Changeset 63100 for branches/6.0/src/wp-includes/canonical.php

Timestamp:

08/06/2026 07:38:52 PM (2 months ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.0.3 security fixes to the 5.9 branch.

• Users: Ensure a proper email address is used before sending email confirmations.
• Formatting: Prevent stack overflow in safecss_filter_attr.
• Multisite: Enforce the active signup policy for existing users.
• HTTP API: Improve compliance with IPv4 Special-Purpose Address Space.
• Users: Prevent Usernames from mangling HTML
• Canonical: Only redirect for publicly viewable post types.
• Administration: When wp_is_large_user_count(), ensure that the post author is always added to author dropdown.
• Editor: Fix output for post date.

Merges [63060],[63061],[63062],[63063],[63064],[63065],[63067] to the 5.9 branch.

Props xknown, westonruter, jeremyfelt, peterwilsoncc, paulkevan, lucasbustamante, jorbin, desrosj, vortfu, dmsnell, johnbillion, ehtis, batmoo, lancewillett, jonsurrell, isabel_brison, bernhard-reiter, tyxla, aduth.

File:

• branches/6.0/src/wp-includes/canonical.php (modified) (2 diffs)

branches/6.0/src/wp-includes/canonical.php

@@ -919 +919 @@
 
         if ( get_query_var( 'name' ) ) {
+                $publicly_viewable_post_types = array_filter( get_post_types( array( 'exclude_from_search' => false ) ), 'is_post_type_viewable' );
+
                 /**
                  * Filters whether to perform a strict guess for a 404 redirect.
@@ -939 +941 @@
                 if ( get_query_var( 'post_type' ) ) {
                         if ( is_array( get_query_var( 'post_type' ) ) ) {
-                                // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare
-                                $where .= " AND post_type IN ('" . join( "', '", esc_sql( get_query_var( 'post_type' ) ) ) . "')";
+                                $post_types = array_intersect( get_query_var( 'post_type' ), $publicly_viewable_post_types );
+                                if ( empty( $post_types ) ) {
+                                        return false;
+                                }
+                                $where .= " AND post_type IN ('" . implode( "', '", esc_sql( $post_types ) ) . "')";
                         } else {
+                                if ( ! in_array( get_query_var( 'post_type' ), $publicly_viewable_post_types, true ) ) {
+                                        return false;
+                                }
                                 $where .= $wpdb->prepare( ' AND post_type = %s', get_query_var( 'post_type' ) );
                         }
                 } else {
-                        $where .= " AND post_type IN ('" . implode( "', '", get_post_types( array( 'public' => true ) ) ) . "')";
+                        $where .= " AND post_type IN ('" . implode( "', '", esc_sql( $publicly_viewable_post_types ) ) . "')";
                 }