Ticket #21949: 21949.wp-class.3.patch

wp-includes/class-wp.php

@@ -278 +278 @@
                                 }
                         }
                 }
+                
+                // Only get $queryable_taxonomies if needed
+                $queryable_taxonomies = null;
 
                 // Convert urldecoded spaces back into +
-                foreach ( $GLOBALS['wp_taxonomies'] as $taxonomy => $t )
-                        if ( $t->query_var && isset( $this->query_vars[$t->query_var] ) )
+                foreach ( $GLOBALS['wp_taxonomies'] as $taxonomy => $t ) {
+                        if ( $t->query_var && isset( $this->query_vars[$t->query_var] ) ) {
                                 $this->query_vars[$t->query_var] = str_replace( ' ', '+', $this->query_vars[$t->query_var] );
+                        }
+                        
+                        // Limit publicly queried taxonomy to those that are public
+                        // for taxonomy query_vars
+                        if ( isset( $this->query_vars[$t->query_var] ) ) {
+                                // Only get $queryable_taxonomies if needed
+                                if ( null === $queryable_taxonomies )
+                                        $queryable_taxonomies = get_taxonomies( array( 'public' => true ) );
+                                
+                                if ( ! is_array( $this->query_vars[$t->query_var] ) ) {
+                                        if ( ! in_array( $this->query_vars[$t->query_var], $queryable_taxonomies ) ) {
+                                                unset( $this->query_vars[$t->query_var] );
+                                        }
+                                } else {
+                                        $this->query_vars[$t->query_var] = array_intersect( $this->query_vars[$t->query_var], $queryable_taxonomies );
+                                }
+                        }
+                }
+                
+                // Limit publicly queried taxonomy to those that are public
+                // for query_var taxonomy
+                if ( isset( $this->query_vars['taxonomy'] ) ) {
+                        // Only get $queryable_taxonomies if needed
+                        if ( null === $queryable_taxonomies )
+                                $queryable_taxonomies = get_taxonomies( array( 'public' => true ) );
+                        
+                        if ( ! is_array( $this->query_vars['taxonomy'] ) ) {
+                                if ( ! in_array( $this->query_vars['taxonomy'], $queryable_taxonomies ) ) {
+                                        unset( $this->query_vars['taxonomy'] );
+                                        unset( $this->query_vars['term'] );
+                                }
+                        } else {
+                                $this->query_vars['taxonomy'] = array_intersect( $this->query_vars['taxonomy'], $queryable_taxonomies );
+                        }
+                }
 
                 // Limit publicly queried post_types to those that are publicly_queryable
                 if ( isset( $this->query_vars['post_type']) ) {