Protected posts should not be found in searches

[dosa]

By listing password protected posts in search results nosey users can fish for the post content - eg trying their own name if they think the post might be about them.

[markjaquith]

Could not duplicate on trunk. I couldn't get private posts to show up in search results for non-logged-in users or logged-in users who didn't write the private post.

[arminbw]

I could reproduce this on version 2.5.1. Details here: ​http://wordpress.org/support/topic/180743

[DD32]

Tested on trunk:

• Created New post, Set a password, Gave it tags & categories, Added a unique word to the content
• Upon searching for the term:
  • The Post appears in the listing, however:
    • It requests a password to view the contents
    • It does display the title: "Protected: My Secret Post" and the date
    • It doesnt show me any details of the post
• While i was at it, checked how it appeared in the RSS feed, Same as above, not content leaked.

I believe the issue at question here, is that when you logout, The password cookie is not cleared, So If someone has added a password, and then typed it in, Then they will continue to see the posts' real content until a point where the password cookie is cleared.

So its a bit confusing for users who think their Private/Protected page is available for viewing by all.

[arminbw]

The protected content does not show up, but - like dosa stated - you can "fish" for it.

simplified szenario:

1. You write an article titled "people we do not like"
   
2. You include the Name "Sue" in your article and protect it with a password
   
3. Sue visits your blog and searches for her name
   
4. While she is at it, she starts to search for all kind of other names..

[netsensei]

I've looked at this issue. Just wanted some feedback.

My solution would be to change the query to exclude all password protected posts, except those that are 'unlocked' with a valid password. I think this would require a change of the queries around line 1755 in query.php.

I suppose one would left join against a list of password unlocked posts/pages.

Just tossing with the idea here. I didn't actually tried to implement this because I'm not that knowledgeable with wordpress core code.

[Nicholas91]

Replying to netsensei:

I've looked at this issue. Just wanted some feedback.

My solution would be to change the query to exclude all password protected posts, except those that are 'unlocked' with a valid password. I think this would require a change of the queries around line 1755 in query.php.

I suppose one would left join against a list of password unlocked posts/pages.

Just tossing with the idea here. I didn't actually tried to implement this because I'm not that knowledgeable with wordpress core code.

I agree with you. Someone please write a patch for the above idea.

[Nicholas91]

And can we also add

<META NAME="ROBOTS" CONTENT="NOINDEX, FOLLOW">

on the password protected post?

[Denis-de-Bernardy]

Dup of #9559

[Denis-de-Bernardy]

fixed in r11106