get_posts() not honoring post_status criteria

[Denis-de-Bernardy]

Toss in the following in a mu-plugin file to reproduce:

$posts = get_posts();
var_dump($posts);

You'll get auto-drafts in the returned result set, instead of the expected published posts only (i.e. the default as set by get_posts()).

I've traced the problem to this loop that calls get_post_stati() in the WP_Query#get_posts() method:

foreach ( get_post_stati() as $status ) {
	if ( in_array( $status, $q_status ) ) {
		if ( 'private' == $status )
			$p_status[] = "$wpdb->posts.post_status = '$status'";
		else
			$r_status[] = "$wpdb->posts.post_status = '$status'";
	}
}

get_post_stati() latter relies on a global that isn't set yet. I'm suspicious that we should be calling it here to begin with. Assuming we should, I definitely don't think WP should silently return an empty array. It should cough a _doing_it_wrong() notice, and quite possibly even a warning.

That being said: why aren't the built-in post statuses registered by the time plugins get loaded? Can't we register them earlier? (And: does the same apply to custom post types?)

[wonderboymusic]

init signals the end of bootstrapping, all built-in types are registered then

[Denis-de-Bernardy]

Ya, I figured as much, but not after wasting time tracking down what was up with WP.

Therefor this ticket: so that the next guy who tries it immediately has some feedback as to what he's doing wrong instead of being left scratching his head while cursing WP with the foulest words he can think of.

[wonderboymusic]

get_posts() should be able to return publicly published posts without incident, we should probably fix this - 27507.diff​ checks if get_post_stati() is empty, may need more checks since get_posts() works for attachments and might want inherit

[Denis-de-Bernardy]

The patch you uploaded seems invalid. If you opt to ignore status validation in early calls to get_posts(), the patch should probably be more like:

if ( empty( $stati ) ) {
    foreach ($q_status as $status) {
        ...
    }
}

(And I still think a _doing_it_wrong() call is more appropriate here.

[helen]

No consensus, punting.