Ticket #13509: 13509.diff

wp-includes/query.php

@@ -2521 +2521 @@
                         if ( is_user_logged_in() ) {
                                 // Add private states that are limited to viewing by the author of a post or someone who has caps to read private states.
                                 $private_states = get_post_stati( array('private' => true) );
-                                foreach ( (array) $private_states as $state )
-                                        $where .= current_user_can( $read_private_cap ) ? " OR $wpdb->posts.post_status = '$state'" : " OR $wpdb->posts.post_author = $user_ID AND $wpdb->posts.post_status = '$state'";
+                                $readable_post_types = array();
+                                
+                                foreach ( get_post_types( array( 'exclude_from_search' => false ) ) as $pt ) {
+                                        // get the post type object
+                                        $pt_object = get_post_type_object($pt);
+                                        // checks if the user can read private posts fo this post type
+                                        if ( $pt_object && current_user_can($pt_object->cap->read_private_posts))
+                                                $readable_post_types[] =  $pt;
+                                }
+                                if ($readable_post_types) {
+                                        $where .= " OR ($wpdb->posts.post_status = 'private' AND post_type IN ('" . implode("','", $readable_post_types) . "') )";
+                                } else {
+                                        foreach ( (array) $private_states as $state ) 
+                                                $where .= $wpdb->prepare(" OR $wpdb->posts.post_author = %d AND $wpdb->posts.post_status = %s", $user_ID, $state);
+                                }
+                                
                         }
 
                         $where .= ')';