diff --git a/src/wp-includes/link-template.php b/src/wp-includes/link-template.php index 0fe8a942b8..17748ddabc 100644 --- a/src/wp-includes/link-template.php +++ b/src/wp-includes/link-template.php @@ -1521,6 +1521,36 @@ function get_adjacent_post( $in_same_term = false, $excluded_terms = '', $previo } } + // 'post_status' clause depends on the current user. + if ( is_user_logged_in() ) { + $user_id = get_current_user_id(); + + $post_type_object = get_post_type_object( $post->post_type ); + if ( empty( $post_type_object ) ) { + $post_type_cap = $post->post_type; + $read_private_cap = 'read_private_' . $post_type_cap . 's'; + } else { + $read_private_cap = $post_type_object->cap->read_private_posts; + } + + /* + * Results should include private posts belonging to the current user, or private posts where the + * current user has the 'read_private_posts' cap. + */ + $private_states = get_post_stati( array( 'private' => true ) ); + $where .= " AND ( p.post_status = 'publish'"; + foreach ( (array) $private_states as $state ) { + if ( current_user_can( $read_private_cap ) ) { + $where .= $wpdb->prepare( " OR p.post_status = %s", $state ); + } else { + $where .= $wpdb->prepare( " OR (p.post_author = %d AND p.post_status = %s)", $user_id, $state ); + } + } + $where .= " )"; + } else { + $where .= " AND p.post_status = 'publish'"; + } + $adjacent = $previous ? 'previous' : 'next'; $op = $previous ? '<' : '>'; $order = $previous ? 'DESC' : 'ASC'; @@ -1551,7 +1581,7 @@ function get_adjacent_post( $in_same_term = false, $excluded_terms = '', $previo * @param bool $in_same_term Whether post should be in a same taxonomy term. * @param array $excluded_terms Array of excluded term IDs. */ - $where = apply_filters( "get_{$adjacent}_post_where", $wpdb->prepare( "WHERE p.post_date $op %s AND p.post_type = %s AND p.post_status = 'publish' $where", $current_post_date, $post->post_type ), $in_same_term, $excluded_terms ); + $where = apply_filters( "get_{$adjacent}_post_where", $wpdb->prepare( "WHERE p.post_date $op %s AND p.post_type = %s $where", $current_post_date, $post->post_type ), $in_same_term, $excluded_terms ); /** * Filter the ORDER BY clause in the SQL for an adjacent post query. diff --git a/tests/phpunit/tests/url.php b/tests/phpunit/tests/url.php index 15da8ca8bf..1bc7ba5c02 100644 --- a/tests/phpunit/tests/url.php +++ b/tests/phpunit/tests/url.php @@ -279,10 +279,10 @@ class Tests_URL extends WP_UnitTestCase { force_ssl_login( $forced_login ); } - function test_get_adjacent_post() { - $post_id = $this->factory->post->create(); - sleep( 1 ); // get_adjacent_post() doesn't handle posts created in the same second. - $post_id2 = $this->factory->post->create(); + public function test_get_adjacent_post() { + $now = time(); + $post_id = $this->factory->post->create( array( 'post_date' => date( 'Y-m-d H:i:s', $now - 1 ) ) ); + $post_id2 = $this->factory->post->create( array( 'post_date' => date( 'Y-m-d H:i:s', $now ) ) ); if ( ! isset( $GLOBALS['post'] ) ) $GLOBALS['post'] = null; @@ -306,9 +306,89 @@ class Tests_URL extends WP_UnitTestCase { $this->assertNull( get_adjacent_post() ); $GLOBALS['post'] = $orig_post; + } - // Tests requiring creating more posts can't be run since the query - // cache in get_adjacent_post() requires a fresh page load to invalidate. + /** + * Test get_adjacent_post returns the next private post when the author is the currently logged in user. + * + * @ticket 30287 + */ + public function test_get_adjacent_post_should_return_private_posts_belonging_to_the_current_user() { + $u = $this->factory->user->create( array( 'role' => 'author' ) ); + $old_uid = get_current_user_id(); + wp_set_current_user( $u ); + + $now = time(); + $p1 = $this->factory->post->create( array( 'post_author' => $u, 'post_status' => 'private', 'post_date' => date( 'Y-m-d H:i:s', $now - 1 ) ) ); + $p2 = $this->factory->post->create( array( 'post_author' => $u, 'post_date' => date( 'Y-m-d H:i:s', $now ) ) ); + + if ( ! isset( $GLOBALS['post'] ) ) { + $GLOBALS['post'] = null; + } + $orig_post = $GLOBALS['post']; + + $GLOBALS['post'] = get_post( $p2 ); + + $p = get_adjacent_post(); + $this->assertEquals( $p1, $p->ID ); + + $GLOBALS['post'] = $orig_post; + wp_set_current_user( $old_uid ); + } + + /** + * @ticket 30287 + */ + public function test_get_adjacent_post_should_return_private_posts_belonging_to_other_users_if_the_current_user_can_read_private_posts() { + $u1 = $this->factory->user->create( array( 'role' => 'author' ) ); + $u2 = $this->factory->user->create( array( 'role' => 'administrator' ) ); + $old_uid = get_current_user_id(); + wp_set_current_user( $u2 ); + + $now = time(); + $p1 = $this->factory->post->create( array( 'post_author' => $u1, 'post_status' => 'private', 'post_date' => date( 'Y-m-d H:i:s', $now - 1 ) ) ); + $p2 = $this->factory->post->create( array( 'post_author' => $u1, 'post_date' => date( 'Y-m-d H:i:s', $now ) ) ); + + if ( ! isset( $GLOBALS['post'] ) ) { + $GLOBALS['post'] = null; + } + $orig_post = $GLOBALS['post']; + + $GLOBALS['post'] = get_post( $p2 ); + + $p = get_adjacent_post(); + $this->assertEquals( $p1, $p->ID ); + + $GLOBALS['post'] = $orig_post; + wp_set_current_user( $old_uid ); + } + + /** + * @ticket 30287 + */ + public function test_get_adjacent_post_should_not_return_private_posts_belonging_to_other_users_if_the_current_user_cannot_read_private_posts() { + $u1 = $this->factory->user->create( array( 'role' => 'author' ) ); + $u2 = $this->factory->user->create( array( 'role' => 'author' ) ); + $old_uid = get_current_user_id(); + wp_set_current_user( $u2 ); + + $now = time(); + $p1 = $this->factory->post->create( array( 'post_author' => $u1, 'post_date' => date( 'Y-m-d H:i:s', $now - 2 ) ) ); + $p2 = $this->factory->post->create( array( 'post_author' => $u1, 'post_status' => 'private', 'post_date' => date( 'Y-m-d H:i:s', $now - 1 ) ) ); + $p3 = $this->factory->post->create( array( 'post_author' => $u1, 'post_date' => date( 'Y-m-d H:i:s', $now ) ) ); + + if ( ! isset( $GLOBALS['post'] ) ) { + $GLOBALS['post'] = null; + } + $orig_post = $GLOBALS['post']; + + $GLOBALS['post'] = get_post( $p3 ); + + $p = get_adjacent_post(); + $this->assertEquals( $p1, $p->ID ); + + $GLOBALS['post'] = $orig_post; + wp_set_current_user( $old_uid ); } /**