[wp-trac] [WordPress Trac] #51094: WP_Query.query with invalid post_status will return all

[WordPress Trac]

#51094: WP_Query.query with invalid post_status will return all
------------------------------------+-----------------------------
 Reporter:  carsonreinke            |       Owner:  metalandcoffee
     Type:  defect (bug)            |      Status:  accepted
 Priority:  normal                  |   Milestone:  5.7
Component:  Query                   |     Version:  3.9
 Severity:  critical                |  Resolution:
 Keywords:  dev-feedback has-patch  |     Focuses:
------------------------------------+-----------------------------
Changes (by metalandcoffee):

 * keywords:  needs-patch => dev-feedback has-patch
 * owner:  (none) => metalandcoffee
 * status:  new => accepted
 * milestone:  Awaiting Review => 5.7


Comment:

 Hi again! I'd like to propose a patch although this would require some
 major dev feedback since I do not want to risk breaking other aspects of
 the WP_Query class.

 Like @carsonreinke pointed out, this bug does result in posts with any
 post stati being returned (including trashed and auto-draft posts) so I
 think it's worth fixing.

 In my patch, I changed from looping through the available post stati to
 looping through the post stati provided in the custom query. This results
 in the following generated SQL statement if a custom query has invalid
 post stati:

 `SELECT SQL_CALC_FOUND_ROWS  wp_posts.ID FROM wp_posts  WHERE 1=1  AND
 wp_posts.post_type = 'post' AND ((wp_posts.post_status = 'fakestatus' OR
 wp_posts.post_status = 'publishe'))  ORDER BY wp_posts.post_date DESC
 LIMIT 0, 10`

 This results in 0 posts being returned which is what we want if we enter
 something invalid.

 I set the milestone to 5.7 because it'd be nice to get this fix in there
 :)

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/51094#comment:6>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform