Changeset 50132 for trunk/src/wp-includes/canonical.php

Timestamp:

02/02/2021 12:38:40 AM (5 years ago)

Author:

peterwilsoncc

Message:

Canonical: Prevent ID enumeration of private post slugs.

Add check to redirect_canonical() to ensure private posts only redirect for logged in users.

Modifies the read_post mata capability to user get_post_status() rather than the post's post_status property to allow attachments to redirect based on the inherited post status.

Introduces wp_force_ugly_post_permalink() to unify the check to determine if an ugly link should be displayed in each of the functions used for determining permalinks: get_permalink(), get_post_permalink(), _get_page_link() and get_attachment_link().

Improves logic of get_attachment_link() to validate parent post and resolution of inherited post status. This is an incomplete fix of #52373 to prevent the function returning links resulting in a file not found error. Required to unblock this ticket.

Props peterwilsoncc, TimothyBlynJacobs.
See #52373.
Fixes #5272.

File:

• trunk/src/wp-includes/canonical.php (modified) (14 diffs)

trunk/src/wp-includes/canonical.php

@@ -78 +78 @@
         $redirect     = $original;
         $redirect_url = false;
+        $redirect_obj = false;
 
         // Notice fixing.
@@ -103 +104 @@
         if ( is_feed() && $post_id ) {
                 $redirect_url = get_post_comments_feed_link( $post_id, get_query_var( 'feed' ) );
+                $redirect_obj = get_post( $post_id );
 
                 if ( $redirect_url ) {
@@ -127 +129 @@
 
                         $redirect_url = get_permalink( $post_id );
+                        $redirect_obj = get_post( $post_id );
 
                         if ( $redirect_url ) {
@@ -151 +154 @@
                         if ( $post_type_obj && $post_type_obj->public && 'auto-draft' !== $redirect_post->post_status ) {
                                 $redirect_url = get_permalink( $redirect_post );
+                                $redirect_obj = get_post( $redirect_post );
 
                                 $redirect['query'] = _remove_qs_args_if_not_in_url(
@@ -198 +202 @@
                         if ( $post_id ) {
                                 $redirect_url = get_permalink( $post_id );
+                                $redirect_obj = get_post( $post_id );
 
                                 $redirect['path']  = rtrim( $redirect['path'], (int) get_query_var( 'page' ) . '/' );
@@ -224 +229 @@
                         if ( ! empty( $_GET['attachment_id'] ) ) {
                                 $redirect_url = get_attachment_link( get_query_var( 'attachment_id' ) );
+                                $redirect_obj = get_post( get_query_var( 'attachment_id' ) );
 
                                 if ( $redirect_url ) {
@@ -230 +236 @@
                         } else {
                                 $redirect_url = get_attachment_link();
+                                $redirect_obj = get_post();
                         }
                 } elseif ( is_single() && ! empty( $_GET['p'] ) && ! $redirect_url ) {
                         $redirect_url = get_permalink( get_query_var( 'p' ) );
+                        $redirect_obj = get_post( get_query_var( 'p' ) );
 
                         if ( $redirect_url ) {
@@ -239 +247 @@
                 } elseif ( is_single() && ! empty( $_GET['name'] ) && ! $redirect_url ) {
                         $redirect_url = get_permalink( $wp_query->get_queried_object_id() );
+                        $redirect_obj = get_post( $wp_query->get_queried_object_id() );
 
                         if ( $redirect_url ) {
@@ -245 +254 @@
                 } elseif ( is_page() && ! empty( $_GET['page_id'] ) && ! $redirect_url ) {
                         $redirect_url = get_permalink( get_query_var( 'page_id' ) );
+                        $redirect_obj = get_post( get_query_var( 'page_id' ) );
 
                         if ( $redirect_url ) {
@@ -257 +267 @@
                 ) {
                         $redirect_url = get_permalink( get_option( 'page_for_posts' ) );
+                        $redirect_obj = get_post( get_option( 'page_for_posts' ) );
 
                         if ( $redirect_url ) {
@@ -311 +322 @@
                         ) {
                                 $redirect_url = get_author_posts_url( $author->ID, $author->user_nicename );
+                                $redirect_obj = $author;
 
                                 if ( $redirect_url ) {
@@ -386 +398 @@
                                 ) {
                                         $redirect_url = get_permalink( $wp_query->get_queried_object_id() );
+                                        $redirect_obj = get_post( $wp_query->get_queried_object_id() );
                                 }
                         }
@@ -396 +409 @@
                         if ( ! $redirect_url ) {
                                 $redirect_url = get_permalink( get_queried_object_id() );
+                                $redirect_obj = get_post( get_queried_object_id() );
                         }
 
@@ -741 +755 @@
         }
 
+        if ( $redirect_obj instanceof WP_Post ) {
+                $post_status_obj = get_post_status_object( get_post_status( $redirect_obj ) );
+                /*
+                 * Unset the redirect object and URL if they are not readable by the user.
+                 * This condition is a little confusing as the condition needs to pass if
+                 * the post is not readable by the user. That's why there are ! (not) conditions
+                 * throughout.
+                 */
+                if (
+                        // Private post statuses only redirect if the user can read them.
+                        ! (
+                                $post_status_obj->private &&
+                                current_user_can( 'read_post', $redirect_obj->ID )
+                        ) &&
+                        // For other posts, only redirect if publicly viewable.
+                        ! is_post_publicly_viewable( $redirect_obj )
+                ) {
+                        $redirect_obj = false;
+                        $redirect_url = false;
+                }
+        }
+
         /**
          * Filters the canonical redirect URL.