Changeset 49563 for trunk/src/wp-includes/link-template.php

Timestamp:

11/12/2020 04:14:44 AM (6 years ago)

Author:

peterwilsoncc

Message:

Canonical: Prevent ID enumeration of private post slugs.

Add check to redirect_canonical() to ensure the destination post is not using a private post status.

Props dd32, Denis-de-Bernardy, donmhico, helen, nacin, peterwilsoncc, pishmishy, TimothyBlynJacobs, tzafrir, Viper007Bond, whyisjake.
Fixes #5272.

File:

• trunk/src/wp-includes/link-template.php (modified) (1 diff)

trunk/src/wp-includes/link-template.php

@@ -419 +419 @@
         if ( $parent && ! in_array( $parent->post_type, get_post_types(), true ) ) {
                 $parent = false;
+        }
+
+        if ( $parent ) {
+                $parent_status_obj = get_post_status_object( get_post_status( $post->post_parent ) );
+                if (
+                        ! is_post_type_viewable( get_post_type( $post->post_parent ) ) ||
+                        $parent_status_obj->internal ||
+                        $parent_status_obj->protected
+                ) {
+                        $parent = false;
+                }
         }