WordPress.org

Make WordPress Core

Opened 7 years ago

Closed 6 years ago

Last modified 6 years ago

#22902 closed defect (bug) (fixed)

Duplicate post slug causes unpublished posts to display in single post template, based on permalinks

Reported by: luke at sametz Owned by: markjaquith
Milestone: 3.6 Priority: high
Severity: major Version: 3.2
Component: Quick/Bulk Edit Keywords: has-patch
Focuses: Cc:
PR Number:

Description

It's possible to force unpublished post content to appear on an existing, published post's permalink if an editor or administrator assigns an existing slug to one or more unpublished posts via the Quick Edit link on All Posts (or the equivalent, for custom post types).

Steps to reproduce

  1. Start with a default installation of 3.5
  2. Set permalink structure to the 'Post name' Common setting
  3. Save it as a Draft
  4. Give it a title of of 'Unpublished Post' and add body text
  5. Save it as a Draft
  6. View All Posts
  7. Use the Quick Edit link for the Unpublished Post
  8. Assign a slug of 'hello-world' and Update
  9. View the default 'Hello World!' post at /hello-world/

Results:

The loop runs and returns both posts in the single.php template.

You'll get...

  • the full title and text of the unpublished post,
  • a previous link to the default Hello World post,
  • the comments for the Unpublished post, and finally
  • the expected result of the default Hello World post.

Real world use case:

A periodical publication with a monthly "From the editor" post. A non-technical Editor could (assuming default permissions) potentially notice the slug in quick edit and try to "correct" the url, duplicating the first post with that title.

Attachments (3)

22902.patch (761 bytes) - added by SergeyBiryukov 7 years ago.
22902.2.patch (1.5 KB) - added by SergeyBiryukov 7 years ago.
Refreshed
22902.3.patch (1.6 KB) - added by markjaquith 6 years ago.
refreshed

Download all attachments as: .zip

Change History (9)

#1 @johnbillion
7 years ago

  • Keywords permalink draft post removed
  • Version changed from 3.5 to 3.2

Confirmed. Reproduced on 3.2, could well affect earlier.

#2 @luke at sametz
7 years ago

Was originally spotted on a 3.4.2 site, but tried a clean install of current version to test the steps to reproduce. Not sure how far back it goes, but guessing at least to 3.0.

It seems that the permalink structure makes a query based upon the slug - the only information available to determine the post to be presented - and the loop does its thing and displays all results matching the query, as expected. While it's arguably expected behavior, it's certainly unexpected results. The real question at the time was whether to report it as a permalink issue or a query issue.

After sleeping on it, I think it might be best if addressed as an administrative UI issue. Just ensure that draft posts get unique slugs in Quick Edit, just like published ones do. That wouldn't actually resolve the root of the issue, just makes sure it can't happen through the administrative interface.

#3 @nacin
7 years ago

  • Component changed from Query to Quick/Bulk Edit
  • Milestone changed from Awaiting Review to 3.6
  • Priority changed from normal to high
  • Severity changed from normal to major

This is bad.

#4 @SergeyBiryukov
7 years ago

  • Keywords has-patch added

wp_unique_post_slug() bails early when dealing with a draft:
http://core.trac.wordpress.org/browser/tags/3.5/wp-includes/post.php#L3073

get_sample_permalink() contains a hack to prevent that by faking a 'publish' status:
http://core.trac.wordpress.org/browser/tags/3.5/wp-admin/includes/post.php#L994

22902.patch is an attempt to fix the issue by implementing a similar hack in wp_ajax_inline_save().

@SergeyBiryukov
7 years ago

Refreshed

@markjaquith
6 years ago

refreshed

#5 @markjaquith
6 years ago

  • Owner set to markjaquith
  • Resolution set to fixed
  • Status changed from new to closed

In 24206:

Ensure that draft posts cannot be given a non-unique post slug when using Quick Edit.

fixes #22902. props SergeyBiryukov.

Note: See TracTickets for help on using tickets.