sergiotarxz
/
Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

In `get_adjacent_post()`, return private post if the current user has the capacity to read it. 

This mirrors the check that happens post-query in `WP_Query`. See #30911.

Props bswatson.
Fixes #30287.

git-svn-id: https://develop.svn.wordpress.org/trunk@31302 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Boone Gorges 2015-01-30 02:19:46 +00:00
parent 9f8e5d3c17
commit 9cb4d3c1ce
2 changed files with 117 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
src/wp-includes/link-template.php
View File

@ -1521,6 +1521,36 @@ function get_adjacent_post( $in_same_term = false, $excluded_terms = '', $previo
}
}
// 'post_status' clause depends on the current user.
if ( is_user_logged_in() ) {
$user_id = get_current_user_id();
$post_type_object = get_post_type_object( $post->post_type );
if ( empty( $post_type_object ) ) {
$post_type_cap = $post->post_type;
$read_private_cap = 'read_private_' . $post_type_cap . 's';
} else {
$read_private_cap = $post_type_object->cap->read_private_posts;
}
/*
* Results should include private posts belonging to the current user, or private posts where the
* current user has the 'read_private_posts' cap.
*/
$private_states = get_post_stati( array( 'private' => true ) );
$where .= " AND ( p.post_status = 'publish'";
foreach ( (array) $private_states as $state ) {
if ( current_user_can( $read_private_cap ) ) {
$where .= $wpdb->prepare( " OR p.post_status = %s", $state );
} else {
$where .= $wpdb->prepare( " OR (p.post_author = %d AND p.post_status = %s)", $user_id, $state );
}
}
$where .= " )";
} else {
$where .= " AND p.post_status = 'publish'";
}
$adjacent = $previous ? 'previous' : 'next';
$op = $previous ? '<' : '>';
$order = $previous ? 'DESC' : 'ASC';
@ -1551,7 +1581,7 @@ function get_adjacent_post( $in_same_term = false, $excluded_terms = '', $previo
* @param bool $in_same_term Whether post should be in a same taxonomy term.
* @param array $excluded_terms Array of excluded term IDs.
*/
$where = apply_filters( "get_{$adjacent}_post_where", $wpdb->prepare( "WHERE p.post_date $op %s AND p.post_type = %s AND p.post_status = 'publish' $where", $current_post_date, $post->post_type ), $in_same_term, $excluded_terms );
$where = apply_filters( "get_{$adjacent}_post_where", $wpdb->prepare( "WHERE p.post_date $op %s AND p.post_type = %s $where", $current_post_date, $post->post_type ), $in_same_term, $excluded_terms );
/**
* Filter the ORDER BY clause in the SQL for an adjacent post query.

92
tests/phpunit/tests/url.php
View File

@ -279,10 +279,10 @@ class Tests_URL extends WP_UnitTestCase {
force_ssl_login( $forced_login );
}
function test_get_adjacent_post() {
$post_id = $this->factory->post->create();
sleep( 1 ); // get_adjacent_post() doesn't handle posts created in the same second.
$post_id2 = $this->factory->post->create();
public function test_get_adjacent_post() {
$now = time();
$post_id = $this->factory->post->create( array( 'post_date' => date( 'Y-m-d H:i:s', $now - 1 ) ) );
$post_id2 = $this->factory->post->create( array( 'post_date' => date( 'Y-m-d H:i:s', $now ) ) );
if ( ! isset( $GLOBALS['post'] ) )
$GLOBALS['post'] = null;
@ -306,9 +306,89 @@ class Tests_URL extends WP_UnitTestCase {
$this->assertNull( get_adjacent_post() );
$GLOBALS['post'] = $orig_post;
}
// Tests requiring creating more posts can't be run since the query
// cache in get_adjacent_post() requires a fresh page load to invalidate.
/**
* Test get_adjacent_post returns the next private post when the author is the currently logged in user.
*
* @ticket 30287
*/
public function test_get_adjacent_post_should_return_private_posts_belonging_to_the_current_user() {
$u = $this->factory->user->create( array( 'role' => 'author' ) );
$old_uid = get_current_user_id();
wp_set_current_user( $u );
$now = time();
$p1 = $this->factory->post->create( array( 'post_author' => $u, 'post_status' => 'private', 'post_date' => date( 'Y-m-d H:i:s', $now - 1 ) ) );
$p2 = $this->factory->post->create( array( 'post_author' => $u, 'post_date' => date( 'Y-m-d H:i:s', $now ) ) );
if ( ! isset( $GLOBALS['post'] ) ) {
$GLOBALS['post'] = null;
}
$orig_post = $GLOBALS['post'];
$GLOBALS['post'] = get_post( $p2 );
$p = get_adjacent_post();
$this->assertEquals( $p1, $p->ID );
$GLOBALS['post'] = $orig_post;
wp_set_current_user( $old_uid );
}
/**
* @ticket 30287
*/
public function test_get_adjacent_post_should_return_private_posts_belonging_to_other_users_if_the_current_user_can_read_private_posts() {
$u1 = $this->factory->user->create( array( 'role' => 'author' ) );
$u2 = $this->factory->user->create( array( 'role' => 'administrator' ) );
$old_uid = get_current_user_id();
wp_set_current_user( $u2 );
$now = time();
$p1 = $this->factory->post->create( array( 'post_author' => $u1, 'post_status' => 'private', 'post_date' => date( 'Y-m-d H:i:s', $now - 1 ) ) );
$p2 = $this->factory->post->create( array( 'post_author' => $u1, 'post_date' => date( 'Y-m-d H:i:s', $now ) ) );
if ( ! isset( $GLOBALS['post'] ) ) {
$GLOBALS['post'] = null;
}
$orig_post = $GLOBALS['post'];
$GLOBALS['post'] = get_post( $p2 );
$p = get_adjacent_post();
$this->assertEquals( $p1, $p->ID );
$GLOBALS['post'] = $orig_post;
wp_set_current_user( $old_uid );
}
/**
* @ticket 30287
*/
public function test_get_adjacent_post_should_not_return_private_posts_belonging_to_other_users_if_the_current_user_cannot_read_private_posts() {
$u1 = $this->factory->user->create( array( 'role' => 'author' ) );
$u2 = $this->factory->user->create( array( 'role' => 'author' ) );
$old_uid = get_current_user_id();
wp_set_current_user( $u2 );
$now = time();
$p1 = $this->factory->post->create( array( 'post_author' => $u1, 'post_date' => date( 'Y-m-d H:i:s', $now - 2 ) ) );
$p2 = $this->factory->post->create( array( 'post_author' => $u1, 'post_status' => 'private', 'post_date' => date( 'Y-m-d H:i:s', $now - 1 ) ) );
$p3 = $this->factory->post->create( array( 'post_author' => $u1, 'post_date' => date( 'Y-m-d H:i:s', $now ) ) );
if ( ! isset( $GLOBALS['post'] ) ) {
$GLOBALS['post'] = null;
}
$orig_post = $GLOBALS['post'];
$GLOBALS['post'] = get_post( $p3 );
$p = get_adjacent_post();
$this->assertEquals( $p1, $p->ID );
$GLOBALS['post'] = $orig_post;
wp_set_current_user( $old_uid );
}
/**