Ticket #33306: only query logged in users if member of site.2.diff

wp-includes/query.php

@@ -3046 +3046 @@
                        if ( is_user_logged_in() ) {
                                // Add private states that are limited to viewing by the author of a post or someone who has caps to read private states.
                                $private_states = get_post_stati( array('private' => true) );
-                               foreach ( (array) $private_states as $state )
-                                       $where .= current_user_can( $read_private_cap ) ? " OR $wpdb->posts.post_status = '$state'" : " OR $wpdb->posts.post_author = $user_id AND $wpdb->posts.post_status = '$state'";
+                                foreach ( (array) $private_states as $state ) {
+                                        if ( current_user_can( $read_private_cap ) ) {
+                                                $where .= " OR $wpdb->posts.post_status = '$state'";
+                                        } else if ( ! is_multisite() || ( is_multisite() && is_user_member_of_blog() ) ) {
+                                                $where .= " OR $wpdb->posts.post_author = $user_id AND $wpdb->posts.post_status = '$state'";
+                                        }
+                                }
                        }
 
                        $where .= ')';