Recent Posts widget ignores private posts since replacing The Loop

[captain.crash]

Since changeset [41890] the Recent Posts widget has been ignoring posts marked as private.

Such posts do appear in normal archive listings (when logged in, obviously) and did so as well in the Recent Posts widget prior to said changeset that replaced The Loop with a foreach loop.

[audrasjb]

Hello and thanks for the ticket, I can reproduce the issue on my side.

[audrasjb]

Add private posts to recent posts widget query if the user is connected.

[audrasjb]

45883.diff adds private posts to the Recent Posts Widget query if the user is connected.

Can you please test this patch? I tested it and the patch works on my side.

[captain.crash]

Patch is working on my side as well.

[Edit] Sorry, but am I supposed to set the resolution (and close the ticket)?

[audrasjb]

@captaincrash I reopened the ticket. You don't have anything to do except to wait for the next release lead(s) to include this ticket to the scope of the release. As this is a defect, I set the milestone to 5.1.1 minor release. It's up to release lead(s) to accept it or not for the release they are leading. Then, maybe it will land in 5.1.1, maybe in 5.2.

[dlh]

I'm having a little trouble following how [41890] might have caused a change in behavior like the one described here. If I revert [41890] from my test environment, for example, I still don't see private posts in the widget, but perhaps I'm testing incorrectly.

Regardless, I wonder whether the change in 45883.diff​ is too broad. Being logged in isn't usually sufficient in itself to view private posts; users typically need to be the post author or have the read_private_posts capability for the post type.

Removing the post_status clause from the query args entirely causes the default WP_Query logic to kick in, which checks authorship and capabilities.

However, if private posts weren't previously visible in the widget, that might constitute a backwards-compatibility break both for the widget output and the widget_posts_args filter.

[captain.crash]

Replying to dlh:

I'm having a little trouble following how [41890] might have caused a change in behavior like the one described here. If I revert [41890] from my test environment, for example, I still don't see private posts in the widget, but perhaps I'm testing incorrectly.

I'm terribly ashamed, but I cannot reproduce the issue either.

I was sure I was testing thoroughly. I did that now again - I hope (with clean installs back to 4.0) - and can confirm that the Recent Posts widget probably never showed private posts in the first place. I'm still sure I did not make this up, but I cannot reproduce my earlier tests. @audrasjb probably only tested that private posts do not appear now, but not whether or not they did prior to said changeset.

So, thanks for chiming in and sorry again. I guess this ticket's for the wastebin.

[audrasjb]

You are absolutely right @dlh thanks for the feedback :)
45883.1.diff simply removes post_status entirely to let WP_Query handle private posts permissions.

@lukecarbis, it's up to you to move this one to 5.2 or not. But it doesn't looks like a regression from 5.1.

[audrasjb]

Adds private posts to recent posts widget

[lukecarbis]

@audrasjb If we can get your patch tested in time, I'd like to keep it in 5.1.1.

[audrasjb]

@dlh can you add a feedback about removing post_status from recent post widget's query? I do not see any problem of backward compatibility but if you don't agree please feel free to add your thought about that :)

[dlh]

One backwards-compatibility break is changing the $args that are passed to widget_posts_args, which, I guess, isn't huge.

However, the current behavior has been in place for 12 years — see #4786. Although core no longer contains the caching behavior described in that ticket, plugin and theme developers may have implemented their own fragment caching for widgets or sidebars, and with this change, the widget output would no longer be safe to cache.

Additionally, as you noted, there doesn't appear to be a regression from 5.1. Plus, 12 years' worth of behavior just seems like a lot to alter in a maintenance release.

[pbiron]

During the bug scrub today it was decided to punt this to 5.2. While the fix looks good, since it is not actually a regression it doesn't fit to scope of 5.1.1.

[SergeyBiryukov]

Limiting the recent entries query to published posts was done in [5973], changing the version accordingly.

The current patch simply reverts that changeset. I agree with the concerns in comment:13, changing this now would make the widget output unsafe to cache.

If someone needs to show private posts in Recent Posts widget, the widget_posts_args filter can be used for that.

[audrasjb]

Thanks for your contribution.
et's close that ticket as wontfix since the patch is not safe and also there is already a method to handle that need: the widget_posts_args filter.