Changeset 63915

Timestamp:

09/24/2026 12:26:10 PM (5 hours ago)

Author:

zieladam

Message:

Query: Prefer published pages in path lookups.

A draft and a published page can share the same path. With no SQL result order, get_page_by_path() could return the draft and cause a 404 for the published page.

Order candidates with publish first, other statuses next, and draft, pending, and auto-draft last. Use the lowest ID to break ties within each group.

When $post_type is an array, return the first full-path match instead of the last so the SQL order is respected. Keep the existing preference for the requested post type over attachments when $post_type is a string.

Add regression tests for string and array post type arguments.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/13655

Props brookedot, trepmal, SirLouen, sahilgidwani, rdelbem, vijendrajat, jonsurrell.
Fixes #61996.

Location:

trunk

Files:

• src/wp-includes/post.php (modified) (2 diffs)
• tests/phpunit/tests/post/getPageByPath.php (modified) (1 diff)

trunk/src/wp-includes/post.php

@@ -6392 +6392 @@
                 WHERE post_name IN ($in_string)
                 AND post_type IN ($post_type_in_string)
+                ORDER BY
+                        post_status = 'publish' DESC,
+                        post_status IN ('draft', 'pending', 'auto-draft') ASC, ID ASC
         ";
 
@@ -6423 +6426 @@
                         ) {
                                 $found_id = $page->ID;
-                                if ( $page->post_type === $post_type ) {
+
+                                /*
+                                 * A string like 'page' also searches attachments: /about/photo/ could be
+                                 * a child page or an attachment page, and this lookup handles both.
+                                 * Keep an attachment as a fallback, but keep looking for the requested
+                                 * type so an attachment cannot hide a page with the same path.
+                                 *
+                                 * An array is the exact list of types to search; no extra types are added.
+                                 * SQL already checks that list, so stop at the first full-path match.
+                                 */
+                                if ( is_array( $post_type ) || $page->post_type === $post_type ) {
                                         break;
                                 }

trunk/tests/phpunit/tests/post/getPageByPath.php

@@ -56 +56 @@
 
                 $this->assertSame( $page, $found->ID );
+        }
+
+        /**
+         * @ticket 61996
+         * @covers ::get_page_by_path
+         *
+         * @dataProvider data_page_post_types
+         *
+         * @param string|string[] $post_type Post type argument.
+         */
+        public function test_should_prefer_published_page_then_lowest_id( $post_type ) {
+                // Setting a pending page's slug requires publish permission.
+                wp_set_current_user( self::factory()->user->create( array( 'role' => 'administrator' ) ) );
+
+                $draft     = self::factory()->post->create(
+                        array(
+                                'post_type'   => 'page',
+                                'post_status' => 'draft',
+                        )
+                );
+                $pending   = self::factory()->post->create(
+                        array(
+                                'post_type'   => 'page',
+                                'post_status' => 'pending',
+                        )
+                );
+                $published = self::factory()->post->create(
+                        array(
+                                'post_type'   => 'page',
+                                'post_status' => 'publish',
+                                'post_name'   => 'privacy-policy',
+                        )
+                );
+
+                // Draft and pending slug updates can reuse a published page's slug.
+                foreach ( array( $draft, $pending ) as $post_id ) {
+                        wp_update_post(
+                                array(
+                                        'ID'        => $post_id,
+                                        'post_name' => 'privacy-policy',
+                                )
+                        );
+                        $this->assertSame( 'privacy-policy', get_post( $post_id )->post_name );
+                }
+
+                $this->assertSame( $published, get_page_by_path( 'privacy-policy', OBJECT, $post_type )->ID );
+
+                // Draft and pending pages have the same priority, so the lowest ID wins.
+                wp_delete_post( $published, true );
+                $this->assertSame( $draft, get_page_by_path( 'privacy-policy', OBJECT, $post_type )->ID );
+
+                wp_delete_post( $draft, true );
+                $this->assertSame( $pending, get_page_by_path( 'privacy-policy', OBJECT, $post_type )->ID );
+        }
+
+        /**
+         * Data provider.
+         *
+         * @return array<string, array<string|string[]>> {
+         */
+        public function data_page_post_types(): array {
+                return array(
+                        'string'             => array( 'page' ),
+                        'array of one type'  => array( array( 'page' ) ),
+                        'array of two types' => array( array( 'page', 'post' ) ),
+                );
         }