Tabs: Support URL-based credentials

When credentials are provided directly in the URL, e.g.:

    https://username:password@www.example.com/

`location.href` strips out the auth part, but anchor links contain them, making
our `isLocal` computation broken. This fixes it by only looking at `origin`,
`pathname` & `search`.

Fixes gh-2213
Closes gh-2345

1 files changed, 13 insertions, 20 deletions

diff --git a/ui/widgets/tabs.js b/ui/widgets/tabs.js
index 49468feb3..0a8efd3ca 100644
--- a/ui/widgets/tabs.js
+++ b/ui/widgets/tabs.js
@@ -61,26 +61,19 @@ $.widget( "ui.tabs", {
 		load: null
 	},
 
-	_isLocal: ( function() {
-		var rhash = /#.*$/;
-
-		return function( anchor ) {
-			var anchorUrl, locationUrl;
-
-			anchorUrl = anchor.href.replace( rhash, "" );
-			locationUrl = location.href.replace( rhash, "" );
-
-			// Decoding may throw an error if the URL isn't UTF-8 (#9518)
-			try {
-				anchorUrl = decodeURIComponent( anchorUrl );
-			} catch ( _error ) {}
-			try {
-				locationUrl = decodeURIComponent( locationUrl );
-			} catch ( _error ) {}
-
-			return anchor.hash.length > 1 && anchorUrl === locationUrl;
-		};
-	} )(),
+	_isLocal: function( anchor ) {
+		var anchorUrl = new URL( anchor.href ),
+			locationUrl = new URL( location.href );
+
+		return anchor.hash.length > 1 &&
+
+			// `href` may contain a hash but also username & password;
+			// we want to ignore them, so we check the three fields
+			// below instead.
+			anchorUrl.origin === locationUrl.origin &&
+			anchorUrl.pathname === locationUrl.pathname &&
+			anchorUrl.search === locationUrl.search;
+	},
 
 	_create: function() {
 		var that = this,