Changeset 31302

Timestamp:

01/30/2015 02:19:46 AM (10 years ago)

Author:

boonebgorges

Message:

In get_adjacent_post(), return private post if the current user has the capacity to read it.

This mirrors the check that happens post-query in WP_Query. See #30911.

Props bswatson.
Fixes #30287.

Location:

trunk

Files:

• src/wp-includes/link-template.php (modified) (2 diffs)
• tests/phpunit/tests/url.php (modified) (2 diffs)

trunk/src/wp-includes/link-template.php

@@ -1522 +1522 @@
     }
 
+    // 'post_status' clause depends on the current user.
+    if ( is_user_logged_in() ) {
+        $user_id = get_current_user_id();
+
+        $post_type_object = get_post_type_object( $post->post_type );
+        if ( empty( $post_type_object ) ) {
+            $post_type_cap    = $post->post_type;
+            $read_private_cap = 'read_private_' . $post_type_cap . 's';
+        } else {
+            $read_private_cap = $post_type_object->cap->read_private_posts;
+        }
+
+        /*
+         * Results should include private posts belonging to the current user, or private posts where the
+         * current user has the 'read_private_posts' cap.
+         */
+        $private_states = get_post_stati( array( 'private' => true ) );
+        $where .= " AND ( p.post_status = 'publish'";
+        foreach ( (array) $private_states as $state ) {
+            if ( current_user_can( $read_private_cap ) ) {
+                $where .= $wpdb->prepare( " OR p.post_status = %s", $state );
+            } else {
+                $where .= $wpdb->prepare( " OR (p.post_author = %d AND p.post_status = %s)", $user_id, $state );
+            }
+        }
+        $where .= " )";
+    } else {
+        $where .= " AND p.post_status = 'publish'";
+    }
+
     $adjacent = $previous ? 'previous' : 'next';
     $op = $previous ? '<' : '>';
@@ -1552 +1582 @@
      * @param array  $excluded_terms Array of excluded term IDs.
      */
-    $where = apply_filters( "get_{$adjacent}_post_where", $wpdb->prepare( "WHERE p.post_date $op %s AND p.post_type = %s AND p.post_status = 'publish' $where", $current_post_date, $post->post_type ), $in_same_term, $excluded_terms );
+    $where = apply_filters( "get_{$adjacent}_post_where", $wpdb->prepare( "WHERE p.post_date $op %s AND p.post_type = %s $where", $current_post_date, $post->post_type ), $in_same_term, $excluded_terms );
 
     /**

trunk/tests/phpunit/tests/url.php

@@ -280 +280 @@
     }
 
-    function test_get_adjacent_post() {
-        $post_id = $this->factory->post->create();
-        sleep( 1 ); // get_adjacent_post() doesn't handle posts created in the same second.
-        $post_id2 = $this->factory->post->create();
+    public function test_get_adjacent_post() {
+        $now = time();
+        $post_id = $this->factory->post->create( array( 'post_date' => date( 'Y-m-d H:i:s', $now - 1 ) ) );
+        $post_id2 = $this->factory->post->create( array( 'post_date' => date( 'Y-m-d H:i:s', $now ) ) );
 
         if ( ! isset( $GLOBALS['post'] ) )
@@ -307 +307 @@
 
         $GLOBALS['post'] = $orig_post;
-
-        // Tests requiring creating more posts can't be run since the query
-        // cache in get_adjacent_post() requires a fresh page load to invalidate.
+    }
+
+    /**
+     * Test get_adjacent_post returns the next private post when the author is the currently logged in user.
+     *
+     * @ticket 30287
+     */
+    public function test_get_adjacent_post_should_return_private_posts_belonging_to_the_current_user() {
+        $u = $this->factory->user->create( array( 'role' => 'author' ) );
+        $old_uid = get_current_user_id();
+        wp_set_current_user( $u );
+
+        $now = time();
+        $p1 = $this->factory->post->create( array( 'post_author' => $u, 'post_status' => 'private', 'post_date' => date( 'Y-m-d H:i:s', $now - 1 ) ) );
+        $p2 = $this->factory->post->create( array( 'post_author' => $u, 'post_date' => date( 'Y-m-d H:i:s', $now ) ) );
+
+        if ( ! isset( $GLOBALS['post'] ) ) {
+            $GLOBALS['post'] = null;
+        }
+        $orig_post = $GLOBALS['post'];
+
+        $GLOBALS['post'] = get_post( $p2 );
+
+        $p = get_adjacent_post();
+        $this->assertEquals( $p1, $p->ID );
+
+        $GLOBALS['post'] = $orig_post;
+        wp_set_current_user( $old_uid );
+    }
+
+    /**
+     * @ticket 30287
+     */
+    public function test_get_adjacent_post_should_return_private_posts_belonging_to_other_users_if_the_current_user_can_read_private_posts() {
+        $u1 = $this->factory->user->create( array( 'role' => 'author' ) );
+        $u2 = $this->factory->user->create( array( 'role' => 'administrator' ) );
+        $old_uid = get_current_user_id();
+        wp_set_current_user( $u2 );
+
+        $now = time();
+        $p1 = $this->factory->post->create( array( 'post_author' => $u1, 'post_status' => 'private', 'post_date' => date( 'Y-m-d H:i:s', $now - 1 ) ) );
+        $p2 = $this->factory->post->create( array( 'post_author' => $u1, 'post_date' => date( 'Y-m-d H:i:s', $now ) ) );
+
+        if ( ! isset( $GLOBALS['post'] ) ) {
+            $GLOBALS['post'] = null;
+        }
+        $orig_post = $GLOBALS['post'];
+
+        $GLOBALS['post'] = get_post( $p2 );
+
+        $p = get_adjacent_post();
+        $this->assertEquals( $p1, $p->ID );
+
+        $GLOBALS['post'] = $orig_post;
+        wp_set_current_user( $old_uid );
+    }
+
+    /**
+     * @ticket 30287
+     */
+    public function test_get_adjacent_post_should_not_return_private_posts_belonging_to_other_users_if_the_current_user_cannot_read_private_posts() {
+        $u1 = $this->factory->user->create( array( 'role' => 'author' ) );
+        $u2 = $this->factory->user->create( array( 'role' => 'author' ) );
+        $old_uid = get_current_user_id();
+        wp_set_current_user( $u2 );
+
+        $now = time();
+        $p1 = $this->factory->post->create( array( 'post_author' => $u1, 'post_date' => date( 'Y-m-d H:i:s', $now - 2 ) ) );
+        $p2 = $this->factory->post->create( array( 'post_author' => $u1, 'post_status' => 'private', 'post_date' => date( 'Y-m-d H:i:s', $now - 1 ) ) );
+        $p3 = $this->factory->post->create( array( 'post_author' => $u1, 'post_date' => date( 'Y-m-d H:i:s', $now ) ) );
+
+        if ( ! isset( $GLOBALS['post'] ) ) {
+            $GLOBALS['post'] = null;
+        }
+        $orig_post = $GLOBALS['post'];
+
+        $GLOBALS['post'] = get_post( $p3 );
+
+        $p = get_adjacent_post();
+        $this->assertEquals( $p1, $p->ID );
+
+        $GLOBALS['post'] = $orig_post;
+        wp_set_current_user( $old_uid );
     }