vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-11 12:20:22 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Canonical: Prevent ID enumeration of private post slugs.

Browse Source 
Add check to `redirect_canonical()` to ensure private posts only redirect for logged in users.

Modifies the `read_post` mata capability to user `get_post_status()` rather than the post's `post_status` property to allow attachments to redirect based on the inherited post status.

Introduces `wp_force_ugly_post_permalink()` to unify the check to determine if an ugly link should be displayed in each of the functions used for determining permalinks: `get_permalink()`, `get_post_permalink()`, `_get_page_link()` and `get_attachment_link()`.

Improves logic of `get_attachment_link()` to validate parent post and resolution of inherited post status. This is an incomplete fix of #52373 to prevent the function returning links resulting in a file not found error. Required to unblock this ticket.

Props peterwilsoncc, TimothyBlynJacobs.
See #52373.
Fixes #5272.


git-svn-id: https://develop.svn.wordpress.org/trunk@50132 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Peter Wilson
2021-02-02 00:38:40 +00:00
parent 051aa92e3d
commit 553d618e4a
6 changed files with 1102 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/phpunit/tests/link.php
+4 -1
View File
@@ -204,6 +204,9 @@ class Tests_Link extends WP_UnitTestCase {
}
}
$this->assertSame( home_url( user_trailingslashit( $attachment->post_name ) ), get_permalink( $attachment_id ) );
$this->assertSame( home_url( "/?attachment_id={$attachment->ID}" ), get_permalink( $attachment_id ) );
// Visit permalink.
$this->go_to( get_permalink( $attachment_id ) );
$this->assertQueryTrue( 'is_attachment', 'is_single', 'is_singular' );
}
}