Ticket #21949: 21949.wp-class.2.patch

wp-includes/class-wp.php

@@ -278 +278 @@
                                 }
                         }
                 }
-
+                
+                // Only get $queryable_taxonomies if needed
+                $queryable_taxonomies = null;
+                
                 // Convert urldecoded spaces back into +
-                foreach ( $GLOBALS['wp_taxonomies'] as $taxonomy => $t )
-                        if ( $t->query_var && isset( $this->query_vars[$t->query_var] ) )
+                foreach ( $GLOBALS['wp_taxonomies'] as $taxonomy => $t ) {
+                        if ( $t->query_var && isset( $this->query_vars[$t->query_var] ) ) {
                                 $this->query_vars[$t->query_var] = str_replace( ' ', '+', $this->query_vars[$t->query_var] );
-
+                        }
+                        
+                        // Limit publicly queried taxonomy to those that are public
+                        // for taxonomy query_vars
+                        if ( isset( $this->query_vars[$t->query_var] ) ) {
+                                // Only get $queryable_taxonomies if needed
+                                if ( null === $queryable_taxonomies )
+                                        $queryable_taxonomies = get_taxonomies( array( 'public' => true ) );
+                                $this->_limit_public( $t->query_var, $queryable_taxonomies );
+                        }
+                }
+                
+                // Limit publicly queried taxonomy to those that are public
+                // for query_var taxonomy
+                if ( isset( $this->query_vars['taxonomy'] ) ) {
+                        // Only get $queryable_taxonomies if needed
+                        if ( null === $queryable_taxonomies )
+                                $queryable_taxonomies = get_taxonomies( array( 'public' => true ) );
+                        $this->_limit_public( 'taxonomy', $queryable_taxonomies );
+                }
+                
                 // Limit publicly queried post_types to those that are publicly_queryable
                 if ( isset( $this->query_vars['post_type']) ) {
                         $queryable_post_types = get_post_types( array('publicly_queryable' => true) );
-                        if ( ! is_array( $this->query_vars['post_type'] ) ) {
-                                if ( ! in_array( $this->query_vars['post_type'], $queryable_post_types ) )
-                                        unset( $this->query_vars['post_type'] );
-                        } else {
-                                $this->query_vars['post_type'] = array_intersect( $this->query_vars['post_type'], $queryable_post_types );
-                        }
+                        $this->_limit_public( 'post_type', $queryable_post_types );
                 }
-
+                
                 foreach ( (array) $this->private_query_vars as $var) {
                         if ( isset($this->extra_query_vars[$var]) )
                                 $this->query_vars[$var] = $this->extra_query_vars[$var];
@@ -307 +325 @@
 
                 do_action_ref_array('parse_request', array(&$this));
         }
+        
+        /**
+         * Helper function to limit query_vars to those that are public.
+         *
+         * Removes non-public (taxonomy) and non-publicly_queryable (post_types) query_vars.
+         * Also, removes term if taxonomy is not public.
+         *
+         * @since 3.5.0
+         *
+         * @param string|array $qv Query var being tested, e.g., taxonomy, post_type, {taxonomy_name}.
+         * @param array $queryable_qvs Array of acceptable public query vars.
+         */
+        function _limit_public( $qv, $queryable_qvs ) {
+                if ( ! is_array( $this->query_vars[$qv] ) ) {
+                        if ( ! in_array( $this->query_vars[$qv], $queryable_qvs ) ) {
+                                unset( $this->query_vars[$qv] );
+                                if ( 'taxonomy' == $qv )
+                                        unset( $this->query_vars['term'] );
+                        }
+                } else {
+                        $this->query_vars[$qv] = array_intersect( $this->query_vars[$qv], $queryable_qvs );
+                }
+        }
 
         /**
          * Send additional HTTP headers for caching, content type, etc.