[wp-trac] [WordPress Trac] #40112: Can't preview starter content "Home" menu item in subdirectory installation

[WordPress Trac]

#40112: Can't preview starter content "Home" menu item in subdirectory installation
--------------------------+-----------------------------
 Reporter:  dlh           |      Owner:
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  Customize     |    Version:  4.7.1
 Severity:  normal        |   Keywords:
  Focuses:                |
--------------------------+-----------------------------
 To replicate, install trunk into a subdirectory, preview Twenty Seventeen
 with its starter content, and attempt to navigate to the "Home" menu item.
 Instead of the preview, you get a "Cheatin'" error.

 As far as I can tell, the cause of this behavior starts with
 `get_option()` stripping trailing slashes from `home_url()`.

 `get_theme_starter_content()` calls `home_url()` as part of building its
 `'nav_menus'` array as of [39561]. When the home URL is a subdirectory,
 the resulting URL is always `example.com/wp` instead of `example.com/wp/`.

 Later, inside the Customize preview, the resulting URL of the "Home" menu
 item looks like:

 `http://example.com/wp?customize_changeset_uuid=1234`.

 Clicking the link leads to the error page because (and here I'm not quite
 certain) the user's authentication cookie isn't sent to the server with a
 request for `example.com/wp`. So, no user is logged in when the Customizer
 checks authentication -- first in `WP_Customize_Widgets::__construct()`,
 then in `WP_Customize_Manager::customize_preview_init()`.

 The problem doesn't occur when WordPress is in the root because appending
 the changeset ID in JS (via `element.search` in `prepareLinkPreview()`)
 automatically appends the trailing slash, at least in Chrome and Firefox.
 Before that, I think [25681] handled it.

 Assuming the above is correct, a relatively low-impact way to address the
 issue is to trailing-slash `home_url()` in `get_theme_starter_content()`,
 which the attached patch would do.

 However, any link to `example.com/wp` in the preview is affected, even
 before 4.7. The starter content only makes the issue more noticeable. So a
 more general fix in JS might also be worthwhile.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/40112>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform