From 8530693a5119b18556f8b7a6a0a5000575e0edfe Mon Sep 17 00:00:00 2001
From: Scott Taylor <wonderboymusic@git.wordpress.org>
Date: Thu, 29 May 2014 06:03:15 +0000
Subject: [PATCH] If `post__in` or `post_parent__in` is passed to `WP_Query` as
 an empty array, nuke the query. Both vars are currently only checked for
 truthiness after which they are ignored. Setting these vars at all indicates
 explicit filtering being desired.

Adds unit test.

Fixes #28099.


git-svn-id: https://develop.svn.wordpress.org/trunk@28613 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-includes/query.php             | 6 ++++++
 tests/phpunit/tests/query/results.php | 9 +++++++++
 2 files changed, 15 insertions(+)

diff --git a/src/wp-includes/query.php b/src/wp-includes/query.php
index 4b5aa1730c..2dcc95c949 100644
--- a/src/wp-includes/query.php
+++ b/src/wp-includes/query.php
@@ -2448,6 +2448,9 @@ class WP_Query {
 		} elseif ( $q['post__in'] ) {
 			$post__in = implode(',', array_map( 'absint', $q['post__in'] ));
 			$where .= " AND {$wpdb->posts}.ID IN ($post__in)";
+		} elseif ( isset( $this->query['post__in'] ) ) {
+			$post__in = 0;
+			$where .= " AND 1=0 ";
 		} elseif ( $q['post__not_in'] ) {
 			$post__not_in = implode(',',  array_map( 'absint', $q['post__not_in'] ));
 			$where .= " AND {$wpdb->posts}.ID NOT IN ($post__not_in)";
@@ -2458,6 +2461,9 @@ class WP_Query {
 		} elseif ( $q['post_parent__in'] ) {
 			$post_parent__in = implode( ',', array_map( 'absint', $q['post_parent__in'] ) );
 			$where .= " AND {$wpdb->posts}.post_parent IN ($post_parent__in)";
+		} elseif ( isset( $this->query['post_parent__in'] ) ) {
+			$post_parent__in = 0;
+			$where .= " AND 1=0 ";
 		} elseif ( $q['post_parent__not_in'] ) {
 			$post_parent__not_in = implode( ',',  array_map( 'absint', $q['post_parent__not_in'] ) );
 			$where .= " AND {$wpdb->posts}.post_parent NOT IN ($post_parent__not_in)";
diff --git a/tests/phpunit/tests/query/results.php b/tests/phpunit/tests/query/results.php
index 20c45ba446..9c4ce065f9 100644
--- a/tests/phpunit/tests/query/results.php
+++ b/tests/phpunit/tests/query/results.php
@@ -402,6 +402,15 @@ class Tests_Query_Results extends WP_UnitTestCase {
 
 	}
 
+	function test_empty_post__in() {
+		$posts1 = $this->q->query( array() );
+		$this->assertNotEmpty( $posts1 );
+		$posts2 = $this->q->query( array( 'post__in' => array() ) );
+		$this->assertEmpty( $posts2 );
+		$posts3 = $this->q->query( array( 'post_parent__in' => array() ) );
+		$this->assertEmpty( $posts3 );
+	}
+
 	function test_exlude_from_search_empty() {
 		global $wp_post_types;
 		foreach ( array_keys( $wp_post_types ) as $slug )