Customize: Initialize matchedAllowedPath to empty string to avoid ternary guard.

See #65030.

Author: abhi3315

src/js/_enqueues/wp/customize/controls.js

@@ -6574,7 +6574,7 @@
 			 */
 
 			previewer.add( 'previewUrl', params.previewUrl ).setter( function( to ) {
-				var result = null, urlParser, queryParams, parsedAllowedUrl, matchedAllowedPath, parsedCandidateUrls = [];
+				var result = null, urlParser, queryParams, parsedAllowedUrl, matchedAllowedPath = '', parsedCandidateUrls = [];
 				urlParser = document.createElement( 'a' );
 				urlParser.href = to;
 
@@ -6616,7 +6616,7 @@
 				} );
 
 				// Disallow links to admin, includes, and content, unless the matching allowed URL itself contains such a path.
-				if ( result && /\/wp-(admin|includes|content)(\/|$)/.test( urlParser.pathname.substring( matchedAllowedPath ? matchedAllowedPath.length : 0 ) ) ) {
+				if ( result && /\/wp-(admin|includes|content)(\/|$)/.test( urlParser.pathname.substring( matchedAllowedPath.length ) ) ) {
 					return null;
 				}
 

src/js/_enqueues/wp/customize/preview.js

@@ -281,7 +281,7 @@
 	 * @return {boolean} Is appropriate for changeset link.
 	 */
 	api.isLinkPreviewable = function isLinkPreviewable( element, options ) {
-		var matchesAllowedUrl, matchedAllowedPath, parsedAllowedUrl, args, elementHost;
+		var matchesAllowedUrl, matchedAllowedPath = '', parsedAllowedUrl, args, elementHost;
 
 		args = _.extend( {}, { allowAdminAjax: false }, options || {} );
 
@@ -318,7 +318,7 @@
 		}
 
 		// Disallow links to admin, includes, and content, unless the matching allowed URL itself contains such a path.
-		if ( /\/wp-(admin|includes|content)(\/|$)/.test( element.pathname.substring( matchedAllowedPath ? matchedAllowedPath.length : 0 ) ) ) {
+		if ( /\/wp-(admin|includes|content)(\/|$)/.test( element.pathname.substring( matchedAllowedPath.length ) ) ) {
 			return false;
 		}