Random content redirect should not combine with search (?s=…&random)

[ReneHermi]

The random content redirect added in 7.2 (/random/ and ?random) also works together with a search query. /?s=WORD&random redirects to a random post that matches WORD, and returns a 404 when nothing matches.

This mixes two features in a way that is hard to predict. It also turns search into a yes/no answer for each search term, even where search results themselves would not be shown, for example on sites behind a login plugin (see #66661).

Steps to reproduce (7.2-beta4-65283, logged out):

1. Publish a post with the word "Zebrafinqx" in its title.
2. Request /?s=Zebrafinqx&random: you get a 302 to that post.
3. Request /?s=qqqzzznothere&random: you get a 404.

Expected: random and a search query do not act at the same time. Suggested fix, as discussed with the security team: ignore random when the request is a search (or skip the search when random is set), so that ?s=…&random behaves like a normal search.

Related: #66625 (caching headers for the random redirect).

This was first sent to security@…. The team decided it does not need a private fix and asked for a public ticket.

[manfcarlo]

Replying to ReneHermi:

even where search results themselves would not be shown

This seems like an important point. Themes have the ability to omit the query loop or synthesise its results in some way, while this feature overrules the theme by "revealing" one of the posts that would have been shown. Example:

<?php
if ( ! is_search() || is_user_logged_in() ):
  if ( have_posts() ):
    while ( have_posts() ):
      the_post();
      // etc
    endwhile;
  endif;
else:
  wp_login_form();
endif;

I have been of the view for some time that the random redirects should use nonce verification, which would address this and many of the other issues reported. Better yet, scrap the feature owing to its near-zero level of community support.

[jorbin]

Replying to manfcarlo:

I have been of the view for some time that the random redirects should use nonce verification, which would address this and many of the other issues reported.

Every logged out visitor gets the same nonce for the same action, so this won't provide any protection. Additionally, /random/ is a URL that folks link to, bookmark and type. A nonce turns it into a link that only works when Core generated it in the 24 hours which would break the feature.

A search request that includes the random query variable redirected to a matching post or returned a 404, which revealed whether any post matched the search terms. Search requests are no longer random content requests. Instead they are redirected to the same search without the random query variable or the random base, before the main query is run.

The redirect retains the requested path and the other query string parameters, URL-encodes parameter names as well as values, and is skipped when the location would be the requested URL.

Requests for robots.txt, the favicon, sitemaps, feeds and trackbacks now ignore the random query variable, they are neither random content requests nor redirected.

Use of AI Tools

Example disclosure:

AI assistance: Yes
Tool(s): Claude
Model(s): Fabel 5.2
Used for: Code Generation, Code Review, Risk Analysis