Changeset 49830

Timestamp:

12/17/2020 04:15:38 PM (4 years ago)

Author:

boonebgorges

Message:

Query: Respect post-type specific capabilities when querying for multiple post types.

After this change, the relevant read_private_posts capability is checked for
each queried post type. This ensures that private posts appear in search and
archive queries for users who have the ability to view those posts.

Props leogermani.

Fixes #13509, #48968, #48556.

Location:

trunk

Files:

• src/wp-includes/class-wp-query.php (modified) (3 diffs)
• tests/phpunit/tests/query/postStatus.php (modified) (3 diffs)

trunk/src/wp-includes/class-wp-query.php

@@ -2421 +2421 @@
         }
 
+        $has_valid_post_types = true;
         if ( 'any' === $post_type ) {
             $in_search_post_types = get_post_types( array( 'exclude_from_search' => false ) );
             if ( empty( $in_search_post_types ) ) {
-                $where .= ' AND 1=0 ';
+                $post_type_where      = ' AND 1=0 ';
+                $has_valid_post_types = true;
             } else {
-                $where .= " AND {$wpdb->posts}.post_type IN ('" . implode( "', '", array_map( 'esc_sql', $in_search_post_types ) ) . "')";
+                $post_type_where = " AND {$wpdb->posts}.post_type IN ('" . implode( "', '", array_map( 'esc_sql', $in_search_post_types ) ) . "')";
             }
         } elseif ( ! empty( $post_type ) && is_array( $post_type ) ) {
-            $where .= " AND {$wpdb->posts}.post_type IN ('" . implode( "', '", esc_sql( $post_type ) ) . "')";
+            $post_type_where = " AND {$wpdb->posts}.post_type IN ('" . implode( "', '", esc_sql( $post_type ) ) . "')";
         } elseif ( ! empty( $post_type ) ) {
-            $where           .= $wpdb->prepare( " AND {$wpdb->posts}.post_type = %s", $post_type );
+            $post_type_where  = $wpdb->prepare( " AND {$wpdb->posts}.post_type = %s", $post_type );
             $post_type_object = get_post_type_object( $post_type );
         } elseif ( $this->is_attachment ) {
-            $where           .= " AND {$wpdb->posts}.post_type = 'attachment'";
+            $post_type_where  = " AND {$wpdb->posts}.post_type = 'attachment'";
             $post_type_object = get_post_type_object( 'attachment' );
         } elseif ( $this->is_page ) {
-            $where           .= " AND {$wpdb->posts}.post_type = 'page'";
+            $post_type_where  = " AND {$wpdb->posts}.post_type = 'page'";
             $post_type_object = get_post_type_object( 'page' );
         } else {
-            $where           .= " AND {$wpdb->posts}.post_type = 'post'";
+            $post_type_where  = " AND {$wpdb->posts}.post_type = 'post'";
             $post_type_object = get_post_type_object( 'post' );
         }
@@ -2458 +2460 @@
 
