Ticket #48653: 48653.diff

src/wp-includes/capabilities.php

@@ -241 +241 @@
                         }
 
                         $status_obj = get_post_status_object( $post->post_status );
+                        if( !$status_obj ){
+                                /* translators: 1: Post status, 2: Capability name. */
+                                _doing_it_wrong( __FUNCTION__, sprintf( __( 'The post status %1$s is not registered, so it may not be reliable to check the capability "%2$s" against a post with that status.' ), $post->post_status, $cap ), '5.3.1' );
+                                $caps[] = 'edit_others_posts';
+                                break;
+                        }
+
                         if ( $status_obj->public ) {
                                 $caps[] = $post_type->cap->read;
                                 break;

src/wp-includes/class-wp-query.php

@@ -3056 +3056 @@
                                 $this->is_single     = true;
                                 $this->is_attachment = true;
                         }
-                        $post_status_obj = get_post_status_object( $status );
 
                         // If the post_status was specifically requested, let it pass through.
-                        if ( ! $post_status_obj->public && ! in_array( $status, $q_status ) ) {
-
-                                if ( ! is_user_logged_in() ) {
-                                        // User must be logged in to view unpublished posts.
-                                        $this->posts = array();
-                                } else {
-                                        if ( $post_status_obj->protected ) {
-                                                // User must have edit permissions on the draft to preview.
-                                                if ( ! current_user_can( $edit_cap, $this->posts[0]->ID ) ) {
-                                                        $this->posts = array();
+                        if ( ! in_array( $status, $q_status ) ) {
+                                $post_status_obj = get_post_status_object( $status );
+                                if ( $post_status_obj && ! $post_status_obj->public ){
+                                        if ( ! is_user_logged_in() ) {
+                                                // User must be logged in to view unpublished posts.
+                                                $this->posts = array();
+                                        } else {
+                                                if ( $post_status_obj->protected ) {
+                                                        // User must have edit permissions on the draft to preview.
+                                                        if ( ! current_user_can( $edit_cap, $this->posts[0]->ID ) ) {
+                                                                $this->posts = array();
+                                                        } else {
+                                                                $this->is_preview = true;
+                                                                if ( 'future' != $status ) {
+                                                                        $this->posts[0]->post_date = current_time( 'mysql' );
+                                                                }
+                                                        }
+                                                } elseif ( $post_status_obj->private ) {
+                                                        if ( ! current_user_can( $read_cap, $this->posts[0]->ID ) ) {
+                                                                $this->posts = array();
+                                                        }
                                                 } else {
-                                                        $this->is_preview = true;
-                                                        if ( 'future' != $status ) {
-                                                                $this->posts[0]->post_date = current_time( 'mysql' );
-                                                        }
-                                                }
-                                        } elseif ( $post_status_obj->private ) {
-                                                if ( ! current_user_can( $read_cap, $this->posts[0]->ID ) ) {
                                                         $this->posts = array();
                                                 }
-                                        } else {
-                                                $this->posts = array();
                                         }
+                                } else {
+                                        // Post status not registered, assume it's not public.
+                                        $this->posts = array();
                                 }
                         }