[wp-trac] [WordPress Trac] #5272: WordPress allows anonymous user to see slug for private post by guessing post number
WordPress Trac
noreply at wordpress.org
Wed Nov 4 18:10:34 UTC 2020
#5272: WordPress allows anonymous user to see slug for private post by guessing
post number
-------------------------------------------------+-------------------------
Reporter: tzafrir | Owner:
| SergeyBiryukov
Type: defect (bug) | Status: reviewing
Priority: normal | Milestone: 5.6
Component: Security | Version: 2.3.1
Severity: normal | Resolution:
Keywords: has-patch needs-testing has-unit- | Focuses:
tests |
-------------------------------------------------+-------------------------
Comment (by whyisjake):
In conversation with @dd32:
I’d personally lean towards get_post_status_object( $status )->public as
the filterable way, but private isn’t a public post status.
--
Ticket URL: <https://core.trac.wordpress.org/ticket/5272#comment:19>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform
More information about the wp-trac
mailing list