From 2bf5c6af20d468e73c3ff3da059f50a87d869c00 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rabbi=20Islam=20Rony=20=E2=9A=A1=EF=B8=8F?=
 <35329385+RabbiIslamRony@users.noreply.github.com>
Date: Wed, 29 Jul 2026 00:09:25 +0600
Subject: [PATCH] fix: accept listing URLs without explicit schemes

Normalize submitted URL values to HTTP or HTTPS before validation so entries such as www.example.com pass without requiring a DNS lookup.

Validate URL syntax locally and reject embedded user credentials to prevent deceptive links while continuing to block unsupported protocols.
---
 includes/fields/class-directorist-url-field.php | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/includes/fields/class-directorist-url-field.php b/includes/fields/class-directorist-url-field.php
index 4cc846082e..99d1acc30a 100644
--- a/includes/fields/class-directorist-url-field.php
+++ b/includes/fields/class-directorist-url-field.php
@@ -13,9 +13,15 @@ class Url_Field extends Base_Field {
     public $type = 'url';
 
     public function validate( $posted_data ) {
-        $value = $this->sanitize( $posted_data );
-
-        if ( ! wp_http_validate_url( $value ) ) {
+        $value      = $this->sanitize( $posted_data );
+        $parsed_url = wp_parse_url( $value );
+
+        if (
+            ! filter_var( $value, FILTER_VALIDATE_URL ) ||
+            false === $parsed_url ||
+            isset( $parsed_url['user'] ) ||
+            isset( $parsed_url['pass'] )
+        ) {
             $this->add_error( __( 'Invalid URL.', 'directorist' ) );
 
             return false;
@@ -30,7 +36,7 @@ public function sanitize( $posted_data ) {
             return $value;
         }
 
-        return esc_url_raw( $value );
+        return esc_url_raw( $value, [ 'http', 'https' ] );
     }
 }