WordPress.org

Make WordPress Core

Opened 6 years ago

Last modified 5 months ago

#27507 new defect (bug)

get_posts() not honoring post_status criteria

Reported by: Denis-de-Bernardy Owned by:
Milestone: Priority: normal
Severity: normal Version: 3.8.1
Component: Query Keywords: needs-patch
Focuses: Cc:
PR Number:

Description

Toss in the following in a mu-plugin file to reproduce:

$posts = get_posts();
var_dump($posts);

You'll get auto-drafts in the returned result set, instead of the expected published posts only (i.e. the default as set by get_posts()).

I've traced the problem to this loop that calls get_post_stati() in the WP_Query#get_posts() method:

foreach ( get_post_stati() as $status ) {
	if ( in_array( $status, $q_status ) ) {
		if ( 'private' == $status )
			$p_status[] = "$wpdb->posts.post_status = '$status'";
		else
			$r_status[] = "$wpdb->posts.post_status = '$status'";
	}
}

get_post_stati() latter relies on a global that isn't set yet. I'm suspicious that we should be calling it here to begin with. Assuming we should, I definitely don't think WP should silently return an empty array. It should cough a _doing_it_wrong() notice, and quite possibly even a warning.

That being said: why aren't the built-in post statuses registered by the time plugins get loaded? Can't we register them earlier? (And: does the same apply to custom post types?)

Attachments (1)

27507.diff (1.0 KB) - added by wonderboymusic 5 years ago.

Download all attachments as: .zip

Change History (8)

#1 @wonderboymusic
6 years ago

init signals the end of bootstrapping, all built-in types are registered then

#2 @Denis-de-Bernardy
6 years ago

Ya, I figured as much, but not after wasting time tracking down what was up with WP.

Therefor this ticket: so that the next guy who tries it immediately has some feedback as to what he's doing wrong instead of being left scratching his head while cursing WP with the foulest words he can think of.

@wonderboymusic
5 years ago

#3 @wonderboymusic
5 years ago

  • Focuses docs removed
  • Keywords has-patch needs-unit-tests added
  • Milestone changed from Awaiting Review to 4.0

get_posts() should be able to return publicly published posts without incident, we should probably fix this - 27507.diff checks if get_post_stati() is empty, may need more checks since get_posts() works for attachments and might want inherit

#4 @Denis-de-Bernardy
5 years ago

  • Keywords has-patch needs-unit-tests removed

The patch you uploaded seems invalid. If you opt to ignore status validation in early calls to get_posts(), the patch should probably be more like:

if ( empty( $stati ) ) {
    foreach ($q_status as $status) {
        ...
    }
}

(And I still think a _doing_it_wrong() call is more appropriate here.

This ticket was mentioned in IRC in #wordpress-dev by helen. View the logs.


5 years ago

#6 @helen
5 years ago

  • Milestone changed from 4.0 to Future Release

No consensus, punting.

#7 @chriscct7
4 years ago

  • Keywords needs-patch added
Note: See TracTickets for help on using tickets.