Sitemaps: Exclude post types and taxonomies that are not publicly queryable.

Props Cybr.
Fixes #50607.

git-svn-id: https://develop.svn.wordpress.org/trunk@48474 602fd350-edb4-49c9-b593-d223f7449a82

src/wp-includes/sitemaps/providers/class-wp-sitemaps-posts.php

@@ -37,6 +37,8 @@ class WP_Sitemaps_Posts extends WP_Sitemaps_Provider {
 		$post_types = get_post_types( array( 'public' => true ), 'objects' );
 		unset( $post_types['attachment'] );
 
+		$post_types = array_filter( $post_types, 'is_post_type_viewable' );
+
 		/**
 		 * Filters the list of post object sub types available within the sitemap.
 		 *

src/wp-includes/sitemaps/providers/class-wp-sitemaps-taxonomies.php

@@ -35,6 +35,8 @@ class WP_Sitemaps_Taxonomies extends WP_Sitemaps_Provider {
 	public function get_object_subtypes() {
 		$taxonomies = get_taxonomies( array( 'public' => true ), 'objects' );
 
+		$taxonomies = array_filter( $taxonomies, 'is_taxonomy_viewable' );
+
 		/**
 		 * Filter the list of taxonomy object subtypes available within the sitemap.
 		 *

tests/phpunit/tests/sitemaps/sitemaps-taxonomies.php

@@ -142,6 +142,30 @@ class Test_WP_Sitemaps_Taxonomies extends WP_UnitTestCase {
 		$this->assertEmpty( $post_list, 'Private taxonomy term links are visible.' );
 	}
 
+	/**
+	 * Test getting a URL list for a custom taxonomy that is not publicly queryable.
+	 */
+	public function test_get_url_list_custom_taxonomy_not_publicly_queryable() {
+		// Create a custom taxonomy for this test.
+		$taxonomy = 'non_queryable_tax';
+		register_taxonomy( $taxonomy, 'post', array( 'publicly_queryable' => false ) );
+
+		// Create test terms in the custom taxonomy.
+		$terms = self::factory()->term->create_many( 10, array( 'taxonomy' => $taxonomy ) );
+
+		// Create a test post applied to all test terms.
+		self::factory()->post->create( array( 'tax_input' => array( $taxonomy => $terms ) ) );
+
+		$tax_provider = new WP_Sitemaps_Taxonomies();
+
+		$post_list = $tax_provider->get_url_list( 1, $taxonomy );
+
+		// Clean up.
+		unregister_taxonomy_for_object_type( $taxonomy, 'post' );
+
+		$this->assertEmpty( $post_list, 'Private taxonomy term links are visible.' );
+	}
+
 	/**
 	 * Test sitemap index entries with public and private taxonomies.
 	 */
@@ -150,10 +174,12 @@ class Test_WP_Sitemaps_Taxonomies extends WP_UnitTestCase {
 
 		// Create a custom public and private taxonomies for this test.
 		register_taxonomy( 'public_taxonomy', 'post' );
+		register_taxonomy( 'non_queryable_taxonomy', 'post', array( 'publicly_queryable' => false ) );
 		register_taxonomy( 'private_taxonomy', 'post', array( 'public' => false ) );
 
 		// Create test terms in the custom taxonomy.
 		$public_term        = self::factory()->term->create( array( 'taxonomy' => 'public_taxonomy' ) );
+		$non_queryable_term = self::factory()->term->create( array( 'taxonomy' => 'non_queryable_taxonomy' ) );
 		$private_term       = self::factory()->term->create( array( 'taxonomy' => 'private_taxonomy' ) );
 
 		// Create a test post applied to all test terms.
@@ -161,6 +187,7 @@ class Test_WP_Sitemaps_Taxonomies extends WP_UnitTestCase {
 			array(
 				'tax_input' => array(
 					'public_taxonomy'        => array( $public_term ),
+					'non_queryable_taxonomy' => array( $non_queryable_term ),
 					'private_taxonomy'       => array( $private_term ),
 				),
 			)
@@ -171,9 +198,11 @@ class Test_WP_Sitemaps_Taxonomies extends WP_UnitTestCase {
 
 		// Clean up.
 		unregister_taxonomy_for_object_type( 'public_taxonomy', 'post' );
+		unregister_taxonomy_for_object_type( 'non_queryable_taxonomy', 'post' );
 		unregister_taxonomy_for_object_type( 'private_taxonomy', 'post' );
 
 		$this->assertContains( 'http://' . WP_TESTS_DOMAIN . '/?sitemap=taxonomies&sitemap-subtype=public_taxonomy&paged=1', $entries, 'Public Taxonomies are not in the index.' );
+		$this->assertNotContains( 'http://' . WP_TESTS_DOMAIN . '/?sitemap=taxonomies&sitemap-subtype=non_queryable_taxonomy&paged=1', $entries, 'Private Taxonomies are visible in the index.' );
 		$this->assertNotContains( 'http://' . WP_TESTS_DOMAIN . '/?sitemap=taxonomies&sitemap-subtype=private_taxonomy&paged=1', $entries, 'Private Taxonomies are visible in the index.' );
 	}
 

tests/phpunit/tests/sitemaps/sitemaps.php

@@ -191,6 +191,29 @@ class Test_Sitemaps extends WP_UnitTestCase {
 		$this->assertNotContains( 'http://' . WP_TESTS_DOMAIN . '/?sitemap=posts&sitemap-subtype=private_cpt&paged=1', $entries, 'Private CPTs are visible in the index.' );
 	}
 
+	/**
+	 * Test sitemap index entries with public and private custom post types.
+	 *
+	 * @ticket 50607
+	 */
+	public function test_get_sitemap_entries_not_publicly_queryable_post_types() {
+		register_post_type(
+			'non_queryable_cpt',
+			array(
+				'public'             => true,
+				'publicly_queryable' => false,
+			)
+		);
+		self::factory()->post->create( array( 'post_type' => 'non_queryable_cpt' ) );
+
+		$entries = wp_list_pluck( $this->_get_sitemap_entries(), 'loc' );
+
+		// Clean up.
+		unregister_post_type( 'non_queryable_cpt' );
+
+		$this->assertNotContains( 'http://' . WP_TESTS_DOMAIN . '/?sitemap=posts&sitemap-subtype=non_queryable_cpt&paged=1', $entries, 'Non-publicly queryable CPTs are visible in the index.' );
+	}
+
 	/**
 	 * Tests getting a URL list for post type post.
 	 */
@@ -307,6 +330,34 @@ class Test_Sitemaps extends WP_UnitTestCase {
 		$this->assertEmpty( $post_list, 'Private post types may be returned by the post provider.' );
 	}
 
+	/**
+	 * Tests getting a URL list for a private custom post type.
+	 *
+	 * @ticket 50607
+	 */
+	public function test_get_url_list_cpt_not_publicly_queryable() {
+		$post_type = 'non_queryable_cpt';
+
+		register_post_type(
+			$post_type,
+			array(
+				'public'             => true,
+				'publicly_queryable' => false,
+			)
+		);
+
+		self::factory()->post->create_many( 10, array( 'post_type' => $post_type ) );
+
+		$providers = wp_get_sitemaps();
+
+		$post_list = $providers['posts']->get_url_list( 1, $post_type );
+
+		// Clean up.
+		unregister_post_type( $post_type );
+
+		$this->assertEmpty( $post_list, 'Non-publicly queryable post types may be returned by the post provider.' );
+	}
+
 	/**
 	 * Helper function for building an expected url list.
 	 *