Using `author_name` in URL parameter gives unexpected results when logged into contributor account

[lschuyler]

When logged into a contributor account, and trying to view the post listing on the dashboard of an administrator user, the query changes unexpectedly when the URL uses the author_name parameter rather than the default url.

Assuming a user ID of 1 for an administrator user, and a user ID of 2 for a contributor user:

When logged into the contributor account, and displaying the admin user's posts in the dashboard, the URL looks like this and works as expected:

/wp-admin/edit.php?post_type=post&author=1

The main query is:

SELECT SQL_CALC_FOUND_ROWS wp_posts.ID
FROM wp_posts
WHERE 1=1
AND wp_posts.post_author IN (1)
AND wp_posts.post_type = 'post'
AND (wp_posts.post_status = 'publish'
OR wp_posts.post_status = 'future'
OR wp_posts.post_status = 'draft'
OR wp_posts.post_status = 'pending'
OR wp_posts.post_author = 2
AND wp_posts.post_status = 'private')
ORDER BY wp_posts.post_date DESC
LIMIT 0, 20

But if the URL is switched to the username of the administrator user, example, admin, like this /wp-admin/edit.php?post_type=post&author_name=admin or even just /wp-admin/edit.php?author_name=admin I would expect the same results, but they are different:

SELECT SQL_CALC_FOUND_ROWS wp_posts.ID
FROM wp_posts
WHERE 1=1
AND wp_posts.post_author IN (2)
AND (wp_posts.post_author = 1)
AND wp_posts.post_type = 'post'
AND (wp_posts.post_status = 'publish'
OR wp_posts.post_status = 'future'
OR wp_posts.post_status = 'draft'
OR wp_posts.post_status = 'pending'
OR wp_posts.post_author = 2
AND wp_posts.post_status = 'private')
ORDER BY wp_posts.post_date DESC
LIMIT 0, 20

The IN (2) and the OR wp_posts.post_author = 2 here is unexpected, because the 2 is the user ID of the contributor user that is logged in, and it isn't relevant to a query for the posts of user ID 1 (admin).

For comparison, when logged into the administrator's account, this query looks like this:

SELECT SQL_CALC_FOUND_ROWS wp_posts.ID
FROM wp_posts
WHERE 1=1
AND (wp_posts.post_author = 1)
AND wp_posts.post_type = 'post'
AND (wp_posts.post_status = 'publish'
OR wp_posts.post_status = 'future'
OR wp_posts.post_status = 'draft'
OR wp_posts.post_status = 'pending'
OR wp_posts.post_status = 'private')
ORDER BY wp_posts.post_date DESC
LIMIT 0, 20

To replicate:

1. Create two users, one with the administrator role, and another with a contributor role.
2. Publish a post for the admin user.
3. While logged into the contributor user's account, view the administrator user's posts in the dashboard. The link will look like /wp-admin/edit.php?post_type=post&author=1. Take note of the main query and the search results.
4. Alter the url to look for the username of that administrator user, in this format: /wp-admin/edit.php?post_type=post&author_name=admin. Check the main query and search results again.

This appears to be coming from the get_posts function in the wp-includes/class-wp-query.php file.

This is a low severity issue that I stumbled upon while investigating a Co Authors Plus ​issue, a plugin that uses the author_name in the URL. However, even when that plugin is not installed, the above described behavior is replicable.