Ticket #48556: 48556.diff

src/wp-includes/class-wp-query.php

@@ -2396 +2396 @@
                 if ( 'any' == $post_type ) {
                         $in_search_post_types = get_post_types( array( 'exclude_from_search' => false ) );
                         if ( empty( $in_search_post_types ) ) {
-                                $where .= ' AND 1=0 ';
+                                $post_type_where = ' AND 1=0 ';
                         } else {
-                                $where .= " AND {$wpdb->posts}.post_type IN ('" . join( "', '", array_map( 'esc_sql', $in_search_post_types ) ) . "')";
+                                $post_type_where = " AND {$wpdb->posts}.post_type IN ('" . join( "', '", array_map( 'esc_sql', $in_search_post_types ) ) . "')";
                         }
                 } elseif ( ! empty( $post_type ) && is_array( $post_type ) ) {
-                        $where .= " AND {$wpdb->posts}.post_type IN ('" . join( "', '", esc_sql( $post_type ) ) . "')";
+                        $post_type_where = " AND {$wpdb->posts}.post_type IN ('" . join( "', '", esc_sql( $post_type ) ) . "')";
                 } elseif ( ! empty( $post_type ) ) {
-                        $where           .= $wpdb->prepare( " AND {$wpdb->posts}.post_type = %s", $post_type );
+                        $post_type_where           = $wpdb->prepare( " AND {$wpdb->posts}.post_type = %s", $post_type );
                         $post_type_object = get_post_type_object( $post_type );
                 } elseif ( $this->is_attachment ) {
-                        $where           .= " AND {$wpdb->posts}.post_type = 'attachment'";
+                        $post_type_where           = " AND {$wpdb->posts}.post_type = 'attachment'";
                         $post_type_object = get_post_type_object( 'attachment' );
                 } elseif ( $this->is_page ) {
-                        $where           .= " AND {$wpdb->posts}.post_type = 'page'";
+                        $post_type_where           = " AND {$wpdb->posts}.post_type = 'page'";
                         $post_type_object = get_post_type_object( 'page' );
                 } else {
-                        $where           .= " AND {$wpdb->posts}.post_type = 'post'";
+                        $post_type_where           = " AND {$wpdb->posts}.post_type = 'post'";
                         $post_type_object = get_post_type_object( 'post' );
                 }
 
@@ -2431 +2431 @@
 
                 $q_status = array();
                 if ( ! empty( $q['post_status'] ) ) {
+
+                        $where .= $post_type_where;
+
                         $statuswheres = array();
                         $q_status     = $q['post_status'];
                         if ( ! is_array( $q_status ) ) {
@@ -2489 +2492 @@
                         if ( ! empty( $where_status ) ) {
                                 $where .= " AND ($where_status)";
                         }
+                } elseif ( ! $this->is_singular && is_user_logged_in() && ( is_array( $post_type ) && sizeof( $post_type ) > 1 || $post_type == 'any' ) ) {
+
+                        if ( 'any' == $post_type ) {
+                                $cpts = get_post_types( array( 'exclude_from_search' => false ) );
+                        } else {
+                                $cpts = $post_type;
+                        }
+
+                        $statustypeswheres = [];
+
+                        foreach ($cpts as $ptype) {
+
+                                $cpt_object = get_post_type_object($ptype);
+                                if ( ! $cpt_object instanceof \WP_Post_Type ) {
+                                        continue;
+                                }
+                                //var_dump($cpt_object);
+                                $read_private_cap = $cpt_object->cap->read_private_posts;
+
+                                $typewheres = '(';
+
+                                        $typewheres .= $wpdb->prepare( "{$wpdb->posts}.post_type = %s AND (", $ptype );
+
+                                                // public statuses
+                                                $public_states = get_post_stati( array( 'public' => true ) );
+                                                $statuswheres = [];
+                                                foreach ( (array) $public_states as $state ) {
+                                                        $statuswheres[] = "{$wpdb->posts}.post_status = '$state'";
+                                                }
+                                                $typewheres .= implode(' OR ', $statuswheres);
+
+                                                // private statuses
+                                                $private_states = get_post_stati( array( 'private' => true ) );
+                                                foreach ( (array) $private_states as $state ) {
+                                                        $typewheres .= current_user_can( $read_private_cap ) ? " OR {$wpdb->posts}.post_status = '$state'" : " OR {$wpdb->posts}.post_author = $user_id AND {$wpdb->posts}.post_status = '$state'";
+                                                }
+
+                                        $typewheres .= ')';
+
+
+                                $typewheres .= ')';
+
+                                $statustypeswheres[] = $typewheres;
+
+                        }
+
+                        $where .= ' AND (' . implode(' OR ', $statustypeswheres) . ')';
+
                 } elseif ( ! $this->is_singular ) {
+
+                        $where .= $post_type_where;
+
                         $where .= " AND ({$wpdb->posts}.post_status = 'publish'";
 
                         // Add public states.
@@ -2523 +2577 @@
                         }
 
                         $where .= ')';
+                } else {
+                        $where .= $post_type_where;
                 }
 
                 /*

tests/phpunit/tests/post/query.php

@@ -721 +721 @@
                 $this->assertEquals( $expected, $q->found_posts );
         }
 
