| @@ -62,9 +62,13 @@ | ||
| 62 | 62 | |
| 63 | 63 | // Determine which post types to query. An explicit single post type narrows |
| 64 | 64 | // the search; 'all' (or no value) searches the whole forum: forums, topics |
| 65 | 65 | // and replies, so content matches from any of them are returned. |
| 66 | - if ( ! empty( $post_type ) && 'all' !== $post_type ) { | |
| 66 | + // Only public post types may be searched; anything else falls back to the | |
| 67 | + // forum-wide search instead of exposing non-public content. | |
| 68 | + $post_type_object = ( ! empty( $post_type ) && 'all' !== $post_type ) ? get_post_type_object( $post_type ) : null; | |
| 69 | + | |
| 70 | + if ( $post_type_object && $post_type_object->public ) { | |
| 67 | 71 | $query_post_types = array( $post_type ); |
| 68 | 72 | } elseif ( class_exists( 'bbPress' ) ) { |
| 69 | 73 | $query_post_types = array( 'forum', 'topic', 'reply' ); |
| 70 | 74 | } else { |
| @@ -71,13 +75,20 @@ | ||
| 71 | 75 | $query_post_types = array( 'post' ); |
| 72 | 76 | } |
| 73 | 77 | |
| 74 | 78 | // Determine which statuses to include. bbPress stores closed topics with the |
| 75 | - // 'closed' post status (and uses 'private'/'hidden' for restricted forums), | |
| 76 | - // none of which are returned by WP_Query's default 'publish'-only behavior. | |
| 77 | - // Include the publicly viewable bbPress statuses so closed topics still match. | |
| 79 | + // 'closed' post status, which WP_Query's default 'publish'-only behavior skips. | |
| 80 | + // Private/hidden forums are only searchable by users allowed to read them. | |
| 78 | 81 | if ( class_exists( 'bbPress' ) ) { |
| 79 | - $query_post_status = array( 'publish', 'closed', 'private', 'hidden' ); | |
| 82 | + $query_post_status = array( 'publish', 'closed' ); | |
| 83 | + | |
| 84 | + if ( current_user_can( 'read_private_forums' ) ) { | |
| 85 | + $query_post_status[] = 'private'; | |
| 86 | + } | |
| 87 | + | |
| 88 | + if ( current_user_can( 'read_hidden_forums' ) ) { | |
| 89 | + $query_post_status[] = 'hidden'; | |
| 90 | + } | |
| 80 | 91 | } else { |
| 81 | 92 | $query_post_status = array( 'publish' ); |
| 82 | 93 | } |
| 83 | 94 | |
| @@ -103,13 +114,14 @@ | ||
| 103 | 114 | add_filter( 'posts_search', $bbpc_search_clause, 999, 2 ); |
| 104 | 115 | |
| 105 | 116 | // Main results query. |
| 106 | 117 | $results = new \WP_Query( array( |
| 107 | - 'post_type' => $query_post_types, | |
| 108 | - 'post_status' => $query_post_status, | |
| 109 | - 's' => $keyword, | |
| 110 | - 'posts_per_page' => 10, | |
| 111 | - 'bbpc_ajax_search' => true, | |
| 118 | + 'post_type' => $query_post_types, | |
| 119 | + 'post_status' => $query_post_status, | |
| 120 | + 's' => $keyword, | |
| 121 | + 'posts_per_page' => 10, | |
| 122 | + 'bbpc_ajax_search' => true, | |
| 123 | + 'update_post_term_cache' => false, | |
| 112 | 124 | ) ); |
| 113 | 125 | |
| 114 | 126 | remove_filter( 'posts_search', $bbpc_search_clause, 999 ); |
| 115 | 127 | |
