Changeset 54569 for branches/4.9/src/wp-includes/post.php

Timestamp:

10/17/2022 06:11:47 PM (2 years ago)

Author:

SergeyBiryukov

Message:

Grouped backports to the 4.9 branch.

• Posts, Post types: Apply KSES to post-by-email content,
• General: Validate host on "Are you sure?" screen,
• Posts, Post types: Remove emails from post-by-email logs,
• Media: Refactor search by filename within the admin,
• Pings/trackbacks: Apply KSES to all trackbacks,
• Comments: Apply kses when editing comments,
• Customize: Escape blogname option in underscores templates,
• REST API: Lockdown post parameter of the terms endpoint,
• Mail: Reset PHPMailer properties between use,
• Query: Validate relation in WP_Date_Query,
• Widgets: Escape RSS error messages for display.

Merges [54521], [54522], [54523], [54524], [54525], [54526], [54527], [54528], [54529], [54530], [54541] to the 4.9 branch.
Props voldemortensen, johnbillion, paulkevan, peterwilsoncc, xknown, dd32, audrasjb, martinkrcho, vortfu, davidbaumwald, tykoted, timothyblynjacobs, johnjamesjacoby, ehtis, matveb, talldanwp.

Location:

branches/4.9

Files:

• . (modified) (1 prop)
• src/wp-includes/post.php (modified) (2 diffs)

branches/4.9/src/wp-includes/post.php

@@ -1706 +1706 @@
     }
 
-    return $post_type->publicly_queryable || ( $post_type->_builtin && $post_type->public );
+    if ( ! is_object( $post_type ) ) {
+        return false;
+    }
+
+    $is_viewable = $post_type->publicly_queryable || ( $post_type->_builtin && $post_type->public );
+
+    /**
+     * Filters whether a post type is considered "viewable".
+     *
+     * The returned filtered value must be a boolean type to ensure
+     * `is_post_type_viewable()` only returns a boolean. This strictness
+     * is by design to maintain backwards-compatibility and guard against
+     * potential type errors in PHP 8.1+. Non-boolean values (even falsey
+     * and truthy values) will result in the function returning false.
+     *
+     * @since 5.9.0
+     *
+     * @param bool         $is_viewable Whether the post type is "viewable" (strict type).
+     * @param WP_Post_Type $post_type   Post type object.
+     */
+    return true === apply_filters( 'is_post_type_viewable', $is_viewable, $post_type );
+}
+
+/**
+ * Determines whether a post status is considered "viewable".
+ *
+ * For built-in post statuses such as publish and private, the 'public' value will be evaluated.
+ * For all others, the 'publicly_queryable' value will be used.
+ *
+ * @since 5.7.0
+ * @since 5.9.0 Added `is_post_status_viewable` hook to filter the result.
+ *
+ * @param string|stdClass $post_status Post status name or object.
+ * @return bool Whether the post status should be considered viewable.
+ */
+function is_post_status_viewable( $post_status ) {
+    if ( is_scalar( $post_status ) ) {
+        $post_status = get_post_status_object( $post_status );
+
+        if ( ! $post_status ) {
+            return false;
+        }
+    }
+
+    if (
+        ! is_object( $post_status ) ||
+        $post_status->internal ||
+        $post_status->protected
+    ) {
+        return false;
+    }
+
+    $is_viewable = $post_status->publicly_queryable || ( $post_status->_builtin && $post_status->public );
+
+    /**
+     * Filters whether a post status is considered "viewable".
+     *
+     * The returned filtered value must be a boolean type to ensure
+     * `is_post_status_viewable()` only returns a boolean. This strictness
+     * is by design to maintain backwards-compatibility and guard against
+     * potential type errors in PHP 8.1+. Non-boolean values (even falsey
+     * and truthy values) will result in the function returning false.
+     *
+     * @since 5.9.0
+     *
+     * @param bool     $is_viewable Whether the post status is "viewable" (strict type).
+     * @param stdClass $post_status Post status object.
+     */
+    return true === apply_filters( 'is_post_status_viewable', $is_viewable, $post_status );
+}
+
+/**
+ * Determines whether a post is publicly viewable.
+ *
+ * Posts are considered publicly viewable if both the post status and post type
+ * are viewable.
+ *
+ * @since 5.7.0
+ *
+ * @param int|WP_Post|null $post Optional. Post ID or post object. Defaults to global $post.
+ * @return bool Whether the post is publicly viewable.
+ */
+function is_post_publicly_viewable( $post = null ) {
+    $post = get_post( $post );
+
+    if ( ! $post ) {
+        return false;
+    }
+
+    $post_type   = get_post_type( $post );
+    $post_status = get_post_status( $post );
+
+    return is_post_type_viewable( $post_type ) && is_post_status_viewable( $post_status );
 }
 
@@ -6456 +6548 @@
     return $post_name;
 }
-
-/**
- * Filter the SQL clauses of an attachment query to include filenames.
- *
- * @since 4.7.0
- * @access private
- *
- * @global wpdb $wpdb WordPress database abstraction object.
- *
- * @param array $clauses An array including WHERE, GROUP BY, JOIN, ORDER BY,
- *                       DISTINCT, fields (SELECT), and LIMITS clauses.
- * @return array The modified clauses.
- */
-function _filter_query_attachment_filenames( $clauses ) {
-    global $wpdb;
-    remove_filter( 'posts_clauses', __FUNCTION__ );
-
-    // Add a LEFT JOIN of the postmeta table so we don't trample existing JOINs.
-    $clauses['join'] .= " LEFT JOIN {$wpdb->postmeta} AS sq1 ON ( {$wpdb->posts}.ID = sq1.post_id AND sq1.meta_key = '_wp_attached_file' )";
-
-    $clauses['groupby'] = "{$wpdb->posts}.ID";
-
-    $clauses['where'] = preg_replace(
-        "/\({$wpdb->posts}.post_content (NOT LIKE|LIKE) (\'[^']+\')\)/",
-        "$0 OR ( sq1.meta_value $1 $2 )",
-        $clauses['where'] );
-
-    return $clauses;
-}