Changeset 48474

Timestamp:

07/14/2020 11:54:49 AM (6 years ago)

Author:

swissspidy

Message:

Sitemaps: Exclude post types and taxonomies that are not publicly queryable.

Props Cybr.
Fixes #50607.

Location:

trunk

Files:

• src/wp-includes/sitemaps/providers/class-wp-sitemaps-posts.php (modified) (1 diff)
• src/wp-includes/sitemaps/providers/class-wp-sitemaps-taxonomies.php (modified) (1 diff)
• tests/phpunit/tests/sitemaps/sitemaps-taxonomies.php (modified) (4 diffs)
• tests/phpunit/tests/sitemaps/sitemaps.php (modified) (2 diffs)

trunk/src/wp-includes/sitemaps/providers/class-wp-sitemaps-posts.php

@@ -37 +37 @@
                 $post_types = get_post_types( array( 'public' => true ), 'objects' );
                 unset( $post_types['attachment'] );
+
+                $post_types = array_filter( $post_types, 'is_post_type_viewable' );
 
                 /**

trunk/src/wp-includes/sitemaps/providers/class-wp-sitemaps-taxonomies.php

@@ -35 +35 @@
         public function get_object_subtypes() {
                 $taxonomies = get_taxonomies( array( 'public' => true ), 'objects' );
+
+                $taxonomies = array_filter( $taxonomies, 'is_taxonomy_viewable' );
 
                 /**

trunk/tests/phpunit/tests/sitemaps/sitemaps-taxonomies.php

@@ -144 +144 @@
 
         /**
+         * Test getting a URL list for a custom taxonomy that is not publicly queryable.
+         */
+        public function test_get_url_list_custom_taxonomy_not_publicly_queryable() {
+                // Create a custom taxonomy for this test.
+                $taxonomy = 'non_queryable_tax';
+                register_taxonomy( $taxonomy, 'post', array( 'publicly_queryable' => false ) );
+
+                // Create test terms in the custom taxonomy.
+                $terms = self::factory()->term->create_many( 10, array( 'taxonomy' => $taxonomy ) );
+
+                // Create a test post applied to all test terms.
+                self::factory()->post->create( array( 'tax_input' => array( $taxonomy => $terms ) ) );
+
+                $tax_provider = new WP_Sitemaps_Taxonomies();
+
+                $post_list = $tax_provider->get_url_list( 1, $taxonomy );
+
+                // Clean up.
+                unregister_taxonomy_for_object_type( $taxonomy, 'post' );
+
+                $this->assertEmpty( $post_list, 'Private taxonomy term links are visible.' );
+        }
+
+        /**
          * Test sitemap index entries with public and private taxonomies.
          */
@@ -151 +175 @@
                 // Create a custom public and private taxonomies for this test.
                 register_taxonomy( 'public_taxonomy', 'post' );
+                register_taxonomy( 'non_queryable_taxonomy', 'post', array( 'publicly_queryable' => false ) );
                 register_taxonomy( 'private_taxonomy', 'post', array( 'public' => false ) );
 
                 // Create test terms in the custom taxonomy.
-                $public_term  = self::factory()->term->create( array( 'taxonomy' => 'public_taxonomy' ) );
-                $private_term = self::factory()->term->create( array( 'taxonomy' => 'private_taxonomy' ) );
+                $public_term        = self::factory()->term->create( array( 'taxonomy' => 'public_taxonomy' ) );
+                $non_queryable_term = self::factory()->term->create( array( 'taxonomy' => 'non_queryable_taxonomy' ) );
+                $private_term       = self::factory()->term->create( array( 'taxonomy' => 'private_taxonomy' ) );
 
                 // Create a test post applied to all test terms.
@@ -161 +187 @@
                         array(
                                 'tax_input' => array(
-                                        'public_taxonomy'  => array( $public_term ),
-                                        'private_taxonomy' => array( $private_term ),
+                                        'public_taxonomy'        => array( $public_term ),
+                                        'non_queryable_taxonomy' => array( $non_queryable_term ),
+                                        'private_taxonomy'       => array( $private_term ),
                                 ),
                         )
@@ -172 +199 @@
                 // Clean up.
                 unregister_taxonomy_for_object_type( 'public_taxonomy', 'post' );
+                unregister_taxonomy_for_object_type( 'non_queryable_taxonomy', 'post' );
                 unregister_taxonomy_for_object_type( 'private_taxonomy', 'post' );
 
                 $this->assertContains( 'http://' . WP_TESTS_DOMAIN . '/?sitemap=taxonomies&sitemap-subtype=public_taxonomy&paged=1', $entries, 'Public Taxonomies are not in the index.' );
+                $this->assertNotContains( 'http://' . WP_TESTS_DOMAIN . '/?sitemap=taxonomies&sitemap-subtype=non_queryable_taxonomy&paged=1', $entries, 'Private Taxonomies are visible in the index.' );
                 $this->assertNotContains( 'http://' . WP_TESTS_DOMAIN . '/?sitemap=taxonomies&sitemap-subtype=private_taxonomy&paged=1', $entries, 'Private Taxonomies are visible in the index.' );
         }

trunk/tests/phpunit/tests/sitemaps/sitemaps.php

@@ -193 +193 @@
 
         /**
+         * Test sitemap index entries with public and private custom post types.
+         *
+         * @ticket 50607
+         */
+        public function test_get_sitemap_entries_not_publicly_queryable_post_types() {
+                register_post_type(
+                        'non_queryable_cpt',
+                        array(
+                                'public'             => true,
+                                'publicly_queryable' => false,
+                        )
+                );
+                self::factory()->post->create( array( 'post_type' => 'non_queryable_cpt' ) );
+
+                $entries = wp_list_pluck( $this->_get_sitemap_entries(), 'loc' );
+
+                // Clean up.
+                unregister_post_type( 'non_queryable_cpt' );
+
+                $this->assertNotContains( 'http://' . WP_TESTS_DOMAIN . '/?sitemap=posts&sitemap-subtype=non_queryable_cpt&paged=1', $entries, 'Non-publicly queryable CPTs are visible in the index.' );
+        }
+
+        /**
          * Tests getting a URL list for post type post.
          */
@@ -306 +329 @@
 
                 $this->assertEmpty( $post_list, 'Private post types may be returned by the post provider.' );
+        }
+
+        /**
+         * Tests getting a URL list for a private custom post type.
+         *
+         * @ticket 50607
+         */
+        public function test_get_url_list_cpt_not_publicly_queryable() {
+                $post_type = 'non_queryable_cpt';
+
+                register_post_type(
+                        $post_type,
+                        array(
+                                'public'             => true,
+                                'publicly_queryable' => false,
+                        )
+                );
+
+                self::factory()->post->create_many( 10, array( 'post_type' => $post_type ) );
+
+                $providers = wp_get_sitemaps();
+
+                $post_list = $providers['posts']->get_url_list( 1, $post_type );
+
+                // Clean up.
+                unregister_post_type( $post_type );
+
+                $this->assertEmpty( $post_list, 'Non-publicly queryable post types may be returned by the post provider.' );
         }