Ticket #21949: 21949.2.diff

src/wp-includes/class-wp.php

@@ -298 +298 @@
                         if ( $t->query_var && isset( $this->query_vars[$t->query_var] ) )
                                 $this->query_vars[$t->query_var] = str_replace( ' ', '+', $this->query_vars[$t->query_var] );
 
+                // Don't allow non-public taxonomies to be queried.
+                foreach ( get_taxonomies( array( 'public' => false ), 'objects' ) as $taxonomy => $t ) {
+                        // Check first for taxonomy-specific query_var.
+                        if ( $t->query_var && isset( $this->query_vars[ $t->query_var ] ) ) {
+                                unset( $this->query_vars[ $t->query_var ] );
+                        }
+
+                        // Next, check the 'taxonomy' query_var.
+                        if ( isset( $this->query_vars['taxonomy'] ) && $taxonomy === $this->query_vars['taxonomy'] ) {
+                                unset( $this->query_vars['taxonomy'], $this->query_vars['term'] );
+                        }
+                }
+
                 // Limit publicly queried post_types to those that are publicly_queryable
                 if ( isset( $this->query_vars['post_type']) ) {
                         $queryable_post_types = get_post_types( array('publicly_queryable' => true) );

tests/phpunit/tests/taxonomy.php

@@ -442 +442 @@
                 $this->assertEqualSets( array( $t1 ), get_ancestors( $t2, 'wptests_conflict' ) );
                 _unregister_post_type( 'wptests_pt' );
         }
+
+        /**
+         * @ticket 21949
+         */
+        public function test_nonpublic_taxonomy_should_not_be_queryable_using_taxname_query_var() {
+                register_taxonomy( 'wptests_tax', 'post', array(
+                        'public' => false,
+                ) );
+
+                $t = $this->factory->term->create_and_get( array(
+                        'taxonomy' => 'wptests_tax',
+                ) );
+
+                $p = $this->factory->post->create();
+                wp_set_object_terms( $p, $t->slug, 'wptests_tax' );
+
+                $this->go_to( '/?wptests_tax=' . $t->slug );
+
+                $this->assertFalse( is_tax( 'wptests_tax' ) );
+        }
+
+        /**
+         * @ticket 21949
+         */
+        public function test_nonpublic_taxonomy_should_not_be_queryable_using_taxonomy_and_term_vars() {
+                register_taxonomy( 'wptests_tax', 'post', array(
+                        'public' => false,
+                ) );
+
+                $t = $this->factory->term->create_and_get( array(
+                        'taxonomy' => 'wptests_tax',
+                ) );
+
+                $p = $this->factory->post->create();
+                wp_set_object_terms( $p, $t->slug, 'wptests_tax' );
+
+                $this->go_to( '/?taxonomy=wptests_tax&term=' . $t->slug );
+
+                $this->assertFalse( is_tax( 'wptests_tax' ) );
+        }
 }