REST API: Sticky post query returns unsticky posts when no posts are sticky

[ryelle]

When getting sticky posts from the API (for example, site.com/wp-json/wp/v2/posts?sticky=true), if there are no sticky posts set, the query just returns all posts — as if sticky was not set. I was expecting an empty array. If there are sticky posts, it behaves as expected, only returning the sticky posts.

The source seems to be this check in WP_REST_Posts_Controller.

[jnylen0]

@kadamwhite what do you think about getting this into 4.7.3 if we can get it patched quickly enough?

@ryelle are you available to write a patch and unit tests for this change today?

As for the patch, I would suggest something like this:

<?php
$sticky_posts = get_option( 'sticky_posts', array() );
if ( ! is_array( $sticky_posts ) ) {
    $sticky_posts = array();
}
if ( $request['sticky'] ) {
    // ...

[kadamwhite]

@jnylen0 I am +1 on getting this fixed as soon as possible, I milestoned for 4.7.4 because I thought we'd missed the cutoff -- but let's see what we can do :)

[jnylen0]

I would say that we need to get it committed to trunk today or tomorrow at the very latest. A bit of a stretch, but potentially doable.

if there are no sticky posts set

I guess we need to know what get_option( 'sticky_posts' ) returns in this case, and what other values it might return.

[ryelle]

I've added a patch with the is_array check from this comment, plus some tests. I also changed $args['post__in'] = array( -1 ); to 0, because wp_query runs absint over the post__in array, and so was converting it to post ID 1.

[jnylen0]

I think the approach looks good, but there are a few more tests that could be added here and I want to look at it more closely. I'll try to land this today for 4.7.3.

[jnylen0]

Add more tests; test the generated SQL to catch the IN(0) fix.

[jnylen0]

39947.2.diff​ adds more test cases and also tests the WHERE clauses generated by WP_Query using a similar approach to #39079. This catches the IN(0) fix on this ticket.

[jnylen0]

In 40122:

REST API: Fix behavior of sticky posts filter when no posts are sticky.

Previously, when getting posts from the API with sticky=true, if there were no sticky posts set, the query would return all posts as if the sticky argument was not set. In this situation, the query should return an empty array instead.

A sticky=true query that should return an empty array (in the previous situation, or with include and no intersecting post IDs) was also broken in that it would query the post with ID 1.

Finally, this commit significantly improves test coverage for the sticky filter argument, including direct testing of the WHERE clauses generated by WP_Query.

Props ryelle.
Fixes #39947.

[jnylen0]

Reopening for backport to 4.7 branch. The tests added in [40122] depend on [40037] so that commit should probably be merged here as well.

[ocean90]

In 40136:

REST API: Fix behavior of sticky posts filter when no posts are sticky.

Previously, when getting posts from the API with sticky=true, if there were no sticky posts set, the query would return all posts as if the sticky argument was not set. In this situation, the query should return an empty array instead.

A sticky=true query that should return an empty array (in the previous situation, or with include and no intersecting post IDs) was also broken in that it would query the post with ID 1.

Finally, this commit significantly improves test coverage for the sticky filter argument, including direct testing of the WHERE clauses generated by WP_Query.

Merge of [40037] and [40122] to the 4.7 branch.

Props ryelle, jnylen0.
See #39079.
Fixes #39947.