         $q_status = array();
-        if ( ! empty( $q['post_status'] ) ) {
+
+        if ( ! $has_valid_post_types ) {
+            // When there are no public post types, there's no need to assemble the post_status clause.
+            $where .= $post_type_where;
+        } elseif ( ! empty( $q['post_status'] ) ) {
+            $where .= $post_type_where;
+
             $statuswheres = array();
             $q_status     = $q['post_status'];
@@ -2517 +2525 @@
                 $where .= " AND ($where_status)";
             }
+
         } elseif ( ! $this->is_singular ) {
-            $where .= " AND ({$wpdb->posts}.post_status = 'publish'";
-
-            // Add public states.
-            $public_states = get_post_stati( array( 'public' => true ) );
-            foreach ( (array) $public_states as $state ) {
-                if ( 'publish' === $state ) { // Publish is hard-coded above.
-                    continue;
-                }
-                $where .= " OR {$wpdb->posts}.post_status = '$state'";
-            }
-
-            if ( $this->is_admin ) {
-                // Add protected states that should show in the admin all list.
-                $admin_all_states = get_post_stati(
-                    array(
-                        'protected'              => true,
-                        'show_in_admin_all_list' => true,
-                    )
-                );
-                foreach ( (array) $admin_all_states as $state ) {
-                    $where .= " OR {$wpdb->posts}.post_status = '$state'";
-                }
-            }
-
-            if ( is_user_logged_in() ) {
-                // Add private states that are limited to viewing by the author of a post or someone who has caps to read private states.
-                $private_states = get_post_stati( array( 'private' => true ) );
-                foreach ( (array) $private_states as $state ) {
-                    $where .= current_user_can( $read_private_cap ) ? " OR {$wpdb->posts}.post_status = '$state'" : " OR {$wpdb->posts}.post_author = $user_id AND {$wpdb->posts}.post_status = '$state'";
-                }
-            }
-
-            $where .= ')';
+            if ( 'any' === $post_type ) {
+                $queried_post_types = get_post_types( array( 'exclude_from_search' => false ) );
+            } elseif ( is_array( $post_type ) ) {
+                $queried_post_types = $post_type;
+            } elseif ( ! empty( $post_type ) ) {
+                $queried_post_types = array( $post_type );
+            } else {
+                $queried_post_types = array( 'post' );
+            }
+
+            if ( ! empty( $queried_post_types ) ) {
+                $status_type_clauses = array();
+
+                // Assemble a post_status clause for each post type.
+                foreach ( $queried_post_types as $queried_post_type ) {
+                    $queried_post_type_object = get_post_type_object( $queried_post_type );
+                    if ( ! $queried_post_type_object instanceof \WP_Post_Type ) {
+                        continue;
+                    }
+
+                    $type_where = '(' . $wpdb->prepare( "{$wpdb->posts}.post_type = %s AND (", $queried_post_type );
+
+                    // Public statuses.
+                    $public_statuses = get_post_stati( array( 'public' => true ) );
+                    $status_clauses  = [];
+                    foreach ( (array) $public_statuses as $public_status ) {
+                        $status_clauses[] = "{$wpdb->posts}.post_status = '$public_status'";
+                    }
+                    $type_where .= implode( ' OR ', $status_clauses );
+
+                    // Add protected states that should show in the admin all list.
+                    if ( $this->is_admin ) {
+                        $admin_all_statuses = get_post_stati(
+                            array(
+                                'protected'              => true,
+                                'show_in_admin_all_list' => true,
+                            )
+                        );
+                        foreach ( (array) $admin_all_statuses as $admin_all_status ) {
+                            $type_where .= " OR {$wpdb->posts}.post_status = '$admin_all_status'";
+                        }
+                    }
+
+                    // Add private states that are visible to current user.
+                    if ( is_user_logged_in() ) {
+                        $read_private_cap = $queried_post_type_object->cap->read_private_posts;
+                        $private_statuses = get_post_stati( array( 'private' => true ) );
+                        foreach ( (array) $private_statuses as $private_status ) {
+                            $type_where .= current_user_can( $read_private_cap ) ? " OR {$wpdb->posts}.post_status = '$private_status'" : " OR ({$wpdb->posts}.post_author = $user_id AND {$wpdb->posts}.post_status = '$private_status')";
+                        }
+                    }
+
+                    $type_where .= '))';
+
+                    $status_type_clauses[] = $type_where;
+                }
+
+                if ( ! empty( $status_type_clauses ) ) {
+                    $where .= ' AND (' . implode( ' OR ', $status_type_clauses ) . ')';
+                }
+            } else {
+                $where .= ' AND 1=0 ';
+            }
+
+        } else {
+            $where .= $post_type_where;
         }
 

trunk/tests/phpunit/tests/query/postStatus.php

@@ -7 +7 @@
     public static $editor_user_id;
     public static $author_user_id;
+    public static $subscriber_user_id;
     public static $editor_private_post;
     public static $author_private_post;
@@ -13 +14 @@
 
     public static function wpSetUpBeforeClass( WP_UnitTest_Factory $factory ) {
-        self::$editor_user_id = $factory->user->create( array( 'role' => 'editor' ) );
-        self::$author_user_id = $factory->user->create( array( 'role' => 'author' ) );
+        self::$editor_user_id     = $factory->user->create( array( 'role' => 'editor' ) );
+        self::$author_user_id     = $factory->user->create( array( 'role' => 'author' ) );
+        self::$subscriber_user_id = $factory->user->create( array( 'role' => 'subscriber' ) );
 
