Index: src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php
===================================================================
--- src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php	(revision 39150)
+++ src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php	(working copy)
@@ -814,26 +814,7 @@
 	 * @param WP_REST_Request $request       Optional. Full details about the request.
 	 * @return array Items query arguments.
 	 */
-	protected function prepare_items_query( $prepared_args = array(), $request = null ) {
-
-		$valid_vars = array_flip( $this->get_allowed_query_vars( $request ) );
-		$query_args = array();
-
-		foreach ( $valid_vars as $var => $index ) {
-			if ( isset( $prepared_args[ $var ] ) ) {
-				/**
-				 * Filters the query_vars used in get_items() for the constructed query.
-				 *
-				 * The dynamic portion of the hook name, `$var`, refers to the query_var key.
-				 *
-				 * @since 4.7.0
-				 *
-				 * @param string $var The query_var value.
-				 */
-				$query_args[ $var ] = apply_filters( "rest_query_var-{$var}", $prepared_args[ $var ] );
-			}
-		}
-
+	protected function prepare_items_query( $query_args = array(), $request = null ) {
 		if ( 'post' !== $this->post_type || ! isset( $query_args['ignore_sticky_posts'] ) ) {
 			$query_args['ignore_sticky_posts'] = true;
 		}
@@ -846,82 +827,6 @@
 	}
 
 	/**
-	 * Retrieves all of the WP Query vars that are allowed for the REST API request.
-	 *
-	 * @since 4.7.0
-	 * @access protected
-	 *
-	 * @param WP_REST_Request $request Optional. Full details about the request.
-	 * @return array Allowed query variables.
-	 */
-	protected function get_allowed_query_vars( $request = null ) {
-		global $wp;
-
-		/** This filter is documented in wp-includes/class-wp.php */
-		$valid_vars = apply_filters( 'query_vars', $wp->public_query_vars );
-
-		$post_type_obj = get_post_type_object( $this->post_type );
-		if ( current_user_can( $post_type_obj->cap->edit_posts ) ) {
-			/**
-			 * Filters the allowed 'private' query vars for authorized users.
-			 *
-			 * If the user has the `edit_posts` capability, we also allow use of
-			 * private query parameters, which are only undesirable on the
-			 * frontend, but are safe for use in query strings.
-			 *
-			 * To disable anyway, use
-			 * `add_filter( 'rest_private_query_vars', '__return_empty_array' );`
-			 *
-			 * @since 4.7.0
-			 *
-			 * @param array $private_query_vars Array of allowed query vars for authorized users.
-			 */
-			$private = apply_filters( 'rest_private_query_vars', $wp->private_query_vars );
-
-			$valid_vars = array_merge( $valid_vars, $private );
-		}
-
-		// Define our own in addition to WP's normal vars.
-		$rest_valid = array(
-			'author__in',
-			'author__not_in',
-			'ignore_sticky_posts',
-			'menu_order',
-			'offset',
-			'post__in',
-			'post__not_in',
-			'post_parent',
-			'post_parent__in',
-			'post_parent__not_in',
-			'posts_per_page',
-			'date_query',
-			'post_name__in',
-		);
-
-		$valid_vars = array_merge( $valid_vars, $rest_valid );
-
-		/**
-		 * Filters allowed query vars for the REST API.
-		 *
-		 * This filter allows you to add or remove query vars from the final allowed
-		 * list for all requests, including unauthenticated ones. To alter the
-		 * vars for editors only, see {@see 'rest_private_query_vars'}.
-		 *
-		 * @since 4.7.0
-		 *
-		 * @param array {
-		 *    Array of allowed WP_Query query vars.
-		 *
-		 *    @param string          $allowed_query_var The query var to allow.
-		 *    @param WP_REST_Request $request           Request object.
-		 * }
-		 */
-		$valid_vars = apply_filters( 'rest_query_vars', $valid_vars, $request );
-
-		return $valid_vars;
-	}
-
-	/**
 	 * Checks the post_date_gmt or modified_gmt and prepare any post or
 	 * modified date for single post output.
 	 *
@@ -2195,7 +2100,22 @@
 			);
 		}
 
-		return $params;
+		/**
+		 * Filter collection parameters for the posts controller.
+		 *
+		 * The dynamic part of the filter `$this->post_type` refers to the post
+		 * type slug for the controller.
+		 *
+		 * This filter registers the collection parameter, but does not map the
+		 * collection parameter to an internal WP_Query parameter. Use the
+		 * `rest_{$this->post_type}_query` filter to set WP_Query parameters.
+		 *
+		 * @since 4.7.0
+		 *
+		 * @param $params JSON Schema-formatted collection parameters.
+		 * @param WP_Post_Type $post_type_obj Post type object.
+		 */
+		return apply_filters( "rest_{$this->post_type}_collection_params", $params, $post_type_obj );
 	}
 
 	/**