In `get_adjacent_post()`, return private post if the current user has the capacity to read it.
This mirrors the check that happens post-query in `WP_Query`. See #30911. Props bswatson. Fixes #30287. git-svn-id: https://develop.svn.wordpress.org/trunk@31302 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
parent
9f8e5d3c17
commit
9cb4d3c1ce
|
@ -1521,6 +1521,36 @@ function get_adjacent_post( $in_same_term = false, $excluded_terms = '', $previo
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// 'post_status' clause depends on the current user.
|
||||||
|
if ( is_user_logged_in() ) {
|
||||||
|
$user_id = get_current_user_id();
|
||||||
|
|
||||||
|
$post_type_object = get_post_type_object( $post->post_type );
|
||||||
|
if ( empty( $post_type_object ) ) {
|
||||||
|
$post_type_cap = $post->post_type;
|
||||||
|
$read_private_cap = 'read_private_' . $post_type_cap . 's';
|
||||||
|
} else {
|
||||||
|
$read_private_cap = $post_type_object->cap->read_private_posts;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Results should include private posts belonging to the current user, or private posts where the
|
||||||
|
* current user has the 'read_private_posts' cap.
|
||||||
|
*/
|
||||||
|
$private_states = get_post_stati( array( 'private' => true ) );
|
||||||
|
$where .= " AND ( p.post_status = 'publish'";
|
||||||
|
foreach ( (array) $private_states as $state ) {
|
||||||
|
if ( current_user_can( $read_private_cap ) ) {
|
||||||
|
$where .= $wpdb->prepare( " OR p.post_status = %s", $state );
|
||||||
|
} else {
|
||||||
|
$where .= $wpdb->prepare( " OR (p.post_author = %d AND p.post_status = %s)", $user_id, $state );
|
||||||
|
}
|
||||||
|
}
|
||||||
|
$where .= " )";
|
||||||
|
} else {
|
||||||
|
$where .= " AND p.post_status = 'publish'";
|
||||||
|
}
|
||||||
|
|
||||||
$adjacent = $previous ? 'previous' : 'next';
|
$adjacent = $previous ? 'previous' : 'next';
|
||||||
$op = $previous ? '<' : '>';
|
$op = $previous ? '<' : '>';
|
||||||
$order = $previous ? 'DESC' : 'ASC';
|
$order = $previous ? 'DESC' : 'ASC';
|
||||||
|
@ -1551,7 +1581,7 @@ function get_adjacent_post( $in_same_term = false, $excluded_terms = '', $previo
|
||||||
* @param bool $in_same_term Whether post should be in a same taxonomy term.
|
* @param bool $in_same_term Whether post should be in a same taxonomy term.
|
||||||
* @param array $excluded_terms Array of excluded term IDs.
|
* @param array $excluded_terms Array of excluded term IDs.
|
||||||
*/
|
*/
|
||||||
$where = apply_filters( "get_{$adjacent}_post_where", $wpdb->prepare( "WHERE p.post_date $op %s AND p.post_type = %s AND p.post_status = 'publish' $where", $current_post_date, $post->post_type ), $in_same_term, $excluded_terms );
|
$where = apply_filters( "get_{$adjacent}_post_where", $wpdb->prepare( "WHERE p.post_date $op %s AND p.post_type = %s $where", $current_post_date, $post->post_type ), $in_same_term, $excluded_terms );
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Filter the ORDER BY clause in the SQL for an adjacent post query.
|
* Filter the ORDER BY clause in the SQL for an adjacent post query.
|
||||||
|
|
|
@ -279,10 +279,10 @@ class Tests_URL extends WP_UnitTestCase {
|
||||||
force_ssl_login( $forced_login );
|
force_ssl_login( $forced_login );
|
||||||
}
|
}
|
||||||
|
|
||||||
function test_get_adjacent_post() {
|
public function test_get_adjacent_post() {
|
||||||
$post_id = $this->factory->post->create();
|
$now = time();
|
||||||
sleep( 1 ); // get_adjacent_post() doesn't handle posts created in the same second.
|
$post_id = $this->factory->post->create( array( 'post_date' => date( 'Y-m-d H:i:s', $now - 1 ) ) );
|
||||||
$post_id2 = $this->factory->post->create();
|
$post_id2 = $this->factory->post->create( array( 'post_date' => date( 'Y-m-d H:i:s', $now ) ) );
|
||||||
|
|
||||||
if ( ! isset( $GLOBALS['post'] ) )
|
if ( ! isset( $GLOBALS['post'] ) )
|
||||||
$GLOBALS['post'] = null;
|
$GLOBALS['post'] = null;
|
||||||
|
@ -306,9 +306,89 @@ class Tests_URL extends WP_UnitTestCase {
|
||||||
$this->assertNull( get_adjacent_post() );
|
$this->assertNull( get_adjacent_post() );
|
||||||
|
|
||||||
$GLOBALS['post'] = $orig_post;
|
$GLOBALS['post'] = $orig_post;
|
||||||
|
}
|
||||||
|
|
||||||
// Tests requiring creating more posts can't be run since the query
|
/**
|
||||||
// cache in get_adjacent_post() requires a fresh page load to invalidate.
|
* Test get_adjacent_post returns the next private post when the author is the currently logged in user.
|
||||||
|
*
|
||||||
|
* @ticket 30287
|
||||||
|
*/
|
||||||
|
public function test_get_adjacent_post_should_return_private_posts_belonging_to_the_current_user() {
|
||||||
|
$u = $this->factory->user->create( array( 'role' => 'author' ) );
|
||||||
|
$old_uid = get_current_user_id();
|
||||||
|
wp_set_current_user( $u );
|
||||||
|
|
||||||
|
$now = time();
|
||||||
|
$p1 = $this->factory->post->create( array( 'post_author' => $u, 'post_status' => 'private', 'post_date' => date( 'Y-m-d H:i:s', $now - 1 ) ) );
|
||||||
|
$p2 = $this->factory->post->create( array( 'post_author' => $u, 'post_date' => date( 'Y-m-d H:i:s', $now ) ) );
|
||||||
|
|
||||||
|
if ( ! isset( $GLOBALS['post'] ) ) {
|
||||||
|
$GLOBALS['post'] = null;
|
||||||
|
}
|
||||||
|
$orig_post = $GLOBALS['post'];
|
||||||
|
|
||||||
|
$GLOBALS['post'] = get_post( $p2 );
|
||||||
|
|
||||||
|
$p = get_adjacent_post();
|
||||||
|
$this->assertEquals( $p1, $p->ID );
|
||||||
|
|
||||||
|
$GLOBALS['post'] = $orig_post;
|
||||||
|
wp_set_current_user( $old_uid );
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @ticket 30287
|
||||||
|
*/
|
||||||
|
public function test_get_adjacent_post_should_return_private_posts_belonging_to_other_users_if_the_current_user_can_read_private_posts() {
|
||||||
|
$u1 = $this->factory->user->create( array( 'role' => 'author' ) );
|
||||||
|
$u2 = $this->factory->user->create( array( 'role' => 'administrator' ) );
|
||||||
|
$old_uid = get_current_user_id();
|
||||||
|
wp_set_current_user( $u2 );
|
||||||
|
|
||||||
|
$now = time();
|
||||||
|
$p1 = $this->factory->post->create( array( 'post_author' => $u1, 'post_status' => 'private', 'post_date' => date( 'Y-m-d H:i:s', $now - 1 ) ) );
|
||||||
|
$p2 = $this->factory->post->create( array( 'post_author' => $u1, 'post_date' => date( 'Y-m-d H:i:s', $now ) ) );
|
||||||
|
|
||||||
|
if ( ! isset( $GLOBALS['post'] ) ) {
|
||||||
|
$GLOBALS['post'] = null;
|
||||||
|
}
|
||||||
|
$orig_post = $GLOBALS['post'];
|
||||||
|
|
||||||
|
$GLOBALS['post'] = get_post( $p2 );
|
||||||
|
|
||||||
|
$p = get_adjacent_post();
|
||||||
|
$this->assertEquals( $p1, $p->ID );
|
||||||
|
|
||||||
|
$GLOBALS['post'] = $orig_post;
|
||||||
|
wp_set_current_user( $old_uid );
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @ticket 30287
|
||||||
|
*/
|
||||||
|
public function test_get_adjacent_post_should_not_return_private_posts_belonging_to_other_users_if_the_current_user_cannot_read_private_posts() {
|
||||||
|
$u1 = $this->factory->user->create( array( 'role' => 'author' ) );
|
||||||
|
$u2 = $this->factory->user->create( array( 'role' => 'author' ) );
|
||||||
|
$old_uid = get_current_user_id();
|
||||||
|
wp_set_current_user( $u2 );
|
||||||
|
|
||||||
|
$now = time();
|
||||||
|
$p1 = $this->factory->post->create( array( 'post_author' => $u1, 'post_date' => date( 'Y-m-d H:i:s', $now - 2 ) ) );
|
||||||
|
$p2 = $this->factory->post->create( array( 'post_author' => $u1, 'post_status' => 'private', 'post_date' => date( 'Y-m-d H:i:s', $now - 1 ) ) );
|
||||||
|
$p3 = $this->factory->post->create( array( 'post_author' => $u1, 'post_date' => date( 'Y-m-d H:i:s', $now ) ) );
|
||||||
|
|
||||||
|
if ( ! isset( $GLOBALS['post'] ) ) {
|
||||||
|
$GLOBALS['post'] = null;
|
||||||
|
}
|
||||||
|
$orig_post = $GLOBALS['post'];
|
||||||
|
|
||||||
|
$GLOBALS['post'] = get_post( $p3 );
|
||||||
|
|
||||||
|
$p = get_adjacent_post();
|
||||||
|
$this->assertEquals( $p1, $p->ID );
|
||||||
|
|
||||||
|
$GLOBALS['post'] = $orig_post;
|
||||||
|
wp_set_current_user( $old_uid );
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|
Loading…
Reference in New Issue