Changeset 31302 for trunk/src/wp-includes/link-template.php

Timestamp:

01/30/2015 02:19:46 AM (8 years ago)

Author:

boonebgorges

Message:

In get_adjacent_post(), return private post if the current user has the capacity to read it.

This mirrors the check that happens post-query in WP_Query. See #30911.

Props bswatson.
Fixes #30287.

File:

• trunk/src/wp-includes/link-template.php (modified) (2 diffs)

trunk/src/wp-includes/link-template.php

@@ -1522 +1522 @@
     }
 
+    // 'post_status' clause depends on the current user.
+    if ( is_user_logged_in() ) {
+        $user_id = get_current_user_id();
+
+        $post_type_object = get_post_type_object( $post->post_type );
+        if ( empty( $post_type_object ) ) {
+            $post_type_cap    = $post->post_type;
+            $read_private_cap = 'read_private_' . $post_type_cap . 's';
+        } else {
+            $read_private_cap = $post_type_object->cap->read_private_posts;
+        }
+
+        /*
+         * Results should include private posts belonging to the current user, or private posts where the
+         * current user has the 'read_private_posts' cap.
+         */
+        $private_states = get_post_stati( array( 'private' => true ) );
+        $where .= " AND ( p.post_status = 'publish'";
+        foreach ( (array) $private_states as $state ) {
+            if ( current_user_can( $read_private_cap ) ) {
+                $where .= $wpdb->prepare( " OR p.post_status = %s", $state );
+            } else {
+                $where .= $wpdb->prepare( " OR (p.post_author = %d AND p.post_status = %s)", $user_id, $state );
+            }
+        }
+        $where .= " )";
+    } else {
+        $where .= " AND p.post_status = 'publish'";
+    }
+
     $adjacent = $previous ? 'previous' : 'next';
     $op = $previous ? '<' : '>';
@@ -1552 +1582 @@
      * @param array  $excluded_terms Array of excluded term IDs.
      */
-    $where = apply_filters( "get_{$adjacent}_post_where", $wpdb->prepare( "WHERE p.post_date $op %s AND p.post_type = %s AND p.post_status = 'publish' $where", $current_post_date, $post->post_type ), $in_same_term, $excluded_terms );
+    $where = apply_filters( "get_{$adjacent}_post_where", $wpdb->prepare( "WHERE p.post_date $op %s AND p.post_type = %s $where", $current_post_date, $post->post_type ), $in_same_term, $excluded_terms );
 
     /**