the_author_posts() returns an inaccurate value with the author has no published posts

[jbenton]

When the_author_posts() is run for a user who has zero published posts, the value returned is the total number of published posts on the entire WP install. First noticed when I saw someone with 0 posts listed as having 4,181 — the total post count for the site. Confirmed on another install that had 30 total posts and returned 30 for a user with zero posts.

Details, with confirmation from @nacin, here (see the thread) — apparently this was broken in 3.0:

​https://twitter.com/jbenton/status/459083084189929472

[nacin]

This happens because:

• on an author page for someone with no posts (which is a proper 200 page, not a 404), $post is null
• get_the_author_posts() uses get_post()->post_author directly
• count_user_posts() uses get_posts_by_author_sql() to build a WHERE
• get_posts_by_author_sql() doesn't put a condition on post_author if an actual author wasn't passed

We added count_user_posts() in 3.0, replacing the then-direct SQL in get_usernumposts().

[krogsgard]

It seems to me that two things may need to occur:

• Do a check for a returned value on get_post()->post_author in get_the_author_posts() to prevent a notice.
• Create the condition to exit early from get_posts_by_author_sql if a user ID isn't passed. Is there any reason to create continue without a post author?

I'd love for this to be my first patch, but want to make sure I go the right route :)

[krogsgard]

Perform a check on get_post() within get_the_author_posts() to avoid a notice.

[nacin]

This looks good. There is need for empty(), it can just be ! $post, as the variable will always exist.

I don't think we need to venture further down the stack.

This will also need unit tests.

[krogsgard]

Use ! instead of empty() on the check for get_post().

[aaroncampbell]

27998-unit-tests.diff​ adds one test with two assertions. One with no global post set up and one with. The first errors before the patch and passes after. The second passes before and after.

[wonderboymusic]

In 28362:

In get_the_author_posts(), if there is no current $post, return 0 and bail.

Props krogsgard, aaroncampbell.
Fixes #27998.