Ticket #30354: 30354_with_tests.patch

src/wp-includes/post.php

@@ -5249 +5249 @@
 function get_posts_by_author_sql( $post_type, $full = true, $post_author = null, $public_only = false ) {
         global $wpdb;
 
-        // Private posts.
+        // Private posts or not a post type.
         $post_type_obj = get_post_type_object( $post_type );
-        if ( ! $post_type_obj )
+        if ( ! $post_type_obj ){
                 return $full ? 'WHERE 1 = 0' : ' 1 = 0 ';
+        }
 
+        // product the $post_author id
+        if( null !== $post_author ){
+                $post_author = ( 0 === absint( $post_author ) ) ? null : absint( $post_author );
+        }
+
         /**
          * Filter the capability to read private posts for a custom post type
          * when generating SQL for getting posts by author.
@@ -5267 +5273 @@
                 $cap = $post_type_obj->cap->read_private_posts;
         }
 
+        $sql = ' ';
         if ( $full ) {
-                if ( null === $post_author ) {
-                        $sql = $wpdb->prepare( 'WHERE post_type = %s AND ', $post_type );
-                } else {
-                        $sql = $wpdb->prepare( 'WHERE post_author = %d AND post_type = %s AND ', $post_author, $post_type );
-                }
+                $sql = 'WHERE ';
+        }
+
+        if ( null === $post_author ) {
+                        $sql .= $wpdb->prepare( 'post_type = %s AND ', $post_type );
         } else {
-                $sql = '';
+                        $sql .= $wpdb->prepare( 'post_author = %d AND post_type = %s AND ', $post_author, $post_type );
         }
 
+
         $sql .= "(post_status = 'publish'";
 
         // Only need to check the cap if $public_only is false.