         self::$editor_private_post = $factory->post->create(
@@ -458 +460 @@
         $this->assertContains( $p1, wp_list_pluck( $q->posts, 'ID' ) );
     }
+
+    /**
+     * @ticket 48556
+     * @ticket 13509
+     */
+    public function test_non_singular_queries_using_post_type_any_should_respect_post_type_read_private_posts_cap() {
+        register_post_type(
+            'wptests_pt1',
+            array(
+                'exclude_from_search' => false,
+                'capabilities'        => [
+                    'read_private_posts' => 'read_private_pt1s',
+                ],
+            )
+        );
+
+        register_post_type(
+            'wptests_pt2',
+            array(
+                'exclude_from_search' => false,
+            )
+        );
+
+        $post_ids = array();
+
+        $post_ids['wptests_pt1_p1'] = $this->factory->post->create(
+            array(
+                'post_type'   => 'wptests_pt1',
+                'post_status' => 'private',
+                'post_author' => self::$editor_user_id,
+            )
+        );
+
+        $post_ids['wptests_pt1_p2'] = $this->factory->post->create(
+            array(
+                'post_type'   => 'wptests_pt1',
+                'post_status' => 'publish',
+                'post_author' => self::$editor_user_id,
+            )
+        );
+
+        $post_ids['wptests_pt2_p1'] = $this->factory->post->create(
+            array(
+                'post_type'   => 'wptests_pt2',
+                'post_status' => 'private',
+                'post_author' => self::$editor_user_id,
+            )
+        );
+
+        $post_ids['wptests_pt2_p2'] = $this->factory->post->create(
+            array(
+                'post_type'   => 'wptests_pt2',
+                'post_status' => 'publish',
+                'post_author' => self::$editor_user_id,
+            )
+        );
+
+        wp_set_current_user( 0 );
+
+        $q = new WP_Query(
+            array(
+                'post_type' => 'any',
+            )
+        );
+
+        $this->assertSameSets( array( $post_ids['wptests_pt1_p2'], $post_ids['wptests_pt2_p2'] ), wp_list_pluck( $q->posts, 'ID' ) );
+
+        wp_set_current_user( self::$subscriber_user_id );
+        $GLOBALS['current_user']->add_cap( 'read_private_pt1s' );
+
+        $q = new WP_Query(
+            array(
+                'post_type' => 'any',
+            )
+        );
+
+        $this->assertSameSets( array( $post_ids['wptests_pt1_p1'], $post_ids['wptests_pt1_p2'], $post_ids['wptests_pt2_p2'] ), wp_list_pluck( $q->posts, 'ID' ) );
+    }
+
+    /**
+     * @ticket 48556
+     * @ticket 13509
+     */
+    public function test_non_singular_queries_using_multiple_post_type_should_respect_post_type_read_private_posts_cap() {
+        wp_set_current_user( 0 );
+
+        register_post_type(
+            'wptests_pt1',
+            array(
+                'exclude_from_search' => false,
+                'capabilities'        => [
+                    'read_private_posts' => 'read_private_pt1s',
+                ],
+            )
+        );
+
+        register_post_type(
+            'wptests_pt2',
+            array(
+                'exclude_from_search' => false,
+            )
+        );
+
+        $post_ids = array();
+
+        $post_ids['wptests_pt1_p1'] = $this->factory->post->create(
+            array(
+                'post_type'   => 'wptests_pt1',
+                'post_status' => 'private',
+                'post_author' => self::$editor_user_id,
+            )
+        );
+
+        $post_ids['wptests_pt1_p2'] = $this->factory->post->create(
+            array(
+                'post_type'   => 'wptests_pt1',
+                'post_status' => 'publish',
+                'post_author' => self::$editor_user_id,
+            )
+        );
+
+        $post_ids['wptests_pt2_p1'] = $this->factory->post->create(
+            array(
+                'post_type'   => 'wptests_pt2',
+                'post_status' => 'private',
+                'post_author' => self::$editor_user_id,
+            )
+        );
+
+        $post_ids['wptests_pt2_p2'] = $this->factory->post->create(
+            array(
+                'post_type'   => 'wptests_pt2',
+                'post_status' => 'publish',
+                'post_author' => self::$editor_user_id,
+            )
+        );
+
+        $q = new WP_Query(
+            array(
+                'post_type' => 'any',
+            )
+        );
+
+        $this->assertSameSets( array( $post_ids['wptests_pt1_p2'], $post_ids['wptests_pt2_p2'] ), wp_list_pluck( $q->posts, 'ID' ) );
+
+        $u = $this->factory->user->create();
+
+        wp_set_current_user( self::$subscriber_user_id );
+        $GLOBALS['current_user']->add_cap( 'read_private_pt1s' );
+
+        $q = new WP_Query(
+            array(
+                'post_type' => [ 'wptests_pt1', 'wptests_pt2' ],
+            )
+        );
+
+        $this->assertSameSets( array( $post_ids['wptests_pt1_p1'], $post_ids['wptests_pt1_p2'], $post_ids['wptests_pt2_p2'] ), wp_list_pluck( $q->posts, 'ID' ) );
+    }
 }