Changeset 57645

Timestamp:

02/16/2024 11:32:48 PM (10 months ago)

Author:

peterwilsoncc

Message:

Canonical: Limit post types searched by redirect_guess_404_permalink().

Limit the post types searched in redirect_guess_404_permalink() to public, searchable post types. This prevents redirects to 404 pages and the exposure of private post type slugs.

Props francescocarlucci, peterwilsoncc, rajinsharwar.
Fixes #59795.

Location:

trunk

Files:

• src/wp-includes/canonical.php (modified) (3 diffs)
• tests/phpunit/tests/canonical.php (modified) (2 diffs)

trunk/src/wp-includes/canonical.php

@@ -950 +950 @@
 
     if ( get_query_var( 'name' ) ) {
+        $publicly_viewable_statuses   = array_filter( get_post_stati(), 'is_post_status_viewable' );
+        $publicly_viewable_post_types = array_filter( get_post_types( array( 'exclude_from_search' => false ) ), 'is_post_type_viewable' );
+
         /**
          * Filters whether to perform a strict guess for a 404 redirect.
@@ -970 +973 @@
         if ( get_query_var( 'post_type' ) ) {
             if ( is_array( get_query_var( 'post_type' ) ) ) {
+                $post_types = array_intersect( get_query_var( 'post_type' ), $publicly_viewable_post_types );
+                if ( empty( $post_types ) ) {
+                    return false;
+                }
                 $where .= " AND post_type IN ('" . join( "', '", esc_sql( get_query_var( 'post_type' ) ) ) . "')";
             } else {
+                if ( ! in_array( get_query_var( 'post_type' ), $publicly_viewable_post_types, true ) ) {
+                    return false;
+                }
                 $where .= $wpdb->prepare( ' AND post_type = %s', get_query_var( 'post_type' ) );
             }
         } else {
-            $where .= " AND post_type IN ('" . implode( "', '", get_post_types( array( 'public' => true ) ) ) . "')";
+            $where .= " AND post_type IN ('" . implode( "', '", esc_sql( $publicly_viewable_post_types ) ) . "')";
         }
 
@@ -988 +998 @@
         }
 
-        $publicly_viewable_statuses = array_filter( get_post_stati(), 'is_post_status_viewable' );
         // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
         $post_id = $wpdb->get_var( "SELECT ID FROM $wpdb->posts WHERE $where AND post_status IN ('" . implode( "', '", esc_sql( $publicly_viewable_statuses ) ) . "')" );

trunk/tests/phpunit/tests/canonical.php

@@ -11 +11 @@
 class Tests_Canonical extends WP_Canonical_UnitTestCase {
 
+    public static $private_cpt_post;
+
+    public static function wpSetUpBeforeClass( WP_UnitTest_Factory $factory ) {
+        // Set up fixtures in WP_Canonical_UnitTestCase.
+        parent::wpSetUpBeforeClass( $factory );
+
+        self::set_up_custom_post_types();
+        self::$private_cpt_post = $factory->post->create(
+            array(
+                'post_type'  => 'wp_tests_private',
+                'post_title' => 'private-cpt-post',
+            )
+        );
+    }
+
     public function set_up() {
         parent::set_up();
         wp_set_current_user( self::$author_id );
+        self::set_up_custom_post_types();
 
         update_option( 'wp_attachment_pages_enabled', 1 );
+    }
+
+    /**
+     * Register custom post type for tests.
+     *
+     * Register non publicly queryable post type with public set to true.
+     *
+     * These arguments are intentionally contradictory for the test associated
+     * with ticket #59795.
+     */
+    public static function set_up_custom_post_types() {
+        register_post_type(
+            'wp_tests_private',
+            array(
+                'public'             => true,
+                'publicly_queryable' => false,
+            )
+        );
     }
 
@@ -344 +378 @@
      *
      * @ticket 43056
-     */
-    public function test_redirect_guess_404_permalink_post_types() {
-        /*
-         * Sample-page is intentionally missspelt as sample-pag to ensure
-         * the 404 post permalink guessing runs.
-         *
-         * Please do not correct the apparent typo.
-         */
-
-        // String format post type.
-        $this->assertCanonical( '/?name=sample-pag&post_type=page', '/sample-page/' );
-        // Array formatted post type or types.
-        $this->assertCanonical( '/?name=sample-pag&post_type[]=page', '/sample-page/' );
-        $this->assertCanonical( '/?name=sample-pag&post_type[]=page&post_type[]=post', '/sample-page/' );
+     * @ticket 59795
+     *
+     * @dataProvider data_redirect_guess_404_permalink_post_types
+     */
+    public function test_redirect_guess_404_permalink_post_types( $original_url, $expected ) {
+        $this->assertCanonical( $original_url, $expected );
+    }
+
+    /**
+     * Data provider for test_redirect_guess_404_permalink_post_types().
+     *
+     * In the original URLs the post names are intentionally misspelled
+     * to test the redirection.
+     *
+     * Please do not correct the apparent typos.
+     *
+     * @return array[]
+     */
+    public function data_redirect_guess_404_permalink_post_types() {
+        return array(
+            'single string formatted post type'    => array(
+                'original_url' => '/?name=sample-pag&post_type=page',
+                'expected'     => '/sample-page/',
+            ),
+            'single array formatted post type'     => array(
+                'original_url' => '/?name=sample-pag&post_type[]=page',
+                'expected'     => '/sample-page/',
+            ),
+            'multiple array formatted post type'   => array(
+                'original_url' => '/?name=sample-pag&post_type[]=page&post_type[]=post',
+                'expected'     => '/sample-page/',
+            ),
+            'do not redirect to private post type' => array(
+                'original_url' => '/?name=private-cpt-po&post_type[]=wp_tests_private',
+                'expected'     => '/?name=private-cpt-po&post_type[]=wp_tests_private',
+            ),
+        );
     }