tests/phpunit/tests/post/get-posts-by-author-sql.php

@@ +1 @@
+<?php
+
+/**
+ * @group post
+ * @ticket 30354
+ */
+
+class Tests_get_posts_by_author_sql extends WP_UnitTestCase {
+        function setUp() {
+                parent::setUp();
+        }
+
+        // default call get SQL where for posts
+        function test_just_post(){
+                $maybe_string = get_posts_by_author_sql( 'post' );
+
+                $this->assertEquals( "WHERE post_type = 'post' AND (post_status = 'publish')", $maybe_string );
+
+        }
+        // page post type
+        function test_just_page(){
+                $maybe_string = get_posts_by_author_sql( 'page' );
+
+                $this->assertEquals( "WHERE post_type = 'page' AND (post_status = 'publish')", $maybe_string );
+
+        }
+
+        // default call get SQL where for posts and set full to true
+        function test_just_post_true(){
+                $maybe_string = get_posts_by_author_sql( 'post', true );
+
+                $this->assertEquals( "WHERE post_type = 'post' AND (post_status = 'publish')", $maybe_string );
+
+        }
+
+        // Test nonexistant post type.
+        function test_just_non_existent_post_type(){
+                $maybe_string = get_posts_by_author_sql( 'non_existent_post_type' );
+
+                $this->assertEquals( "WHERE 1 = 0", $maybe_string );
+        }
+        // Test nonexistant post type and not full SQL.
+        function test_just_non_existent_post_type_false(){
+                $maybe_string = get_posts_by_author_sql(  'non_existent_post_type', false );
+
+                $this->assertEquals( " 1 = 0 ", $maybe_string );
+
+        }
+        // post and not full where SQL
+        function test_post_false(){
+                $maybe_string = get_posts_by_author_sql( 'post', false );
+
+                $this->assertEquals( " post_type = 'post' AND (post_status = 'publish')", $maybe_string );
+        }
+
+        // posts and full where for user 1
+        function test_post_true_1(){
+                $maybe_string = get_posts_by_author_sql( 'post', true, 1  );
+
+                $this->assertEquals( "WHERE post_author = 1 AND post_type = 'post' AND (post_status = 'publish')", $maybe_string );
+        }
+
+        // posts and not full where for user 1
+        function test_post_false_1(){
+                $maybe_string = get_posts_by_author_sql( 'post', false, 1 );
+
+                $this->assertEquals( " post_author = 1 AND post_type = 'post' AND (post_status = 'publish')", $maybe_string );
+        }
+
+        // posts and full where for user 1 and public
+        function test_post_true_1_true(){
+                $maybe_string = get_posts_by_author_sql( 'post', true, 1, true  );
+
+                $this->assertEquals( "WHERE post_author = 1 AND post_type = 'post' AND (post_status = 'publish')", $maybe_string );
+        }
+        // posts and not full where for user 1 and public
+        function test_post_false_1_true(){
+                $maybe_string = get_posts_by_author_sql( 'post', false, 1, true );
+
+                $this->assertEquals( " post_author = 1 AND post_type = 'post' AND (post_status = 'publish')", $maybe_string );
+        }
+
+        // posts and full where for user 1 and not public
+        function test_post_true_1_false(){
+                $maybe_string = get_posts_by_author_sql( 'post', true, 1, false  );
+
+                $this->assertEquals( "WHERE post_author = 1 AND post_type = 'post' AND (post_status = 'publish')", $maybe_string );
+        }
+
+        // posts and not full where for user 1 and  not public
+        function test_post_false_1_false(){
+                $maybe_string = get_posts_by_author_sql( 'post', false, 1, false );
+
+                $this->assertEquals( " post_author = 1 AND post_type = 'post' AND (post_status = 'publish')", $maybe_string );
+        }
+
+        // posts and not full where for user 1 and  not public
+        function test_post_false_1_false_author(){
+                // Someone who can't view private posts should be limited by ID.
+                $author = $this->factory->user->create( array( 'role' => 'author' ) );
+                wp_set_current_user( $author );
+
+                $maybe_string = get_posts_by_author_sql( 'post', false, null, false );
+
+                $this->assertEquals( " post_type = 'post' AND (post_status = 'publish' OR post_status = 'private' AND post_author = $author)", $maybe_string );
+                wp_set_current_user( 0 );
+        }
+
+        // posts and not full where for user 1 and  not public
+        function test_post_true_1_false_author(){
+                // Someone who can't view private posts should be limited by ID.
+                $author = $this->factory->user->create( array( 'role' => 'author' ) );
+                wp_set_current_user( $author );
+
+                $maybe_string = get_posts_by_author_sql( 'post', true, null, false );
+
+                $this->assertEquals( "WHERE post_type = 'post' AND (post_status = 'publish' OR post_status = 'private' AND post_author = $author)", $maybe_string );
+                wp_set_current_user( 0 );
+        }
+
+        // posts and not full where for user 1 and  not public
+        function test_post_true_1_false_subscriber(){
+                // Someone who can't view private posts should be limited by ID.
+                $author = $this->factory->user->create( array( 'role' => 'subscriber' ) );
+                wp_set_current_user( $author );
+
+                $maybe_string = get_posts_by_author_sql( 'post', true, null, false );
+
+                $this->assertEquals( "WHERE post_type = 'post' AND (post_status = 'publish' OR post_status = 'private' AND post_author = $author)", $maybe_string );
+                wp_set_current_user( 0 );
+        }
+
+        // posts and not full where for user 1 and  not public
+        function test_post_true_1_true_subscriber(){
+                // Someone who can't view private posts should be limited by ID.
+                $author = $this->factory->user->create( array( 'role' => 'subscriber' ) );
+                wp_set_current_user( $author );
+
+                $maybe_string = get_posts_by_author_sql( 'post', true, null, true );
+
+                $this->assertEquals( "WHERE post_type = 'post' AND (post_status = 'publish')", $maybe_string );
+                wp_set_current_user( 0 );
+        }
+
+}