Changeset 48474

Timestamp:

07/14/2020 11:54:49 AM (4 years ago)

Author:

swissspidy

Message:

Sitemaps: Exclude post types and taxonomies that are not publicly queryable.

Props Cybr.
Fixes #50607.

Location:

trunk

Files:

• src/wp-includes/sitemaps/providers/class-wp-sitemaps-posts.php (modified) (1 diff)
• src/wp-includes/sitemaps/providers/class-wp-sitemaps-taxonomies.php (modified) (1 diff)
• tests/phpunit/tests/sitemaps/sitemaps-taxonomies.php (modified) (4 diffs)
• tests/phpunit/tests/sitemaps/sitemaps.php (modified) (2 diffs)

trunk/src/wp-includes/sitemaps/providers/class-wp-sitemaps-posts.php

@@ -37 +37 @@
         $post_types = get_post_types( array( 'public' => true ), 'objects' );
         unset( $post_types['attachment'] );
+
+        $post_types = array_filter( $post_types, 'is_post_type_viewable' );
 
         /**

trunk/src/wp-includes/sitemaps/providers/class-wp-sitemaps-taxonomies.php

@@ -35 +35 @@
     public function get_object_subtypes() {
         $taxonomies = get_taxonomies( array( 'public' => true ), 'objects' );
+
+        $taxonomies = array_filter( $taxonomies, 'is_taxonomy_viewable' );
 
         /**

trunk/tests/phpunit/tests/sitemaps/sitemaps-taxonomies.php

@@ -144 +144 @@
 
     /**
+     * Test getting a URL list for a custom taxonomy that is not publicly queryable.
+     */
+    public function test_get_url_list_custom_taxonomy_not_publicly_queryable() {
+        // Create a custom taxonomy for this test.
+        $taxonomy = 'non_queryable_tax';
+        register_taxonomy( $taxonomy, 'post', array( 'publicly_queryable' => false ) );
+
+        // Create test terms in the custom taxonomy.
+        $terms = self::factory()->term->create_many( 10, array( 'taxonomy' => $taxonomy ) );
+
+        // Create a test post applied to all test terms.
+        self::factory()->post->create( array( 'tax_input' => array( $taxonomy => $terms ) ) );
+
+        $tax_provider = new WP_Sitemaps_Taxonomies();
+
+        $post_list = $tax_provider->get_url_list( 1, $taxonomy );
+
+        // Clean up.
+        unregister_taxonomy_for_object_type( $taxonomy, 'post' );
+
+        $this->assertEmpty( $post_list, 'Private taxonomy term links are visible.' );
+    }
+
+    /**
      * Test sitemap index entries with public and private taxonomies.
      */
@@ -151 +175 @@
         // Create a custom public and private taxonomies for this test.
         register_taxonomy( 'public_taxonomy', 'post' );
+        register_taxonomy( 'non_queryable_taxonomy', 'post', array( 'publicly_queryable' => false ) );
         register_taxonomy( 'private_taxonomy', 'post', array( 'public' => false ) );
 
         // Create test terms in the custom taxonomy.
-        $public_term  = self::factory()->term->create( array( 'taxonomy' => 'public_taxonomy' ) );
-        $private_term = self::factory()->term->create( array( 'taxonomy' => 'private_taxonomy' ) );
+        $public_term        = self::factory()->term->create( array( 'taxonomy' => 'public_taxonomy' ) );
+        $non_queryable_term = self::factory()->term->create( array( 'taxonomy' => 'non_queryable_taxonomy' ) );
+        $private_term       = self::factory()->term->create( array( 'taxonomy' => 'private_taxonomy' ) );
 
         // Create a test post applied to all test terms.
@@ -161 +187 @@
             array(
                 'tax_input' => array(
-                    'public_taxonomy'  => array( $public_term ),
-                    'private_taxonomy' => array( $private_term ),
+                    'public_taxonomy'        => array( $public_term ),
+                    'non_queryable_taxonomy' => array( $non_queryable_term ),
+                    'private_taxonomy'       => array( $private_term ),
                 ),
             )
@@ -172 +199 @@
         // Clean up.
         unregister_taxonomy_for_object_type( 'public_taxonomy', 'post' );
+        unregister_taxonomy_for_object_type( 'non_queryable_taxonomy', 'post' );
         unregister_taxonomy_for_object_type( 'private_taxonomy', 'post' );
 
         $this->assertContains( 'http://' . WP_TESTS_DOMAIN . '/?sitemap=taxonomies&sitemap-subtype=public_taxonomy&paged=1', $entries, 'Public Taxonomies are not in the index.' );
+        $this->assertNotContains( 'http://' . WP_TESTS_DOMAIN . '/?sitemap=taxonomies&sitemap-subtype=non_queryable_taxonomy&paged=1', $entries, 'Private Taxonomies are visible in the index.' );
         $this->assertNotContains( 'http://' . WP_TESTS_DOMAIN . '/?sitemap=taxonomies&sitemap-subtype=private_taxonomy&paged=1', $entries, 'Private Taxonomies are visible in the index.' );
     }

trunk/tests/phpunit/tests/sitemaps/sitemaps.php

@@ -193 +193 @@
 
     /**
+     * Test sitemap index entries with public and private custom post types.
+     *
+     * @ticket 50607
+     */
+    public function test_get_sitemap_entries_not_publicly_queryable_post_types() {
+        register_post_type(
+            'non_queryable_cpt',
+            array(
+                'public'             => true,
+                'publicly_queryable' => false,
+            )
+        );
+        self::factory()->post->create( array( 'post_type' => 'non_queryable_cpt' ) );
+
+        $entries = wp_list_pluck( $this->_get_sitemap_entries(), 'loc' );
+
+        // Clean up.
+        unregister_post_type( 'non_queryable_cpt' );
+
+        $this->assertNotContains( 'http://' . WP_TESTS_DOMAIN . '/?sitemap=posts&sitemap-subtype=non_queryable_cpt&paged=1', $entries, 'Non-publicly queryable CPTs are visible in the index.' );
+    }
+
+    /**
      * Tests getting a URL list for post type post.
      */
@@ -306 +329 @@
 
         $this->assertEmpty( $post_list, 'Private post types may be returned by the post provider.' );
+    }
+
+    /**
+     * Tests getting a URL list for a private custom post type.
+     *
+     * @ticket 50607
+     */
+    public function test_get_url_list_cpt_not_publicly_queryable() {
+        $post_type = 'non_queryable_cpt';
+
+        register_post_type(
+            $post_type,
+            array(
+                'public'             => true,
+                'publicly_queryable' => false,
+            )
+        );
+
+        self::factory()->post->create_many( 10, array( 'post_type' => $post_type ) );
+
+        $providers = wp_get_sitemaps();
+
+        $post_list = $providers['posts']->get_url_list( 1, $post_type );
+
+        // Clean up.
+        unregister_post_type( $post_type );
+
+        $this->assertEmpty( $post_list, 'Non-publicly queryable post types may be returned by the post provider.' );
     }