+        /**
+         * @ticket 48556
+         */
+        public function test_query_posts_perm_readable_mutliple_post_types_with_private_posts() {
+                $current_user = get_current_user_id();
+                wp_set_current_user( self::factory()->user->create( array( 'role' => 'administrator' ) ) );
+
+                $public_post = $this->factory->post->create( array( 'post_title' => 'Test Post' ) );
+                $private_post = $this->factory->post->create( array( 'post_title' => 'Test Post', 'post_status' => 'private' ) );
+
+                $public_page = $this->factory->post->create( array(  'post_type' => 'page', 'post_title' => 'Test Page' ) );
+                $private_page = $this->factory->post->create( array( 'post_type' => 'page', 'post_title' => 'Test Page', 'post_status' => 'private' ) );
+
+                $q = new WP_Query(
+                        array(
+                                'post_type'      => ['post', 'page']
+                        )
+                );
+
+                $this->assertEquals(4, $q->found_posts);
+
+                wp_set_current_user( $current_user );
+
+        }
+
+        /**
+         * @ticket 48556
+         */
+        public function test_query_posts_perm_readable_mutliple_post_types_with_private_posts_cpt_any() {
+                $current_user = get_current_user_id();
+                wp_set_current_user( self::factory()->user->create( array( 'role' => 'administrator' ) ) );
+
+                $public_post = $this->factory->post->create( array( 'post_title' => 'Test Post' ) );
+                $private_post = $this->factory->post->create( array( 'post_title' => 'Test Post', 'post_status' => 'private' ) );
+
+                $public_page = $this->factory->post->create( array(  'post_type' => 'page', 'post_title' => 'Test Page' ) );
+                $private_page = $this->factory->post->create( array( 'post_type' => 'page', 'post_title' => 'Test Page', 'post_status' => 'private' ) );
+
+                $q = new WP_Query(
+                        array(
+                                'post_type'      => 'any'
+                        )
+                );
+
+                $this->assertEquals(4, $q->found_posts);
+
+                wp_set_current_user( $current_user );
+
+        }
+
+        /**
+         * @ticket 48556
+         */
+        public function test_query_posts_perm_readable_mutliple_post_types_with_private_posts_user_permissions() {
+                global $current_user;
+                $current_user_id = get_current_user_id();
+
+                $public_post = $this->factory->post->create( array( 'post_title' => 'Test Post' ) );
+                $private_post = $this->factory->post->create( array( 'post_title' => 'Test Post', 'post_status' => 'private' ) );
+
+                $public_page = $this->factory->post->create( array(  'post_type' => 'page', 'post_title' => 'Test Page' ) );
+                $private_page = $this->factory->post->create( array( 'post_type' => 'page', 'post_title' => 'Test Page', 'post_status' => 'private' ) );
+
+                $subscriber = self::factory()->user->create( array( 'role' => 'subscriber' ) );
+                $subscriber_user = get_userdata($subscriber);
+
+                wp_set_current_user( $subscriber );
+
+                $q = new WP_Query(
+                        array(
+                                'post_type'      => ['post', 'page']
+                        )
+                );
+
+                $this->assertEquals(2, $q->found_posts);
+
+                $subscriber_user->add_cap('read_private_posts');
+                $current_user = $subscriber_user; // ensure new cap is considered
+
+                $q = new WP_Query(
+                        array(
+                                'post_type'      => ['post', 'page']
+                        )
+                );
+
+                $this->assertEquals(3, $q->found_posts);
+
+                $subscriber_user->add_cap('read_private_pages');
+                $current_user = $subscriber_user; // ensure new cap is considered
+
+                $q = new WP_Query(
+                        array(
+                                'post_type'      => ['post', 'page']
+                        )
+                );
+
+                $this->assertEquals(4, $q->found_posts);
+
+                wp_set_current_user( $current_user_id );
+
+
+        }
+
+        /**
+         * @ticket 48556
+         */
+        public function test_query_posts_perm_readable_mutliple_post_types_with_private_posts_user_permissions_cpt_any() {
+                global $current_user;
+                $current_user_id = get_current_user_id();
+
+                $public_post = $this->factory->post->create( array( 'post_title' => 'Test Post' ) );
+                $private_post = $this->factory->post->create( array( 'post_title' => 'Test Post', 'post_status' => 'private' ) );
+
+                $public_page = $this->factory->post->create( array(  'post_type' => 'page', 'post_title' => 'Test Page' ) );
+                $private_page = $this->factory->post->create( array( 'post_type' => 'page', 'post_title' => 'Test Page', 'post_status' => 'private' ) );
+
+                $subscriber = self::factory()->user->create( array( 'role' => 'subscriber' ) );
+                $subscriber_user = get_userdata($subscriber);
+
+                wp_set_current_user( $subscriber );
+
+                $q = new WP_Query(
+                        array(
+                                'post_type'      => 'any'
+                        )
+                );
+
+                $this->assertEquals(2, $q->found_posts);
+
+                $subscriber_user->add_cap('read_private_posts');
+                $current_user = $subscriber_user; // ensure new cap is considered
+
+                $q = new WP_Query(
+                        array(
+                                'post_type'      => 'any'
+                        )
+                );
+
+                $this->assertEquals(3, $q->found_posts);
+
+                $subscriber_user->add_cap('read_private_pages');
+                $current_user = $subscriber_user; // ensure new cap is considered
+
+                $q = new WP_Query(
+                        array(
+                                'post_type'      => 'any'
+                        )
+                );
+
+                $this->assertEquals(4, $q->found_posts);
+
+                wp_set_current_user( $current_user_id );
+
+
+        }
+
 }