Changeset 57645

Timestamp:

02/16/2024 11:32:48 PM (5 months ago)

Author:

peterwilsoncc

Message:

Canonical: Limit post types searched by redirect_guess_404_permalink().

Limit the post types searched in redirect_guess_404_permalink() to public, searchable post types. This prevents redirects to 404 pages and the exposure of private post type slugs.

Props francescocarlucci, peterwilsoncc, rajinsharwar.
Fixes #59795.

Location:

trunk

Files:

• src/wp-includes/canonical.php (modified) (3 diffs)
• tests/phpunit/tests/canonical.php (modified) (2 diffs)

trunk/src/wp-includes/canonical.php

@@ -950 +950 @@
 
     if ( get_query_var( 'name' ) ) {
+
+
+
         /**
          * Filters whether to perform a strict guess for a 404 redirect.
@@ -970 +973 @@
         if ( get_query_var( 'post_type' ) ) {
             if ( is_array( get_query_var( 'post_type' ) ) ) {
+
+
+
+
                 $where .= " AND post_type IN ('" . join( "', '", esc_sql( get_query_var( 'post_type' ) ) ) . "')";
             } else {
+
+
+
                 $where .= $wpdb->prepare( ' AND post_type = %s', get_query_var( 'post_type' ) );
             }
         } else {
-            $where .= " AND post_type IN ('" . implode( "', '", get_post_types( array( 'public' => true ) ) ) . "')";
+            $where .= " AND post_type IN ('" . implode( "', '",  ) ) . "')";
         }
 
@@ -988 +998 @@
         }
 
-        $publicly_viewable_statuses = array_filter( get_post_stati(), 'is_post_status_viewable' );
         // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
         $post_id = $wpdb->get_var( "SELECT ID FROM $wpdb->posts WHERE $where AND post_status IN ('" . implode( "', '", esc_sql( $publicly_viewable_statuses ) ) . "')" );

trunk/tests/phpunit/tests/canonical.php

@@ -11 +11 @@
 class Tests_Canonical extends WP_Canonical_UnitTestCase {
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
     public function set_up() {
         parent::set_up();
         wp_set_current_user( self::$author_id );
+
 
         update_option( 'wp_attachment_pages_enabled', 1 );
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
     }
 
@@ -344 +378 @@
      *
      * @ticket 43056
-     */
-    public function test_redirect_guess_404_permalink_post_types() {
-        /*
-         * Sample-page is intentionally missspelt as sample-pag to ensure
-         * the 404 post permalink guessing runs.
-         *
-         * Please do not correct the apparent typo.
-         */
-
-        // String format post type.
-        $this->assertCanonical( '/?name=sample-pag&post_type=page', '/sample-page/' );
-        // Array formatted post type or types.
-        $this->assertCanonical( '/?name=sample-pag&post_type[]=page', '/sample-page/' );
-        $this->assertCanonical( '/?name=sample-pag&post_type[]=page&post_type[]=post', '/sample-page/' );
+     * @ticket 59795
+     *
+     * @dataProvider data_redirect_guess_404_permalink_post_types
+     */
+    public function test_redirect_guess_404_permalink_post_types( $original_url, $expected ) {
+        $this->assertCanonical( $original_url, $expected );
+    }
+
+    /**
+     * Data provider for test_redirect_guess_404_permalink_post_types().
+     *
+     * In the original URLs the post names are intentionally misspelled
+     * to test the redirection.
+     *
+     * Please do not correct the apparent typos.
+     *
+     * @return array[]
+     */
+    public function data_redirect_guess_404_permalink_post_types() {
+        return array(
+            'single string formatted post type'    => array(
+                'original_url' => '/?name=sample-pag&post_type=page',
+                'expected'     => '/sample-page/',
+            ),
+            'single array formatted post type'     => array(
+                'original_url' => '/?name=sample-pag&post_type[]=page',
+                'expected'     => '/sample-page/',
+            ),
+            'multiple array formatted post type'   => array(
+                'original_url' => '/?name=sample-pag&post_type[]=page&post_type[]=post',
+                'expected'     => '/sample-page/',
+            ),
+            'do not redirect to private post type' => array(
+                'original_url' => '/?name=private-cpt-po&post_type[]=wp_tests_private',
+                'expected'     => '/?name=private-cpt-po&post_type[]=wp_tests_private',
+            ),
+        );
     }