Image Gallery of Private Post is publicly displayed

[hakre]

Might have been forgotten only, I just ran over this inconsistency while beta-testing:

Description:

The Image Gallery of a Private Post is displayed (in another post via the Shorttag with id parameter) whereas, when clicking on the images to go to the attachment page, you get a 404 not found.

Example:

​Post with Gallery
​Attachment of that Gallery

Steps to reproduce

Create a new Post, set a title and the Status to private.

Save as Draft.

Preview it, to get the ID easily from URL.

Upload a Bunch of Images.

Insert the Gallery Shorttag inside that Post Body.

Publish the Post.

Create a second new Post

Give it a Title and Insert the Gallery Shortcode with the ID from the last Post.

Publish.

View.

Copy the URL.

Open another Browser so to have a new User-Session.

Visit that URL.

Expected Behaviour

You should not see a gallery.

Behaviour

You see a gallery.

When clicking on a gallery link you get a 404 page.

Feedback

I see an inconsitency here but have no Idea how to deal with it.

So either the gallery should not be found as well (not found as in 404 but in this case: not output) or the attachment pages should be able to call as well.

Related: #11697

[wonderboymusic]

Just because the images are attached to the post, doesn't mean they can't be shown. get_children() retrieves the attachments for the [gallery], and has never checked the post_status of the parent post.

[SergeyBiryukov]

Reproduced in trunk.

Displaying a gallery where each image link leads to a 404 page doesn't make sense to me.

[SergeyBiryukov]

If an id attribute is passed to [gallery], I guess we should check if the current user can read that post.

[nacin]

This goes all the way back to wp_edit_attachments_query(). Images attached to private posts are not explicitly private. A side effect of opening up galleries in 3.5 meant these could also be used in galleries. But it's been around like this for a long time.

It probably makes sense to block "id" but that really doesn't help much. The disclosure of info here is well-established.

[joemcgill]

I just ran into this issue. It seems like the main problem is that even though the images themselves are not private, WordPress still treats the attachment page as a private post if the post it is attached to is set as private—resulting in users seeing a 404 error when they visit the attachment page. Detaching the image from the private post resolves the 404 issue.

I'm not sure if there is a good reason for attachment pages to inherit the privacy of the page it is attached to or not, since viewing the image itself is not subject to any capabilities check, but if not, we should attempt resolving the 404 issue.