Changeset 47181

Timestamp:

02/05/2020 01:31:38 AM (5 years ago)

Author:

SergeyBiryukov

Message:

Posts, Post Types: Fail gracefully when checking whether a single post with an unregistered post status should be displayed in WP_Query::get_posts().

If the post status is not registered, assume it's not public, but still allow access to users with edit permissions (same as for a protected post status, e.g. draft), so that they could recover orphaned content.

Add unit tests.

Follow-up to [47178].

Props roytanck, SergeyBiryukov.
Fixes #48653.

Location:

trunk

Files:

• src/wp-includes/class-wp-query.php (modified) (2 diffs)
• tests/phpunit/tests/query/postStatus.php (modified) (2 diffs)

trunk/src/wp-includes/class-wp-query.php

@@ -3067 +3067 @@
         if ( ! empty( $this->posts ) && ( $this->is_single || $this->is_page ) ) {
             $status = get_post_status( $this->posts[0] );
+
             if ( 'attachment' === $this->posts[0]->post_type && 0 === (int) $this->posts[0]->post_parent ) {
                 $this->is_page       = false;
@@ -3072 +3073 @@
                 $this->is_attachment = true;
             }
-            $post_status_obj = get_post_status_object( $status );
 
             // If the post_status was specifically requested, let it pass through.
-            if ( ! $post_status_obj->public && ! in_array( $status, $q_status ) ) {
-
-                if ( ! is_user_logged_in() ) {
-                    // User must be logged in to view unpublished posts.
-                    $this->posts = array();
-                } else {
-                    if ( $post_status_obj->protected ) {
-                        // User must have edit permissions on the draft to preview.
-                        if ( ! current_user_can( $edit_cap, $this->posts[0]->ID ) ) {
-                            $this->posts = array();
+            if ( ! in_array( $status, $q_status ) ) {
+                $post_status_obj = get_post_status_object( $status );
+
+                if ( $post_status_obj && ! $post_status_obj->public ) {
+                    if ( ! is_user_logged_in() ) {
+                        // User must be logged in to view unpublished posts.
+                        $this->posts = array();
+                    } else {
+                        if ( $post_status_obj->protected ) {
+                            // User must have edit permissions on the draft to preview.
+                            if ( ! current_user_can( $edit_cap, $this->posts[0]->ID ) ) {
+                                $this->posts = array();
+                            } else {
+                                $this->is_preview = true;
+                                if ( 'future' != $status ) {
+                                    $this->posts[0]->post_date = current_time( 'mysql' );
+                                }
+                            }
+                        } elseif ( $post_status_obj->private ) {
+                            if ( ! current_user_can( $read_cap, $this->posts[0]->ID ) ) {
+                                $this->posts = array();
+                            }
                         } else {
-                            $this->is_preview = true;
-                            if ( 'future' != $status ) {
-                                $this->posts[0]->post_date = current_time( 'mysql' );
-                            }
-                        }
-                    } elseif ( $post_status_obj->private ) {
-                        if ( ! current_user_can( $read_cap, $this->posts[0]->ID ) ) {
                             $this->posts = array();
                         }
-                    } else {
+                    }
+                } elseif ( ! $post_status_obj ) {
+                    // Post status is not registered, assume it's not public.
+                    if ( ! current_user_can( $edit_cap, $this->posts[0]->ID ) ) {
                         $this->posts = array();
                     }

trunk/tests/phpunit/tests/query/postStatus.php

@@ -263 +263 @@
     }
 
+    public function test_single_post_with_nonpublic_status_should_not_be_shown_for_any_user() {
+        register_post_type( 'foo_pt' );
+        register_post_status( 'foo_ps', array( 'public' => false ) );
+        $p = self::factory()->post->create(
+            array(
+                'post_status' => 'foo_ps',
+                'post_author' => self::$author_user_id,
+            )
+        );
+
+        wp_set_current_user( self::$editor_user_id );
+
+        $q = new WP_Query(
+            array(
+                'p' => $p,
+            )
+        );
+
+        $this->assertEmpty( $q->posts );
+    }
+
     public function test_single_post_with_nonpublic_and_protected_status_should_not_be_shown_for_user_who_cannot_edit_others_posts() {
         register_post_type( 'foo_pt' );
@@ -371 +392 @@
     }
 
-    public function test_single_post_with_nonpublic_and_protected_status_should_not_be_shown_for_any_user() {
-        register_post_type( 'foo_pt' );
-        register_post_status( 'foo_ps', array( 'public' => false ) );
-        $p = self::factory()->post->create(
-            array(
-                'post_status' => 'foo_ps',
-                'post_author' => self::$author_user_id,
-            )
-        );
-
-        wp_set_current_user( self::$editor_user_id );
-
-        $q = new WP_Query(
-            array(
-                'p' => $p,
-            )
-        );
-
-        $this->assertEmpty( $q->posts );
+    /**
+     * @ticket 48653
+     */
+    public function test_single_post_with_nonexisting_status_should_not_be_shown_for_user_who_cannot_edit_others_posts() {
+        register_post_type( 'foo_pt' );
+        register_post_status( 'foo_ps', array( 'public' => true ) );
+        $p = self::factory()->post->create(
+            array(
+                'post_status' => 'foo_ps',
+                'post_author' => self::$editor_user_id,
+            )
+        );
+        _unregister_post_status( 'foo_ps' );
+
+        wp_set_current_user( self::$author_user_id );
+
+        $q = new WP_Query(
+            array(
+                'p' => $p,
+            )
+        );
+
+        $this->assertEmpty( $q->posts );
+    }
+
+    /**
+     * @ticket 48653
+     */
+    public function test_single_post_with_nonexisting_status_should_be_shown_for_user_who_can_edit_others_posts() {
+        register_post_type( 'foo_pt' );
+        register_post_status( 'foo_ps', array( 'public' => true ) );
+        $p = self::factory()->post->create(
+            array(
+                'post_status' => 'foo_ps',
+                'post_author' => self::$author_user_id,
+            )
+        );
+        _unregister_post_status( 'foo_ps' );
+
+        wp_set_current_user( self::$editor_user_id );
+
+        $q = new WP_Query(
+            array(
+                'p' => $p,
+            )
+        );
+
+        $this->assertEquals( array( $p ), wp_list_pluck( $q->posts, 'ID' ) );
     }