Changeset 42186 for branches/4.9

Timestamp:

11/15/2017 02:32:06 AM (7 years ago)

Author:

westonruter

Message:

Widgets: Set global $post to current queried object instead of nullifying when is_singular() while applying filters (and shortcodes) in Text widget and (via plugin) Custom HTML widget.

Also prevent [gallery] shortcode from dumping out every attachment on the site when a containing Text widget is shown on an archive template.

Props westonruter, bobbingwide, joemcgill for testing.
See #10457.
Fixes #42548, #42547 for 4.9.

Location:

branches/4.9

Files:

• . (modified) (1 prop)
• src/wp-includes/widgets/class-wp-widget-custom-html.php (modified) (3 diffs)
• src/wp-includes/widgets/class-wp-widget-text.php (modified) (3 diffs)

branches/4.9/src/wp-includes/widgets/class-wp-widget-custom-html.php

@@ -82 +82 @@
 
     /**
+     * Filter gallery shortcode attributes.
+     *
+     * Prevents all of a site's attachments from being shown in a gallery displayed on a
+     * non-singular template where a $post context is not available.
+     *
+     * @since 4.9.0
+     *
+     * @param array $attrs Attributes.
+     * @return array Attributes.
+     */
+    public function _filter_gallery_shortcode_attrs( $attrs ) {
+        if ( ! is_singular() && empty( $attrs['id'] ) && empty( $attrs['include'] ) ) {
+            $attrs['id'] = -1;
+        }
+        return $attrs;
+    }
+
+    /**
      * Outputs the content for the current Custom HTML widget instance.
      *
      * @since 4.8.1
      *
+     * @global WP_Post $post
      * @param array $args     Display arguments including 'before_title', 'after_title',
      *                        'before_widget', and 'after_widget'.
@@ -91 +110 @@
      */
     public function widget( $args, $instance ) {
+        global $post;
+
+        // Override global $post so filters (and shortcodes) apply in a consistent context.
+        $original_post = $post;
+        if ( is_singular() ) {
+            // Make sure post is always the queried object on singular queries (not from another sub-query that failed to clean up the global $post).
+            $post = get_queried_object();
+        } else {
+            // Nullify the $post global during widget rendering to prevent shortcodes from running with the unexpected context on archive queries.
+            $post = null;
+        }
+
+        // Prevent dumping out all attachments from the media library.
+        add_filter( 'shortcode_atts_gallery', array( $this, '_filter_gallery_shortcode_attrs' ) );
 
         $instance = array_merge( $this->default_instance, $instance );
@@ -118 +151 @@
          */
         $content = apply_filters( 'widget_custom_html_content', $content, $instance, $this );
+
+        // Restore post global.
+        $post = $original_post;
+        remove_filter( 'shortcode_atts_gallery', array( $this, '_filter_gallery_shortcode_attrs' ) );
 
         // Inject the Text widget's container class name alongside this widget's class name for theme styling compatibility.

branches/4.9/src/wp-includes/widgets/class-wp-widget-text.php

@@ -180 +180 @@
 
     /**
+     * Filter gallery shortcode attributes.
+     *
+     * Prevents all of a site's attachments from being shown in a gallery displayed on a
+     * non-singular template where a $post context is not available.
+     *
+     * @since 4.9.0
+     *
+     * @param array $attrs Attributes.
+     * @return array Attributes.
+     */
+    public function _filter_gallery_shortcode_attrs( $attrs ) {
+        if ( ! is_singular() && empty( $attrs['id'] ) && empty( $attrs['include'] ) ) {
+            $attrs['id'] = -1;
+        }
+        return $attrs;
+    }
+
+    /**
      * Outputs the content for the current Text widget instance.
      *
@@ -222 +240 @@
         }
 
-        // Nullify the $post global during widget rendering to prevent shortcodes from running with the unexpected context.
-        $suspended_post = null;
-        if ( isset( $post ) ) {
-            $suspended_post = $post;
+        // Override global $post so filters (and shortcodes) apply in a consistent context.
+        $original_post = $post;
+        if ( is_singular() ) {
+            // Make sure post is always the queried object on singular queries (not from another sub-query that failed to clean up the global $post).
+            $post = get_queried_object();
+        } else {
+            // Nullify the $post global during widget rendering to prevent shortcodes from running with the unexpected context on archive queries.
             $post = null;
         }
+
+        // Prevent dumping out all attachments from the media library.
+        add_filter( 'shortcode_atts_gallery', array( $this, '_filter_gallery_shortcode_attrs' ) );
 
         /**
@@ -279 +303 @@
 
         // Restore post global.
-        if ( isset( $suspended_post ) ) {
-            $post = $suspended_post;
-        }
+        $post = $original_post;
+        remove_filter( 'shortcode_atts_gallery', array( $this, '_filter_gallery_shortcode_attrs' ) );
 
         // Undo suspension of legacy plugin-supplied shortcode handling.