Make WordPress Core

Opened 12 years ago

Closed 10 years ago

#3478 closed defect (bug) (fixed)

Title of private posts show up in dashboard

Reported by: McShelby Owned by: pishmishy
Milestone: 2.5 Priority: normal
Severity: major Version: 2.0.5
Component: Security Keywords: has-patch needs-testing
Focuses: Cc:


When a user A logs in to Wordpress he cannot actually see the comments attached to a private post of some other user B, but he can see the title of the post on the Dashboard page. There's a link under "Latest Activity >> Comments" which shows the title of the private post which has recently had a comment attached to it. If user A clicks on the post title link, he correctly gets the 404 page. However the title of user B's private post was revealed.

Attachments (1)

3478-index.patch (846 bytes) - added by pishmishy 11 years ago.

Download all attachments as: .zip

Change History (7)

#1 @foolswisdom
11 years ago

  • Milestone changed from 2.2 to 2.4

#2 follow-up: @chess64
11 years ago

Isn't this fixed already? The sql used is

$wpdb->get_results("SELECT ID, post_title FROM $wpdb->posts WHERE post_type = 'post' AND " . get_private_posts_cap_sql('post') . " AND post_date_gmt < '$today' ORDER BY post_date DESC LIMIT 5")

I'm pretty sure the get_private_posts_cap_sql('post') part does it.

#3 in reply to: ↑ 2 @pishmishy
11 years ago

  • Keywords has-patch added
  • Owner changed from anonymous to pishmishy
  • Status changed from new to assigned

Replying to chess64:

Isn't this fixed already? The sql used is...

That's only hides private posts from the dashboard. The attached patch uses the same techique you mention to hide comments on private posts from the dashboard too.

#4 @foolswisdom
11 years ago

  • Milestone changed from 2.4 (future) to 2.3 (trunk)

#5 @pishmishy
10 years ago

  • Keywords needs-testing added

#6 @westi
10 years ago

  • Resolution set to fixed
  • Status changed from assigned to closed

Closing as fixed - the new dashboard recent-comments widget uses a normal WP_Query object asking for the rss2 comments feed and displays that which should therefore solve this issue.

Note: See TracTickets for help on using tickets.