Changeset 31114

Timestamp:

01/09/2015 04:39:56 PM (10 years ago)

Author:

boonebgorges

Message:

In get_permalink(), don't resolve to pretty permalink if post has 'future' status.

We already do this for other non-public statuses, to prevent leaking non-public
information about unpublished posts.

Props e.mazovetskiy, CalEvans.
Fixes #30910.

Location:

trunk

Files:

• src/wp-includes/link-template.php (modified) (2 diffs)
• tests/phpunit/tests/link.php (modified) (1 diff)
• tests/phpunit/tests/query/postStatus.php (modified) (1 diff)

trunk/src/wp-includes/link-template.php

@@ -158 +158 @@
     $permalink = apply_filters( 'pre_post_link', $permalink, $post, $leavename );
 
-    if ( '' != $permalink && !in_array($post->post_status, array('draft', 'pending', 'auto-draft')) ) {
+    if ( '' != $permalink && !in_array( $post->post_status, array( 'draft', 'pending', 'auto-draft', 'future' ) ) ) {
         $unixtime = strtotime($post->post_date);
 
@@ -254 +254 @@
     $slug = $post->post_name;
 
-    $draft_or_pending = isset($post->post_status) && in_array( $post->post_status, array( 'draft', 'pending', 'auto-draft' ) );
+    $draft_or_pending = isset( $post->post_status ) && in_array( $post->post_status, array( 'draft', 'pending', 'auto-draft', 'future' ) );
 
     $post_type = get_post_type_object($post->post_type);

trunk/tests/phpunit/tests/link.php

@@ -287 +287 @@
         $this->assertEquals( '/this-is-a-test/?redirect=https://example.org/a-different-test-post/', $relative_link );
     }
+
+    /**
+     * @ticket 30910
+     */
+    public function test_get_permalink_should_not_reveal_post_name_for_post_with_post_status_future() {
+        update_option( 'permalink_structure','/%year%/%monthnum%/%day%/%postname%/' );
+
+        flush_rewrite_rules();
+
+        $p = $this->factory->post->create( array(
+            'post_status' => 'publish',
+            'post_date'   => strftime( '%Y-%m-%d %H:%M:%S', strtotime( '+1 day' ) )
+        ) );
+
+        $non_pretty_permalink = add_query_arg( 'p', $p, trailingslashit( home_url() ) );
+
+        $this->assertEquals( $non_pretty_permalink, get_permalink( $p ) );
+    }
+
+    /**
+     * @ticket 30910
+     */
+    public function test_get_permalink_should_not_reveal_post_name_for_cpt_with_post_status_future() {
+        update_option( 'permalink_structure','/%year%/%monthnum%/%day%/%postname%/' );
+
+        register_post_type( 'wptests_pt', array( 'public' => true ) );
+
+        flush_rewrite_rules();
+
+        $p = $this->factory->post->create( array(
+            'post_status' => 'future',
+            'post_type'   => 'wptests_pt',
+            'post_date'   => strftime( '%Y-%m-%d %H:%M:%S', strtotime( '+1 day' ) )
+        ) );
+
+        $non_pretty_permalink = add_query_arg( array(
+            'post_type' => 'wptests_pt',
+            'p' => $p,
+        ), trailingslashit( home_url() ) );
+
+        $this->assertEquals( $non_pretty_permalink, get_permalink( $p ) );
+    }
 }

trunk/tests/phpunit/tests/query/postStatus.php

@@ -196 +196 @@
             'posts_per_page' => -1,
         ) );
-global $wpdb;
-//print_r( $wpdb->get_results( "SELECT * FROM $wpdb->posts" ) );
+
         $this->assertContains( self::$author_privatefoo_post, wp_list_pluck( $q->posts, 'ID' ) );
         $this->assertContains( self::$editor_privatefoo_post, wp_list_pluck( $q->posts, 'ID' ) );