Changeset 57645 for trunk/src/wp-includes/canonical.php

Timestamp:

02/16/2024 11:32:48 PM (3 years ago)

Author:

peterwilsoncc

Message:

Canonical: Limit post types searched by redirect_guess_404_permalink().

Limit the post types searched in redirect_guess_404_permalink() to public, searchable post types. This prevents redirects to 404 pages and the exposure of private post type slugs.

Props francescocarlucci, peterwilsoncc, rajinsharwar.
Fixes #59795.

File:

• trunk/src/wp-includes/canonical.php (modified) (3 diffs)

trunk/src/wp-includes/canonical.php

@@ -950 +950 @@
 
         if ( get_query_var( 'name' ) ) {
+                $publicly_viewable_statuses   = array_filter( get_post_stati(), 'is_post_status_viewable' );
+                $publicly_viewable_post_types = array_filter( get_post_types( array( 'exclude_from_search' => false ) ), 'is_post_type_viewable' );
+
                 /**
                  * Filters whether to perform a strict guess for a 404 redirect.
@@ -970 +973 @@
                 if ( get_query_var( 'post_type' ) ) {
                         if ( is_array( get_query_var( 'post_type' ) ) ) {
+                                $post_types = array_intersect( get_query_var( 'post_type' ), $publicly_viewable_post_types );
+                                if ( empty( $post_types ) ) {
+                                        return false;
+                                }
                                 $where .= " AND post_type IN ('" . join( "', '", esc_sql( get_query_var( 'post_type' ) ) ) . "')";
                         } else {
+                                if ( ! in_array( get_query_var( 'post_type' ), $publicly_viewable_post_types, true ) ) {
+                                        return false;
+                                }
                                 $where .= $wpdb->prepare( ' AND post_type = %s', get_query_var( 'post_type' ) );
                         }
                 } else {
-                        $where .= " AND post_type IN ('" . implode( "', '", get_post_types( array( 'public' => true ) ) ) . "')";
+                        $where .= " AND post_type IN ('" . implode( "', '", esc_sql( $publicly_viewable_post_types ) ) . "')";
                 }
 
@@ -988 +998 @@
                 }
 
-                $publicly_viewable_statuses = array_filter( get_post_stati(), 'is_post_status_viewable' );
                 // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
                 $post_id = $wpdb->get_var( "SELECT ID FROM $wpdb->posts WHERE $where AND post_status IN ('" . implode( "', '", esc_sql( $publicly_viewable_statuses ) ) . "')" );