
 doesn't start with http:, https:, ? # or /. When you enter a URL and hit
 the Enter key, the modal closes and the dialogue creates the link before
 the blur event on the URL input #wp-link-url can correct it.

 To reproduce:
 ===========

 - Select some text in the visual tab.
 - Click insert/edit link button or Alt-Shift-A to open the link dialogue.
 - Type 'www.tt.com' in the URL input.
 - Press your Enter key to dismiss the dialogue.

 Expected behaviour:
 =================

 - The link is created with href attribute set to http://www.tt.com.

 What happens instead:
 ===================

 - The link is created with href attribute www.tt.com.

 Explanation
 ==========

 The JS for the #wp-link dialogue (wplink.min.js) has a method called
 correctURL. This checks the URL entered in the #wp-link-input: if it
 doesn't start with a string ending in : (such as http:) or with ?, # or /,
 prepends http:// to it. This method is called when the user pastes into
 the URL input, or on blurs that input. So when you enter a dodgy URL in
 the input it is usually corrected.

 In case anyone should really want to create a link with a dodgy URL, the
 JS saves the last URL corrected in the variable correctedURL. If the
 input's value matches the value of that variable, correctURL doesn't mess
 with it. This means that if you enter a dodgy URL twice it won't be
 corrected the second time.

 In the case I'm describing, when you hit Enter the mceUpdate function is
 called and the link created in tinyMCE before the blur event on the URL
 input has the chance to call correctURL and prepend the http://.

 This has resulted in authors inadvertently creating links like

 <a href="www.DeconstructingVideoGames.com" sl-processed="1">Nick the
 Gent</a>

 in their posts.

 I'm able to reproduce this behaviour on the latest nightly build of WP
 4.3, on the Twenty Fifteen theme, with all plugins off.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/32412>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform