← All changes | lib/access/class-groups-post-access.php +1067 -168 1.11.3 → 4.7.0 View file →

		@@ -24,40 +24,75 @@
24	24	}
25	25
26	26	/**
27	27	* Post access restrictions.
28		- *
29		- * @todo when wp_count_posts() provides reasonable filters, use them so that
30		- * the post counts displayed on top are in line with the actual posts that
31		- * are displayed in the table; same for wp_count_attachments()
32		- * @see http://core.trac.wordpress.org/ticket/16603
33		- *
34	28	*/
35	29	class Groups_Post_Access {
36	30
	31	+ /**
	32	+ * @var string
	33	+ */
37	34	const POSTMETA_PREFIX = 'groups-';
38	35
39		- const CACHE_GROUP = 'groups';
40		- const CAN_READ_POST = 'can_read_post';
	36	+ /**
	37	+ * @var string
	38	+ */
	39	+ const READ = 'read';
41	40
42		- const READ_POST_CAPABILITY = "groups_read_post";
43		- const READ_POST_CAPABILITY_NAME = "Read Post";
	41	+ /**
	42	+ * @var string
	43	+ */
	44	+ const CACHE_GROUP = 'groups';
	45	+
	46	+ /**
	47	+ *
	48	+ * @var string
	49	+ */
	50	+ const CAN_READ_POST = 'can_read_post';
	51	+
	52	+ /**
	53	+ * @deprecated
	54	+ * @var string
	55	+ */
	56	+ const READ_POST_CAPABILITY = 'groups_read_post';
	57	+
	58	+ /**
	59	+ * @deprecated
	60	+ * @var string
	61	+ */
	62	+ const READ_POST_CAPABILITY_NAME = 'Read Post';
	63	+
	64	+ /**
	65	+ * @deprecated
	66	+ * @var string
	67	+ */
44	68	const READ_POST_CAPABILITIES = 'read_post_capabilities';
	69	+
	70	+ /**
	71	+ * @var string
	72	+ */
45	73	const POST_TYPES = 'post_types';
46	74
47	75	/**
48		- * Create needed capabilities on plugin activation.
49		- * Must be called explicitly or hooked into activation.
	76	+ * @since 2.20.0
	77	+ *
	78	+ * @var \WP_Block block for which to filter
50	79	*/
	80	+ private static $filter_get_terms_block = null;
	81	+
	82	+ /**
	83	+ * @since 2.20.0
	84	+ *
	85	+ * @var array widget for which to filter
	86	+ */
	87	+ private static $filter_get_terms_widget = null;
	88	+
	89	+ /**
	90	+ * Work done on activation, currently does nothing.
	91	+ *
	92	+ * @see Groups_Controller::activate()
	93	+ */
51	94	public static function activate() {
52		- if ( !Groups_Capability::read_by_capability( self::READ_POST_CAPABILITY ) ) {
53		- Groups_Capability::create( array( "capability" => self::READ_POST_CAPABILITY ) );
54		- // default read caps
55		- Groups_Options::update_option( Groups_Post_Access::READ_POST_CAPABILITIES, array( Groups_Post_Access::READ_POST_CAPABILITY ) );
56		- // for translation
57		- // @see self::READ_POST_CAPABILITY_NAME
58		- __( "Read Post", GROUPS_PLUGIN_DOMAIN );
59		- }
60	95	}
61	96
62	97	/**
63	98	* Sets up filters to restrict access.
		@@ -64,35 +99,108 @@
64	99	*/
65	100	public static function init() {
66	101	// post access
67	102	add_filter( 'posts_where', array( __CLASS__, 'posts_where' ), 10, 2 );
68		- add_filter( 'get_pages', array( __CLASS__, "get_pages" ), 1 );
	103	+ add_filter( 'get_pages', array( __CLASS__, 'get_pages' ), 1 );
69	104	if ( apply_filters( 'groups_filter_the_posts', false ) ) {
70		- add_filter( 'the_posts', array( __CLASS__, "the_posts" ), 1, 2 );
	105	+ add_filter( 'the_posts', array( __CLASS__, 'the_posts' ), 1, 2 );
71	106	}
72		- add_filter( 'wp_get_nav_menu_items', array( __CLASS__, "wp_get_nav_menu_items" ), 1, 3 );
	107	+ // If we had a get_post filter https://core.trac.wordpress.org/ticket/12955
	108	+ // add_filter( 'get_post', ... );
	109	+ add_filter( 'wp_get_nav_menu_items', array( __CLASS__, 'wp_get_nav_menu_items' ), 1, 3 );
73	110	// content access
74		- add_filter( "get_the_excerpt", array( __CLASS__, "get_the_excerpt" ), 1 );
75		- add_filter( "the_content", array( __CLASS__, "the_content" ), 1 );
	111	+ add_filter( 'get_the_excerpt', array( __CLASS__, 'get_the_excerpt' ), 1 );
	112	+ add_filter( 'the_content', array( __CLASS__, 'the_content' ), 1 );
76	113	// edit & delete post
77	114	add_filter( 'map_meta_cap', array( __CLASS__, 'map_meta_cap' ), 10, 4 );
78		- // @todo these could be interesting to add later ...
	115	+
	116	+ // These could be interesting to add later ...
79	117	// add_filter( "plugin_row_meta", array( __CLASS__, "plugin_row_meta" ), 1 );
80	118	// add_filter( "posts_join_paged", array( __CLASS__, "posts_join_paged" ), 1 );
81	119	// add_filter( "posts_where_paged", array( __CLASS__, "posts_where_paged" ), 1 );
82		- add_action( 'groups_deleted_capability_capability', array( __CLASS__, 'groups_deleted_capability_capability' ) );
	120	+
	121	+ add_action( 'groups_deleted_group', array( __CLASS__, 'groups_deleted_group' ) );
	122	+ add_filter( 'wp_count_posts', array( __CLASS__, 'wp_count_posts' ), 10, 3 );
	123	+
	124	+ // Enable the filter and implement below if needed to correct attachment counts ...
	125	+ // add_filter( 'wp_count_attachments', array( __CLASS__, 'wp_count_attachments' ), 10, 2 );
	126	+
	127	+ // REST API
	128	+ $post_types = self::get_handles_post_types();
	129	+ if ( !empty( $post_types ) ) {
	130	+ foreach ( $post_types as $post_type => $handles ) {
	131	+ if ( $handles ) {
	132	+ add_filter( "rest_prepare_{$post_type}", array( __CLASS__, 'rest_prepare_post' ), 10, 3 );
	133	+ }
	134	+ }
	135	+ }
	136	+
	137	+ // adjacent posts
	138	+ add_filter( 'get_previous_post_where', array( __CLASS__, 'get_previous_post_where' ), 10, 5 );
	139	+ add_filter( 'get_next_post_where', array( __CLASS__, 'get_next_post_where' ), 10, 5 );
	140	+ add_action( 'save_post', array( __CLASS__, 'save_post' ), PHP_INT_MAX );
	141	+ add_filter( 'attachment_fields_to_save', array( __CLASS__, 'attachment_fields_to_save' ), PHP_INT_MAX, 2 );
	142	+
	143	+ // @since 2.20.0
	144	+ add_filter( 'render_block', array( __CLASS__, 'render_block' ), 10, 3 );
	145	+ // @since 2.20.0
	146	+ add_filter( 'block_core_navigation_render_inner_blocks', array( __CLASS__, 'block_core_navigation_render_inner_blocks' ) );
	147	+
	148	+ // @since 2.20.0 adds our get_terms filter for Categories blocks:
	149	+ add_filter( 'pre_render_block', array( __CLASS__, 'pre_render_block' ), 10, 3 );
	150	+ // @since 2.20.0 adds our get_terms filter for Categories widgets rendered as list:
	151	+ add_filter( 'widget_categories_args', array( __CLASS__, 'widget_categories_args' ), 10, 2 );
	152	+ // @since 2.20.0 adds our get_terms filter for Categories widgets rendered as dropdown:
	153	+ add_filter( 'widget_categories_dropdown_args', array( __CLASS__, 'widget_categories_dropdown_args' ), 10, 2 );
83	154	}
84	155
85	156	/**
	157	+ * Replicates the response for invalid post IDs when unauthorized access to a post is requested.
	158	+ * There is no filter in WP_REST_Posts_Controller::get_post() nor in get_post() that we could use (WP 4.8).
	159	+ *
	160	+ * REST API Handbook https://developer.wordpress.org/rest-api/
	161	+ *
	162	+ * For development tests:
	163	+ *
	164	+ * 1. Install https://github.com/WP-API/Basic-Auth
	165	+ * 2. Protect post 1 with group "Test".
	166	+ * 3. Test access denied: $ curl http://example.com/wp-json/wp/v2/posts/1
	167	+ * 4. Test access granted $ curl --user username:password https://example.com/wp-json/wp/v2/posts/1
	168	+ *
	169	+ * On #4 username:password are cleartext, username must belong to group "Test".
	170	+ *
	171	+ * @param array $response
	172	+ * @param WP_Post $post
	173	+ * @param string $request
	174	+ *
	175	+ * @return string[]|number[][]
	176	+ */
	177	+ public static function rest_prepare_post( $response, $post, $request ) {
	178	+ if ( isset( $post->ID ) && !self::user_can_read_post( $post->ID ) ) {
	179	+ $response = array(
	180	+ 'code' => 'rest_post_invalid_id',
	181	+ 'message' => __( 'Invalid post ID.' ), // phpcs:ignore WordPress.WP.I18n.MissingArgDomain
	182	+ 'data' => array( 'status' => 404 )
	183	+ );
	184	+ }
	185	+ return $response;
	186	+ }
	187	+
	188	+ /**
86	189	* Restrict access to edit or delete posts based on the post's access restrictions.
87		- *
	190	+ *
88	191	* @param array $caps
89	192	* @param string $cap
90	193	* @param int $user_id
91	194	* @param array $args
	195	+ *
92	196	* @return array
93	197	*/
94	198	public static function map_meta_cap( $caps, $cap, $user_id, $args ) {
	199	+ // get user object before removing filter
	200	+ $user = function_exists( 'get_current_user_id' ) ? new Groups_User( get_current_user_id() ) : null;
	201	+ // @since 4.0.0 avoid potential infinite recursion
	202	+ remove_filter( 'map_meta_cap', array( __CLASS__, 'map_meta_cap' ), 10 );
95	203	if ( isset( $args[0] ) ) {
96	204	if ( strpos( $cap, 'edit_' ) === 0 || strpos( $cap, 'delete_' ) === 0 ) {
97	205	if ( $post_type = get_post_type( $args[0] ) ) {
98	206
		@@ -99,9 +207,9 @@
99	207	$edit_post_type = 'edit_' . $post_type;
100	208	$delete_post_type = 'delete_' . $post_type;
101	209	if ( $post_type_object = get_post_type_object( $post_type ) ) {
102	210	if ( !isset( $post_type_object->capabilities ) ) {
103		- $post_type_object->capabilities = array();
	211	+ $post_type_object->capabilities = array(); // @phpstan-ignore property.notFound
104	212	}
105	213	$caps_object = get_post_type_capabilities( $post_type_object );
106	214	if ( isset( $caps_object->edit_post ) ) {
107	215	$edit_post_type = $caps_object->edit_post;
		@@ -110,18 +218,35 @@
110	218	$delete_post_type = $caps_object->delete_post;
111	219	}
112	220	}
113	221
114		- if ( $cap === $edit_post_type || $cap === $delete_post_type ) {
	222	+ if (
	223	+ $cap === $edit_post_type ||
	224	+ $cap === $delete_post_type ||
	225	+ $cap === 'edit_post' ||
	226	+ $cap === 'delete_post'
	227	+ ) {
115	228	$post_id = null;
116	229	if ( is_numeric( $args[0] ) ) {
117		- $post_id = $args[0];
	230	+ $post_id = $args[0];
118	231	} else if ( $args[0] instanceof WP_Post ) {
119		- $post_id = $post->ID;
	232	+ $post_id = $args[0]->ID;
120	233	}
121	234	if ( $post_id ) {
122	235	if ( !self::user_can_read_post( $post_id, $user_id ) ) {
123	236	$caps[] = 'do_not_allow';
	237	+ } else {
	238	+ // post with access restrictions requires user to have access restriction rights
	239	+ if ( $post_type = get_post_type( $post_id ) ) {
	240	+ if ( self::handles_post_type( $post_type ) ) {
	241	+ $group_ids = self::get_read_group_ids( $post_id );
	242	+ if ( !empty( $group_ids ) ) {
	243	+ if ( $user === null || !$user->can( GROUPS_RESTRICT_ACCESS ) ) {
	244	+ $caps[] = 'do_not_allow';
	245	+ }
	246	+ }
	247	+ }
	248	+ }
124	249	}
125	250	}
126	251	}
127	252	}
		@@ -126,90 +251,174 @@
126	251	}
127	252	}
128	253	}
129	254	}
	255	+ add_filter( 'map_meta_cap', array( __CLASS__, 'map_meta_cap' ), 10, 4 );
130	256	return $caps;
131	257	}
132	258
133	259	/**
134	260	* Filters out posts that the user should not be able to access.
135		- *
	261	+ *
136	262	* @param string $where current where conditions
137	263	* @param WP_Query $query current query
	264	+ *
138	265	* @return string modified $where
139	266	*/
140		- public static function posts_where( $where, &$query ) {
	267	+ public static function posts_where( $where, $query ) {
141	268
142	269	global $wpdb;
143	270
144		- $user_id = get_current_user_id();
	271	+ if ( apply_filters( 'groups_post_access_posts_where_apply', true, $where, $query ) ) {
145	272
146		- // this only applies to logged in users
147		- if ( $user_id ) {
148		- // if administrators can override access, don't filter
149		- if ( get_option( GROUPS_ADMINISTRATOR_ACCESS_OVERRIDE, GROUPS_ADMINISTRATOR_ACCESS_OVERRIDE_DEFAULT ) ) {
150		- if ( user_can( $user_id, 'administrator' ) ) {
	273	+ $user_id = get_current_user_id();
	274	+
	275	+ // this only applies to logged in users
	276	+ if ( _groups_admin_override() ) {
	277	+ return $where;
	278	+ }
	279	+
	280	+ // Groups admins see everything
	281	+ if ( Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
	282	+ return $where;
	283	+ }
	284	+
	285	+ if ( !apply_filters( 'groups_post_access_posts_where_filter_all', false ) ) {
	286	+ $filter = true;
	287	+ $post_types = apply_filters(
	288	+ 'groups_post_access_posts_where_query_get_post_types',
	289	+ $query->get( 'post_type', null ),
	290	+ $where,
	291	+ $query
	292	+ );
	293	+
	294	+ // If post_types is empty and we have a term page (AKA taxonomy archive),
	295	+ // try to retrieve the post type from the taxonomy:
	296	+ if ( empty( $post_types ) ) {
	297	+ if ( $query->is_tax() ) {
	298	+ $queried_object = $query->get_queried_object();
	299	+ if ( $queried_object instanceof WP_Term ) {
	300	+ $taxonomy = get_taxonomy( $queried_object->taxonomy );
	301	+ if ( $taxonomy !== false ) {
	302	+ if ( property_exists( $taxonomy, 'object_type' ) ) { // object_type property since WP 4.7.0
	303	+ $post_types = $taxonomy->object_type;
	304	+ }
	305	+ }
	306	+ }
	307	+ }
	308	+ }
	309	+
	310	+ if ( 'any' == $post_types ) {
	311	+ // we need to filter in this case as it affects any post type
	312	+ } else if ( !empty( $post_types ) && is_array( $post_types ) ) {
	313	+ // if there is at least one post type we handle, we need to filter
	314	+ $handled = 0;
	315	+ $handles_post_types = self::get_handles_post_types();
	316	+ foreach ( $post_types as $post_type ) {
	317	+ if ( !isset( $handles_post_types[$post_type] ) || $handles_post_types[$post_type] ) {
	318	+ $handled++;
	319	+ }
	320	+ }
	321	+ $filter = $handled > 0;
	322	+ } else if ( !empty( $post_types ) && is_string( $post_types ) ) {
	323	+ $filter = self::handles_post_type( $post_types );
	324	+ } else if ( $query->is_attachment ) {
	325	+ $filter = self::handles_post_type( 'attachment' );
	326	+ } else if ( $query->is_page ) {
	327	+ $filter = self::handles_post_type( 'page' );
	328	+ } else {
	329	+ $filter = self::handles_post_type( 'post' );
	330	+ }
	331	+ if ( !$filter ) {
151	332	return $where;
152	333	}
153	334	}
154		- }
155	335
156		- // 1. Get all the capabilities that the user has, including those that are inherited:
157		- $caps = array();
158		- if ( $user = new Groups_User( $user_id ) ) {
159		- $capabilities = $user->capabilities_deep;
160		- if ( is_array( $capabilities ) ) {
161		- foreach ( $capabilities as $capability ) {
162		- $caps[] = "'". $capability . "'";
	336	+ $handles_post_types = Groups_Post_Access::get_handles_post_types();
	337	+ $post_types = array();
	338	+ foreach ( $handles_post_types as $post_type => $handles ) {
	339	+ if ( $handles ) {
	340	+ $post_types[] = $post_type;
163	341	}
164	342	}
165		- }
	343	+ if ( count( $post_types ) == 0 ) {
	344	+ return $where;
	345	+ }
	346	+ $post_types_in = "'" . implode( "','", array_map( 'esc_sql', $post_types ) ) . "'";
166	347
167		- if ( count( $caps ) > 0 ) {
168		- $caps = implode( ',', $caps );
169		- } else {
170		- $caps = '\'\'';
	348	+ // 1. Get all the groups that the user belongs to, including those that are inherited:
	349	+ $group_ids = array();
	350	+ if ( $user = new Groups_User( $user_id ) ) {
	351	+ $group_ids_deep = $user->get_group_ids_deep();
	352	+ if ( is_array( $group_ids_deep ) ) {
	353	+ $group_ids = $group_ids_deep;
	354	+ }
	355	+ }
	356	+ if ( count( $group_ids ) > 0 ) {
	357	+ $group_ids = implode( ',', array_map( 'intval', $group_ids ) );
	358	+ } else {
	359	+ $group_ids = '0';
	360	+ }
	361	+
	362	+ // 2. Filter the posts:
	363	+ // This allows the user to access posts where the posts are not restricted or where
	364	+ // the user belongs to ANY of the groups:
	365	+ // $where .= sprintf(
	366	+ // " AND {$wpdb->posts}.ID IN " .
	367	+ // " ( " .
	368	+ // " SELECT ID FROM $wpdb->posts WHERE post_type NOT IN (%s) OR ID NOT IN ( SELECT post_id FROM $wpdb->postmeta WHERE {$wpdb->postmeta}.meta_key = '%s' ) " . // posts of a type that is not handled or posts without access restriction
	369	+ // " UNION ALL " . // we don't care about duplicates here, just make it quick
	370	+ // " SELECT post_id AS ID FROM $wpdb->postmeta WHERE {$wpdb->postmeta}.meta_key = '%s' AND {$wpdb->postmeta}.meta_value IN (%s) " . // posts that require any group the user belongs to
	371	+ // " ) ",
	372	+ // $post_types_in,
	373	+ // self::POSTMETA_PREFIX . self::READ,
	374	+ // self::POSTMETA_PREFIX . self::READ,
	375	+ // $group_ids
	376	+ // );
	377	+ // New faster version - Exclude any post IDs from:
	378	+ // posts restricted to groups that the user does not belong to MINUS posts restricted to groups to which the user belongs
	379	+ $groups_table = _groups_get_tablename( 'group' );
	380	+ $where .= sprintf(
	381	+ " AND {$wpdb->posts}.ID NOT IN ( " .
	382	+ "SELECT ID FROM $wpdb->posts WHERE " .
	383	+ "post_type IN (%s) AND " .
	384	+ "ID IN ( " .
	385	+ "SELECT post_id FROM $wpdb->postmeta pm WHERE " .
	386	+ "pm.meta_key = '%s' AND " .
	387	+ "pm.meta_value NOT IN (%s) AND " .
	388	+ "pm.meta_value IN ( SELECT group_id FROM $groups_table ) AND " . // @since 2.18.0 also check for group ID value integrity
	389	+ "post_id NOT IN ( SELECT post_id FROM $wpdb->postmeta pm WHERE pm.meta_key = '%s' AND pm.meta_value IN (%s) ) " .
	390	+ ") " .
	391	+ ") ",
	392	+ $post_types_in,
	393	+ esc_sql( self::POSTMETA_PREFIX . self::READ ),
	394	+ $group_ids,
	395	+ esc_sql( self::POSTMETA_PREFIX . self::READ ),
	396	+ $group_ids
	397	+ );
171	398	}
172	399
173		- // 2. Filter the posts that require a capability that the user doesn't
174		- // have, or in other words: exclude posts that the user must NOT access:
175		-
176		- // The following is not correct in that it requires the user to have ALL capabilities:
177		-// $where .= sprintf(
178		-// " AND {$wpdb->posts}.ID NOT IN (SELECT DISTINCT ID FROM $wpdb->posts LEFT JOIN $wpdb->postmeta on {$wpdb->posts}.ID = {$wpdb->postmeta}.post_id WHERE {$wpdb->postmeta}.meta_key = '%s' AND {$wpdb->postmeta}.meta_value NOT IN (%s) ) ",
179		-// self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY,
180		-// $caps
181		-// );
182		-
183		- // This allows the user to access posts where the posts are not restricted or where
184		- // the user has ANY of the capabilities:
185		- $where .= sprintf(
186		- " AND {$wpdb->posts}.ID IN " .
187		- " ( " .
188		- " SELECT ID FROM $wpdb->posts WHERE ID NOT IN ( SELECT post_id FROM $wpdb->postmeta WHERE {$wpdb->postmeta}.meta_key = '%s' ) " . // posts without access restriction
189		- " UNION ALL " . // we don't care about duplicates here, just make it quick
190		- " SELECT post_id AS ID FROM $wpdb->postmeta WHERE {$wpdb->postmeta}.meta_key = '%s' AND {$wpdb->postmeta}.meta_value IN (%s) " . // posts that require any capability the user has
191		- " ) ",
192		- self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY,
193		- self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY,
194		- $caps
195		- );
196		-
197		- return $where;
	400	+ return apply_filters( 'groups_post_access_posts_where', $where, $query );
198	401	}
199	402
200	403	/**
201	404	* Filter pages by access capability.
202		- *
	405	+ *
203	406	* @param array $pages
	407	+ *
	408	+ * @return array
204	409	*/
205	410	public static function get_pages( $pages ) {
206	411	$result = array();
207		- $user_id = get_current_user_id();
208		- foreach ( $pages as $page ) {
209		- if ( self::user_can_read_post( $page->ID, $user_id ) ) {
210		- $result[] = $page;
	412	+ if ( apply_filters( 'groups_post_access_get_pages_apply', true, $pages ) ) {
	413	+ $user_id = get_current_user_id();
	414	+ foreach ( $pages as $page ) {
	415	+ if ( self::user_can_read_post( $page->ID, $user_id ) ) {
	416	+ $result[] = $page;
	417	+ }
211	418	}
	419	+ } else {
	420	+ $result = $pages;
212	421	}
213	422	return $result;
214	423	}
215	424
		@@ -214,19 +423,25 @@
214	423	}
215	424
216	425	/**
217	426	* Filter posts by access capability.
218		- *
	427	+ *
219	428	* @param array $posts list of posts
220	429	* @param WP_Query $query
	430	+ *
	431	+ * @return array
221	432	*/
222	433	public static function the_posts( $posts, &$query ) {
223	434	$result = array();
224		- $user_id = get_current_user_id();
225		- foreach ( $posts as $post ) {
226		- if ( self::user_can_read_post( $post->ID, $user_id ) ) {
227		- $result[] = $post;
	435	+ if ( apply_filters( 'groups_post_access_the_posts_apply', true, $posts, $query ) ) {
	436	+ $user_id = get_current_user_id();
	437	+ foreach ( $posts as $post ) {
	438	+ if ( self::user_can_read_post( $post->ID, $user_id ) ) {
	439	+ $result[] = $post;
	440	+ }
228	441	}
	442	+ } else {
	443	+ $result = $posts;
229	444	}
230	445	return $result;
231	446	}
232	447
		@@ -231,24 +446,35 @@
231	446	}
232	447
233	448	/**
234	449	* Filter menu items by access capability.
235		- *
236		- * @todo admin section: this won't inhibit the items being offered to be added, although when they're added they won't show up in the menu
237		- *
	450	+ *
	451	+ * Notes for the admin section:
	452	+ * 1. With themes that provide sidebars and widgets, protected items are visible and can be chosen to be added to a menu. But once the menu is saved, those items do not appear, providing a somewhat confusing user experience.
	453	+ * 2. With themes that support full site editing (like Twenty Twenty-Four which gets rid of sidebars and widgets), protected items are not offered to whom is editing a Navigation block. However, protected items that were added by someone who could access them, will be visible.
	454	+ *
238	455	* @param array $items
239	456	* @param mixed $menu
240	457	* @param array $args
	458	+ *
	459	+ * @return array
241	460	*/
242	461	public static function wp_get_nav_menu_items( $items = null, $menu = null, $args = null ) {
243	462	$result = array();
244		- $user_id = get_current_user_id();
245		- foreach ( $items as $item ) {
246		- // @todo might want to check $item->object and $item->type first,
247		- // for example these are 'page' and 'post_type' for a page
248		- if ( self::user_can_read_post( $item->object_id, $user_id ) ) {
249		- $result[] = $item;
	463	+ if ( apply_filters( 'groups_post_access_wp_get_nav_menu_items_apply', true, $items, $menu, $args ) ) {
	464	+ $user_id = get_current_user_id();
	465	+ foreach ( $items as $item ) {
	466	+ // Check whether the menu item is for some post type, otherwise it's for something else which we don't control.
	467	+ if ( is_object( $item ) && isset( $item->type ) && $item->type === 'post_type' ) {
	468	+ if ( self::user_can_read_post( $item->object_id, $user_id ) ) {
	469	+ $result[] = $item;
	470	+ }
	471	+ } else {
	472	+ $result[] = $item;
	473	+ }
250	474	}
	475	+ } else {
	476	+ $result = $items;
251	477	}
252	478	return $result;
253	479	}
254	480
		@@ -253,21 +479,26 @@
253	479	}
254	480
255	481	/**
256	482	* Filter excerpt by access capability.
257		- *
	483	+ *
258	484	* @param string $output
259		- * @return $output if access granted, otherwise ''
	485	+ *
	486	+ * @return string $output if access granted, otherwise ''
260	487	*/
261	488	public static function get_the_excerpt( $output ) {
262	489	global $post;
263	490	$result = '';
264		- if ( isset( $post->ID ) ) {
265		- if ( self::user_can_read_post( $post->ID ) ) {
	491	+ if ( apply_filters( 'groups_post_access_get_the_excerpt_apply', true, $output ) ) {
	492	+ if ( isset( $post->ID ) ) {
	493	+ if ( self::user_can_read_post( $post->ID ) ) {
	494	+ $result = $output;
	495	+ }
	496	+ } else {
	497	+ // not a post, don't interfere
266	498	$result = $output;
267	499	}
268	500	} else {
269		- // not a post, don't interfere
270	501	$result = $output;
271	502	}
272	503	return $result;
273	504	}
		@@ -275,19 +506,24 @@
275	506	/**
276	507	* Filter content by access capability.
277	508	*
278	509	* @param string $output
279		- * @return $output if access granted, otherwise ''
	510	+ *
	511	+ * @return string $output if access granted, otherwise ''
280	512	*/
281	513	public static function the_content( $output ) {
282	514	global $post;
283	515	$result = '';
284		- if ( isset( $post->ID ) ) {
285		- if ( self::user_can_read_post( $post->ID ) ) {
	516	+ if ( apply_filters( 'groups_post_access_the_content_apply', true, $output ) ) {
	517	+ if ( isset( $post->ID ) ) {
	518	+ if ( self::user_can_read_post( $post->ID ) ) {
	519	+ $result = $output;
	520	+ }
	521	+ } else {
	522	+ // not a post, don't interfere
286	523	$result = $output;
287	524	}
288	525	} else {
289		- // not a post, don't interfere
290	526	$result = $output;
291	527	}
292	528	return $result;
293	529	}
		@@ -292,15 +528,114 @@
292	528	return $result;
293	529	}
294	530
295	531	/**
296		- * Adds an access capability requirement.
297		- *
298		- * $map must contain 'post_id' (*)
299		- *
300		- * For now this only should be used to add the READ_POST_CAPABILITY which
301		- * it does automatically. Nothing else is checked for granting access.
302		- *
	532	+ * Hooked on the get_{$adjacent}_post_where filter to remove restricted posts.
	533	+ *
	534	+ * @param string $where
	535	+ * @param boolean $in_same_term
	536	+ * @param array $excluded_terms
	537	+ * @param string $taxonomy
	538	+ * @param WP_Post $post
	539	+ *
	540	+ * @return string $where modified if appropriate
	541	+ */
	542	+ public static function get_previous_post_where( $where, $in_same_term, $excluded_terms, $taxonomy, $post ) {
	543	+ return self::get_next_post_where( $where, $in_same_term, $excluded_terms, $taxonomy, $post );
	544	+ }
	545	+
	546	+ /**
	547	+ * Hooked on the get_{$adjacent}_post_where filter to remove restricted posts.
	548	+ *
	549	+ * @param string $where
	550	+ * @param boolean $in_same_term
	551	+ * @param array $excluded_terms
	552	+ * @param string $taxonomy
	553	+ * @param WP_Post $post
	554	+ *
	555	+ * @return string $where modified if appropriate
	556	+ */
	557	+ public static function get_next_post_where( $where, $in_same_term, $excluded_terms, $taxonomy, $post ) {
	558	+ if (
	559	+ !empty( $post ) && // @phpstan-ignore empty.variable
	560	+ self::handles_post_type( $post->post_type ?? '' )
	561	+ ) {
	562	+ // @since 4.0.0 cached values are purged by Groups_Cache_Robot when flushing the cache group for a post type
	563	+ $cache_group = self::get_post_type_cache_group( $post->post_type );
	564	+
	565	+ $post_ids = array( -1 );
	566	+ $cached = Groups_Cache::get_ext( 'eligible_post_ids', $cache_group );
	567	+ if ( $cached === null ) {
	568	+ // run it through get_posts with suppress_filters set to false so that our posts_where filter is applied and assures only accessible posts are seen
	569	+ $post_ids = get_posts( array( 'post_type' => $post->post_type, 'numberposts' => -1, 'suppress_filters' => false, 'fields' => 'ids' ) );
	570	+ if ( is_array( $post_ids ) && count( $post_ids ) > 0 ) {
	571	+ foreach ( $post_ids as $i => $post_id ) {
	572	+ $post_ids[$i] = intval( $post_id );
	573	+ }
	574	+ } else {
	575	+ $post_ids = array( -1 );
	576	+ }
	577	+ Groups_Cache::set_ext( 'eligible_post_ids', $post_ids, $cache_group );
	578	+ } else {
	579	+ $post_ids = $cached->get_value();
	580	+ }
	581	+
	582	+ if ( is_array( $post_ids ) && count( $post_ids ) > 0 ) {
	583	+ $condition = ' p.ID IN (' . implode( ',', $post_ids ) . ') ';
	584	+ if ( !empty( $where ) ) {
	585	+ $where .= ' AND ' . $condition;
	586	+ } else {
	587	+ $where = ' WHERE ' . $condition;
	588	+ }
	589	+ }
	590	+ }
	591	+ return $where;
	592	+ }
	593	+
	594	+ /**
	595	+ * Clears cached eligible post IDs.
	596	+ *
	597	+ * @since 2.17.0
	598	+ *
	599	+ * @param int $post_id
	600	+ */
	601	+ public static function save_post( $post_id ) {
	602	+ if ( ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE || wp_is_post_revision( $post_id ) || wp_is_post_autosave( $post_id ) ) ) {
	603	+ } else {
	604	+ $post_type = get_post_type( $post_id );
	605	+ if ( self::handles_post_type( $post_type ) ) {
	606	+ }
	607	+ }
	608	+ }
	609	+
	610	+ /**
	611	+ * Clear cached eligible post IDs for the 'attachment' post type (the save_post action is not triggered for those).
	612	+ *
	613	+ * @since 2.17.0
	614	+ *
	615	+ * @param array $post
	616	+ * @param array $attachment
	617	+ *
	618	+ * @return array
	619	+ */
	620	+ public static function attachment_fields_to_save( $post, $attachment ) {
	621	+ if ( self::handles_post_type( 'attachment' ) ) {
	622	+ $post_id = null;
	623	+ if ( isset( $post['ID'] ) ) {
	624	+ $post_id = $post['ID'];
	625	+ } else if ( isset( $post['post_ID'] ) ) {
	626	+ $post_id = $post['post_ID'];
	627	+ }
	628	+ if ( $post_id !== null ) {
	629	+ self::save_post( $post_id );
	630	+ }
	631	+ }
	632	+ return $post;
	633	+ }
	634	+
	635	+ /**
	636	+ * Adds an access requirement based on post_id and group_id.
	637	+ *
303	638	* (*) Revisions : As of Groups 1.3.13 and at WordPress 3.6.1, as
304	639	* add_post_meta stores postmeta for the revision's parent, we retrieve
305	640	* the parent's post ID if it applies and check against that to see if
306	641	* that capability is already present. This is to avoid duplicating
		@@ -305,27 +640,39 @@
305	640	* the parent's post ID if it applies and check against that to see if
306	641	* that capability is already present. This is to avoid duplicating
307	642	* the already existing postmeta entry (which ocurred in previous
308	643	* versions).
309		- *
310		- * @param array $map
311		- * @return true if the capability could be added to the post, otherwis false
	644	+ *
	645	+ * @param array $map must contain 'post_id' (*) and 'group_id'
	646	+ *
	647	+ * @return true if the access requirement could be added to the post, otherwise false
312	648	*/
313	649	public static function create( $map ) {
314		- extract( $map );
	650	+
315	651	$result = false;
316	652
317		- if ( !isset( $capability ) ) {
318		- $capability = self::READ_POST_CAPABILITY;
	653	+ $capability = isset( $map['capability'] ) ? $map['capability'] : null;
	654	+ $post_id = isset( $map['post_id'] ) ? $map['post_id'] : null;
	655	+ $group_id = isset( $map['group_id'] ) ? $map['group_id'] : null;
	656	+
	657	+ if ( $capability !== null ) {
	658	+ _doing_it_wrong(
	659	+ __CLASS__ . '::' . __METHOD__,
	660	+ __( 'You should use Groups_Post_Access_Legacy::create() to pass a capability restriction instead.', 'groups' ), // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
	661	+ '2.0.0'
	662	+ );
319	663	}
320	664
321		- if ( !empty( $post_id ) && !empty( $capability) ) {
322		- if ( Groups_Capability::read_by_capability( $capability ) ) {
	665	+ if ( !empty( $post_id ) && !empty( $group_id ) ) {
	666	+ $post_id = Groups_Utility::id( $post_id );
	667	+ $group_id = Groups_Utility::id( $group_id );
	668	+ if ( Groups_Group::read( $group_id ) ) {
323	669	if ( $revision_parent_id = wp_is_post_revision( $post_id ) ) {
324	670	$post_id = $revision_parent_id;
325	671	}
326		- if ( !in_array( $capability, get_post_meta( $post_id, self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY ) ) ) {
327		- $result = add_post_meta( $post_id, self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY, $capability );
	672	+ $stored_group_ids = self::get_read_group_ids( $post_id );
	673	+ if ( !in_array( $group_id, $stored_group_ids ) ) {
	674	+ $result = add_post_meta( $post_id, self::POSTMETA_PREFIX . self::READ, $group_id );
328	675	}
329	676	}
330	677	}
331	678	return $result;
		@@ -331,50 +678,110 @@
331	678	return $result;
332	679	}
333	680
334	681	/**
335		- * Returns true if the post requires the given capability to grant access.
336		- *
337		- * Currently only READ_POST_CAPABILITY should be used, this is also taken
338		- * as the default.
339		- *
340		- * @param int $post_id
341		- * @param string $capability capability label
342		- * @return true if the capability is required, otherwise false
	682	+ * Returns true if the post requires the user to be a member of the given group(s) to grant access.
	683	+ *
	684	+ * @param int $post_id ID of the post
	685	+ * @param array $map should provide one or more group IDs via 'groups_read'
	686	+ *
	687	+ * @return boolean true if the group(s) is required, otherwise false
343	688	*/
344		- public static function read( $post_id, $capability = self::READ_POST_CAPABILITY ) {
	689	+ public static function read( $post_id, $map = array() ) {
	690	+
345	691	$result = false;
346		- $caps = get_post_meta( $post_id, self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY );
347		- if ( $caps ) {
348		- $result = in_array( $capability, $caps );
	692	+
	693	+ $groups_read = isset( $map['groups_read'] ) ? $map['groups_read'] : null;
	694	+
	695	+ if ( !empty( $post_id ) ) {
	696	+ if ( $groups_read !== null ) {
	697	+ if ( empty( $groups_read ) ) {
	698	+ $groups_read = array();
	699	+ } else if ( !is_array( $groups_read ) ) {
	700	+ $groups_read = array( $groups_read );
	701	+ }
	702	+ $group_ids = self::get_read_group_ids( $post_id );
	703	+ if ( $group_ids ) {
	704	+ foreach ( $groups_read as $group_id ) {
	705	+ $result = in_array( $group_id, $group_ids );
	706	+ if ( !$result ) {
	707	+ break;
	708	+ }
	709	+ }
	710	+ }
	711	+ }
349	712	}
350	713	return $result;
351	714	}
352	715
353	716	/**
354		- * Currently does nothing, always returns false.
355		- *
	717	+ * Update the post access restrictions.
	718	+ *
	719	+ * $map must provide 'post_id' (int) indicating the post's ID and 'groups_read' (int|array of int) holding group IDs that restrict read access.
	720	+ *
356	721	* @param array $map
357		- * @return false
	722	+ *
	723	+ * @return array of group ids, false on failure
358	724	*/
359	725	public static function update( $map ) {
360		- return false;
	726	+
	727	+ $result = false;
	728	+
	729	+ $post_id = isset( $map['post_id'] ) ? $map['post_id'] : null;
	730	+ $groups_read = isset( $map['groups_read'] ) ? $map['groups_read'] : null;
	731	+
	732	+ if ( !empty( $post_id ) ) {
	733	+ if ( empty( $groups_read ) ) {
	734	+ $groups_read = array();
	735	+ } else if ( !is_array( $groups_read ) ) {
	736	+ $groups_read = array( $groups_read );
	737	+ }
	738	+ $groups_read = array_map( array( 'Groups_Utility', 'id' ), $groups_read );
	739	+ $current_groups_read = self::get_read_group_ids( $post_id );
	740	+ $current_groups_read = array_map( array( 'Groups_Utility', 'id' ), $current_groups_read );
	741	+ foreach ( $groups_read as $group_id ) {
	742	+ if ( !in_array( $group_id, $current_groups_read ) ) {
	743	+ add_post_meta( $post_id, self::POSTMETA_PREFIX . self::READ, $group_id );
	744	+ }
	745	+ }
	746	+ foreach ( $current_groups_read as $group_id ) {
	747	+ if ( !in_array( $group_id, $groups_read ) ) {
	748	+ delete_post_meta( $post_id, self::POSTMETA_PREFIX . self::READ, $group_id );
	749	+ }
	750	+ }
	751	+ $stored_group_ids = self::get_read_group_ids( $post_id );
	752	+ $result = array_map( array( 'Groups_Utility', 'id' ), $stored_group_ids );
	753	+ }
	754	+ return $result;
361	755	}
362	756
363	757	/**
364		- * Removes a capability requirement from a post.
365		- *
	758	+ * Removes access restrictions from a post.
	759	+ *
366	760	* @param int $post_id
367		- * @param string $capability defaults to groups_read_post, removes all if null is given
368		- * @return true on success, otherwise false
	761	+ * @param array $map must provide 'groups_read' holding group IDs to remove from restricting access to the post; if empty, all access restrictions will be removed
	762	+ *
	763	+ * @return boolean true on success, otherwise false
369	764	*/
370		- public static function delete( $post_id, $capability = self::READ_POST_CAPABILITY ) {
	765	+ public static function delete( $post_id, $map = array() ) {
	766	+
371	767	$result = false;
	768	+
	769	+ $groups_read = isset( $map['groups_read'] ) ? $map['groups_read'] : null;
	770	+
372	771	if ( !empty( $post_id ) ) {
373		- if ( !empty( $capability ) ) {
374		- $result = delete_post_meta( $post_id, self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY, $capability );
	772	+ if ( empty( $groups_read ) ) {
	773	+ $groups_read = array();
	774	+ } else if ( !is_array( $groups_read ) ) {
	775	+ $groups_read = array( $groups_read );
	776	+ }
	777	+ $groups_read = array_map( array( 'Groups_Utility', 'id' ), $groups_read );
	778	+ if ( !empty( $groups_read ) ) {
	779	+ foreach ( $groups_read as $group_id ) {
	780	+ $result = delete_post_meta( $post_id, self::POSTMETA_PREFIX . self::READ, $group_id );
	781	+ }
375	782	} else {
376		- $result = delete_post_meta( $post_id, self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY );
	783	+ $result = delete_post_meta( $post_id, self::POSTMETA_PREFIX . self::READ );
377	784	}
378	785	}
379	786	return $result;
380	787	}
		@@ -380,45 +787,92 @@
380	787	}
381	788
382	789	/**
383	790	* Returns a list of capabilities that grant access to the post.
384		- *
	791	+ *
	792	+ * @deprecated
	793	+ *
385	794	* @param int $post_id
	795	+ *
386	796	* @return array of string, capabilities
387	797	*/
388	798	public static function get_read_post_capabilities( $post_id ) {
389		- return get_post_meta( $post_id, self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY );
	799	+ _doing_it_wrong(
	800	+ __CLASS__ . '::' . __METHOD__,
	801	+ __( 'This method is deprecated. You should use Groups_Post_Access_Legacy::get_read_post_capabilities() to retrieve the capabilities instead.', 'groups' ), // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
	802	+ '2.0.0'
	803	+ );
	804	+
	805	+ require_once GROUPS_LEGACY_LIB . '/access/class-groups-post-access-legacy.php';
	806	+ return Groups_Post_Access_Legacy::get_read_post_capabilities( $post_id );
390	807	}
391	808
392	809	/**
393		- * Returns true if the user has any of the capabilities that grant access to the post.
394		- *
	810	+ * Returns a list of group IDs that grant read access to the post.
	811	+ *
	812	+ * @param int $post_id
	813	+ *
	814	+ * @return array of int, group IDs
	815	+ */
	816	+ public static function get_read_group_ids( $post_id ) {
	817	+ $result = array();
	818	+ $group_ids = get_post_meta( $post_id, self::POSTMETA_PREFIX . self::READ );
	819	+ if ( is_array( $group_ids ) ) {
	820	+ foreach ( $group_ids as $group_id ) {
	821	+ // @since 2.18.0 discard invalid group IDs
	822	+ if ( !empty( $group_id ) && Groups_Group::exists( $group_id ) ) {
	823	+ $result[] = intval( $group_id );
	824	+ }
	825	+ }
	826	+ }
	827	+ return $result;
	828	+ }
	829	+
	830	+ /**
	831	+ * Returns true if the user belongs to any of the groups that grant access to the post.
	832	+ *
395	833	* @param int $post_id post id
396		- * @param int $user_id user id or null for current user
	834	+ * @param int $user_id user id or null for current user
	835	+ *
397	836	* @return boolean true if user can read the post
398	837	*/
399	838	public static function user_can_read_post( $post_id, $user_id = null ) {
	839	+
400	840	$result = false;
	841	+
401	842	if ( !empty( $post_id ) ) {
	843	+
402	844	if ( $user_id === null ) {
403	845	$user_id = get_current_user_id();
404	846	}
	847	+
405	848	$cached = Groups_Cache::get( self::CAN_READ_POST . '_' . $user_id . '_' . $post_id, self::CACHE_GROUP );
	849	+
406	850	if ( $cached !== null ) {
407		- $result = $cached->value;
408		- unset( $cached ) ;
	851	+ $result = $cached->get_value();
	852	+ unset( $cached );
409	853	} else {
410		- $groups_user = new Groups_User( $user_id );
411		- $read_caps = self::get_read_post_capabilities( $post_id );
412		- if ( !empty( $read_caps ) ) {
413		- foreach( $read_caps as $read_cap ) {
414		- if ( $groups_user->can( $read_cap ) ) {
	854	+ // admin override and Groups admins see everything
	855	+ if ( _groups_admin_override() || Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
	856	+ $result = true;
	857	+ } else {
	858	+ // can read if post type is not handled
	859	+ if ( $post_type = get_post_type( $post_id ) ) {
	860	+ if ( !self::handles_post_type( $post_type ) ) {
415	861	$result = true;
416		- break;
417	862	}
418	863	}
419		- } else {
420		- $result = true;
	864	+ // check if the user can read
	865	+ if ( !$result ) {
	866	+ $groups_user = new Groups_User( $user_id );
	867	+ $group_ids = self::get_read_group_ids( $post_id );
	868	+ if ( empty( $group_ids ) ) {
	869	+ $result = true;
	870	+ } else {
	871	+ $ids = array_intersect( $groups_user->get_group_ids_deep(), $group_ids );
	872	+ $result = !empty( $ids );
	873	+ }
	874	+ }
421	875	}
422	876	$result = apply_filters( 'groups_post_access_user_can_read_post', $result, $post_id, $user_id );
423	877	Groups_Cache::set( self::CAN_READ_POST . '_' . $user_id . '_' . $post_id, $result, self::CACHE_GROUP );
424	878	}
		@@ -426,15 +880,460 @@
426	880	return $result;
427	881	}
428	882
429	883	/**
430		- * Hooks into groups_deleted_capability_capability to remove existing access
431		- * restrictions based on the deleted capability.
432		- *
433		- * @param string $name of the deleted capability
	884	+ * Hooks into groups_deleted_group to remove existing access restrictions
	885	+ * based on the deleted group.
	886	+ *
	887	+ * @param int $group_id the ID of the deleted group
434	888	*/
435		- public static function groups_deleted_capability_capability( $capability ) {
436		- delete_metadata( 'post', null, self::POSTMETA_PREFIX . self::READ_POST_CAPABILITY, $capability, true );
	889	+ public static function groups_deleted_group( $group_id ) {
	890	+ if ( $group_id ) {
	891	+ delete_metadata( 'post', null, self::POSTMETA_PREFIX . self::READ, $group_id, true );
	892	+ }
437	893	}
438	894
	895	+ /**
	896	+ * Hooked on wp_count_posts to correct the post counts.
	897	+ *
	898	+ * Note: at WP 4.7.4 through WP_Posts_List_Table::prepare_items() which obtains $post_status
	899	+ * independent of the post type, we will come here for any post status, so don't be surprised
	900	+ * to see this executed e.g. on post type 'post' with e.g. 'wc-completed' post status.
	901	+ *
	902	+ * @param object $counts An object containing the current post_type's post counts by status.
	903	+ * @param string $type the post type
	904	+ * @param string $perm The permission to determine if the posts are 'readable' by the current user.
	905	+ *
	906	+ * @return object
	907	+ */
	908	+ public static function wp_count_posts( $counts, $type, $perm ) {
	909	+ // @since 3.3.1 remove temporarily to avoid potential infinite recursion https://github.com/itthinx/groups/pull/160
	910	+ remove_filter( 'wp_count_posts', array( __CLASS__, 'wp_count_posts' ), 10 );
	911	+ if ( !empty( $type ) && is_string( $type ) && self::handles_post_type( $type ) ) {
	912	+ // @since 4.0.0 counts in cache are purged by Groups_Cache_Robot when flushing the cache group for a post type
	913	+ $cache_group = self::get_post_type_cache_group( $type );
	914	+ $cached = Groups_Cache::get_ext( 'count_posts', $cache_group );
	915	+ if ( $cached !== null ) {
	916	+ $counts = $cached->get_value();
	917	+ } else {
	918	+ foreach ( $counts as $post_status => $count ) {
	919	+ $query_args = array(
	920	+ 'fields' => 'ids',
	921	+ 'post_type' => $type,
	922	+ 'post_status' => $post_status,
	923	+ 'numberposts' => -1, // all
	924	+ 'suppress_filters' => false, // don't suppress filters as we need to get restrictions taken into account
	925	+ 'orderby' => 'none', // Important! Don't waste time here.
	926	+ 'no_found_rows' => true, // performance, omit unnecessary SQL_CALC_FOUND_ROWS in query here
	927	+ 'nopaging' => true // no paging is needed, get all corresponding posts
	928	+ );
	929	+ // WooCommerce Orders
	930	+ if ( function_exists( 'wc_get_order_statuses' ) && ( $type == 'shop_order' ) ) {
	931	+ $wc_order_statuses = array_keys( wc_get_order_statuses() );
	932	+ if ( !in_array( $post_status, $wc_order_statuses ) ) {
	933	+ // Skip getting the post count for this status as it's
	934	+ // not a valid order status and WC would raise a PHP Notice.
	935	+ continue;
	936	+ }
	937	+ }
	938	+ // WooCommerce Subscriptions
	939	+ if ( function_exists( 'wcs_get_subscription_statuses' ) && ( $type == 'shop_subscription' ) ) {
	940	+ $wc_subscription_statuses = array_keys( wcs_get_subscription_statuses() );
	941	+ if ( !in_array( $post_status, $wc_subscription_statuses ) ) {
	942	+ // Skip as it's not a valid subscription status
	943	+ continue;
	944	+ }
	945	+ }
	946	+ do_action( 'groups_post_access_wp_count_posts_before_query', $query_args, $counts, $type, $perm );
	947	+ $posts = get_posts( $query_args );
	948	+ do_action( 'groups_post_access_wp_count_posts_after_query', $query_args, $counts, $type, $perm );
	949	+ $count = count( $posts );
	950	+ unset( $posts );
	951	+ $counts->$post_status = $count;
	952	+ }
	953	+ Groups_Cache::set_ext( 'count_posts', $counts, $cache_group );
	954	+ }
	955	+ }
	956	+ // @since 3.3.1 reestablish filter for next use
	957	+ add_filter( 'wp_count_posts', array( __CLASS__, 'wp_count_posts' ), 10, 3 );
	958	+ return $counts;
	959	+ }
	960	+
	961	+ /**
	962	+ * Would be hooked on wp_count_attachments to correct the counts but it's not actually
	963	+ * being used in the current media library.
	964	+ *
	965	+ * @param object $counts An object containing the attachment counts by mime type.
	966	+ * @param string $mime_type The mime type pattern used to filter the attachments counted.
	967	+ *
	968	+ * @return object
	969	+ */
	970	+ public static function wp_count_attachments( $counts, $mime_type ) {
	971	+ return $counts;
	972	+ }
	973	+
	974	+ /**
	975	+ * Returns true if we are supposed to handle the post type, otherwise false.
	976	+ *
	977	+ * @param string $post_type
	978	+ *
	979	+ * @return boolean
	980	+ */
	981	+ public static function handles_post_type( $post_type ) {
	982	+ $post_types = self::get_handles_post_types();
	983	+ return isset( $post_types[$post_type] ) && $post_types[$post_type];
	984	+ }
	985	+
	986	+ /**
	987	+ * Returns an array of post types indicating for each whether we handle it (true) or not.
	988	+ * The array is indexed by the post type names.
	989	+ *
	990	+ * @return array indexed by post type names, indicating the value true if we handle it, otherwise false
	991	+ */
	992	+ public static function get_handles_post_types() {
	993	+ $result = array();
	994	+ $post_types_option = Groups_Options::get_option( self::POST_TYPES, array() );
	995	+ $post_types = get_post_types( array(), 'objects' );
	996	+ foreach ( $post_types as $post_type => $object ) {
	997	+ $public = isset( $object->public ) ? $object->public : false;
	998	+ // $exclude_from_search = isset( $object->exclude_from_search ) ? $object->exclude_from_search : false;
	999	+ // $publicly_queryable = isset( $object->publicly_queryable ) ? $object->publicly_queryable : false;
	1000	+ // $show_ui = isset( $object->show_ui ) ? $object->show_ui : false;
	1001	+ // $show_in_nav_menus = isset( $object->show_in_nav_menus ) ? $object->show_in_nav_menus : false;
	1002	+
	1003	+ // by default, handle any post type whose public attribute is true
	1004	+ $managed =
	1005	+ $public && ( !isset( $post_types_option[$post_type] ) || !isset( $post_types_option[$post_type]['add_meta_box'] ) ) ||
	1006	+ isset( $post_types_option[$post_type] ) && isset( $post_types_option[$post_type]['add_meta_box'] ) && $post_types_option[$post_type]['add_meta_box'];
	1007	+ $result[$post_type] = $managed;
	1008	+ }
	1009	+ return $result;
	1010	+ }
	1011	+
	1012	+ /**
	1013	+ * Set which post types we should handle.
	1014	+ *
	1015	+ * @param array $post_types of post type names mapped to booleans, indicating to handle or not a post type
	1016	+ */
	1017	+ public static function set_handles_post_types( $post_types ) {
	1018	+ $post_types_option = Groups_Options::get_option( self::POST_TYPES, array() );
	1019	+ $available_post_types = get_post_types();
	1020	+ foreach ( $available_post_types as $post_type ) {
	1021	+ $post_types_option[$post_type]['add_meta_box'] = isset( $post_types[$post_type] ) && $post_types[$post_type];
	1022	+ }
	1023	+ Groups_Options::update_option( self::POST_TYPES, $post_types_option );
	1024	+ }
	1025	+
	1026	+ /**
	1027	+ * Filter the block content of core/navigation-link and core/navigation-submenu blocks.
	1028	+ *
	1029	+ * This is necessary as these blocks would render their content although the corresponding post is protected.
	1030	+ *
	1031	+ * @since 2.20.0
	1032	+ *
	1033	+ * @param string $block_content
	1034	+ * @param array $parsed_block
	1035	+ * @param \WP_Block $block
	1036	+ *
	1037	+ * @return string
	1038	+ */
	1039	+ public static function render_block( $block_content, $parsed_block, $block ) {
	1040	+ if ( !is_admin() ) {
	1041	+ /**
	1042	+ * Whether to process this block.
	1043	+ *
	1044	+ * @param boolean $filter whether to filter the block
	1045	+ * @param string $block_content the block's content
	1046	+ * @param array $parsed_block the parsed block
	1047	+ * @param \WP_Block $block the block
	1048	+ *
	1049	+ * @return boolean whether to filter
	1050	+ */
	1051	+ if ( apply_filters( 'groups_post_access_filter_render_block', true, $block_content, $parsed_block, $block ) ) {
	1052	+ $is_valid = true;
	1053	+ if ( 'core/navigation-link' === $block->name || 'core/navigation-submenu' === $block->name ) {
	1054	+ if ( $block->attributes && isset( $block->attributes['kind'] ) && 'post-type' === $block->attributes['kind'] && isset( $block->attributes['id'] ) ) {
	1055	+ $post_id = $block->attributes['id'];
	1056	+ if ( !self::user_can_read_post( $post_id ) ) {
	1057	+ $is_valid = false;
	1058	+ }
	1059	+ }
	1060	+ }
	1061	+ if ( !$is_valid ) {
	1062	+ $block_content = '';
	1063	+ }
	1064	+ }
	1065	+ }
	1066	+ return $block_content;
	1067	+ }
	1068	+
	1069	+ /**
	1070	+ * Short-circuits render_block() and WP_Block->render().
	1071	+ *
	1072	+ * For core/navigation-link and core/navigation-submenu blocks:
	1073	+ * - This will be overridden for dynamic blocks, so the render_block filter is necessary instead.
	1074	+ *
	1075	+ * For core/categories blocks:
	1076	+ * - We use this hook to add our get_terms filter.
	1077	+ *
	1078	+ * @see Groups_Post_Access::render_block()
	1079	+ *
	1080	+ * @since 2.20.0
	1081	+ *
	1082	+ * @param string|null $pre_render
	1083	+ * @param array $parsed_block
	1084	+ * @param \WP_Block|null $parent_block
	1085	+ *
	1086	+ * @return string|null
	1087	+ */
	1088	+ public static function pre_render_block( $pre_render, $parsed_block, $parent_block ) {
	1089	+ if ( !is_admin() ) {
	1090	+ /**
	1091	+ * Whether to process this block pre rendering.
	1092	+ *
	1093	+ * @param boolean $filter whether to filter
	1094	+ * @param string $pre_render block content
	1095	+ * @param array $parsed_block the parsed block
	1096	+ * @param \WP_Block $parent_block the parent block
	1097	+ *
	1098	+ * @return boolean whether to filter
	1099	+ */
	1100	+ if ( apply_filters( 'groups_post_access_filter_pre_render_block', true, $pre_render, $parsed_block, $parent_block ) ) {
	1101	+ $block = new \WP_Block( $parsed_block );
	1102	+ // $is_valid = true;
	1103	+ // if ( 'core/navigation-link' === $block->name || 'core/navigation-submenu' === $block->name ) {
	1104	+ // if ( $block->attributes && isset( $block->attributes['kind'] ) && 'post-type' === $block->attributes['kind'] && isset( $block->attributes['id'] ) ) {
	1105	+ // $post_id = $block->attributes['id'];
	1106	+ // if ( !self::user_can_read_post( $post_id ) ) {
	1107	+ // $is_valid = false;
	1108	+ // }
	1109	+ // }
	1110	+ // }
	1111	+ // if ( !$is_valid ) {
	1112	+ // $pre_render = '';
	1113	+ // }
	1114	+
	1115	+ // Detect a categories block and add our filter to update the counts
	1116	+ if ( 'core/categories' === $block->name ) {
	1117	+ self::$filter_get_terms_block = $block;
	1118	+ add_filter( 'get_terms', array( __CLASS__, 'get_terms' ), 10, 4 );
	1119	+ }
	1120	+ }
	1121	+ }
	1122	+ return $pre_render;
	1123	+ }
	1124	+
	1125	+ /**
	1126	+ * Filter inner navigation blocks.
	1127	+ *
	1128	+ * This will not handle the inner blocks of core/navigation-submenu blocks, so the filter on render_block implemented here in this class is necessary.
	1129	+ *
	1130	+ * @since 2.20.0
	1131	+ *
	1132	+ * @param \WP_Block_List $inner_blocks
	1133	+ *
	1134	+ * @return \WP_Block_List
	1135	+ */
	1136	+ public static function block_core_navigation_render_inner_blocks( $inner_blocks ) {
	1137	+ if ( !is_admin() ) {
	1138	+ /**
	1139	+ * Whether to filter the inner blocks.
	1140	+ *
	1141	+ * @param boolean $filter whether to filter
	1142	+ * @param \WP_Block_List $inner_blocks the inner blocks
	1143	+ *
	1144	+ * @return \WP_Block_List the inner blocks
	1145	+ */
	1146	+ if ( apply_filters( 'groups_post_access_filter_block_core_navigation_render_inner_blocks', true, $inner_blocks ) ) {
	1147	+ $valid_inner_blocks = array();
	1148	+ /**
	1149	+ * @var \WP_Block[] $blocks
	1150	+ */
	1151	+ $blocks = iterator_to_array( $inner_blocks );
	1152	+ foreach ( $blocks as $block ) {
	1153	+ $is_valid = true;
	1154	+ // @see block_core_navigation_from_block_get_post_ids( $block )
	1155	+ if ( 'core/navigation-link' === $block->name || 'core/navigation-submenu' === $block->name ) {
	1156	+ if ( $block->attributes && isset( $block->attributes['kind'] ) && 'post-type' === $block->attributes['kind'] && isset( $block->attributes['id'] ) ) {
	1157	+ $post_id = $block->attributes['id'];
	1158	+ if ( !self::user_can_read_post( $post_id ) ) {
	1159	+ $is_valid = false;
	1160	+ }
	1161	+ }
	1162	+ }
	1163	+ if ( $is_valid ) {
	1164	+ $valid_inner_blocks[] = $block;
	1165	+ }
	1166	+ }
	1167	+ $inner_blocks = new WP_Block_List( $valid_inner_blocks );
	1168	+ }
	1169	+ }
	1170	+ return $inner_blocks;
	1171	+ }
	1172	+
	1173	+ /**
	1174	+ * Hooks into the filter to activate our get_terms filter.
	1175	+ *
	1176	+ * @since 2.20.0
	1177	+ *
	1178	+ * @param array $cat_args
	1179	+ * @param array $instance
	1180	+ *
	1181	+ * @return array
	1182	+ */
	1183	+ public static function widget_categories_args( $cat_args, $instance ) {
	1184	+ if ( !is_admin() ) {
	1185	+ /**
	1186	+ * Whether to filter get_terms.
	1187	+ *
	1188	+ * @param boolean $filter whether to filter
	1189	+ * @param array $cat_args category parameters
	1190	+ * @param array $instance instance details
	1191	+ *
	1192	+ * @return array
	1193	+ */
	1194	+ if ( apply_filters( 'groups_post_access_filter_widget_categories_args', true, $cat_args, $instance ) ) {
	1195	+ self::$filter_get_terms_widget = $instance;
	1196	+ add_filter( 'get_terms', array( __CLASS__, 'get_terms' ), 10, 4 );
	1197	+ }
	1198	+ }
	1199	+ return $cat_args;
	1200	+ }
	1201	+
	1202	+ /**
	1203	+ * Hooks into the filter to activate our get_terms filter.
	1204	+ *
	1205	+ * @since 2.20.0
	1206	+ *
	1207	+ * @param array $cat_args
	1208	+ * @param array $instance
	1209	+ *
	1210	+ * @return array
	1211	+ */
	1212	+ public static function widget_categories_dropdown_args( $cat_args, $instance ) {
	1213	+ if ( !is_admin() ) {
	1214	+ /**
	1215	+ * Whether to filter get_terms.
	1216	+ *
	1217	+ * @param boolean $filter whether to filter
	1218	+ * @param array $cat_args category parameters
	1219	+ * @param array $instance instance details
	1220	+ *
	1221	+ * @return array
	1222	+ */
	1223	+ if ( apply_filters( 'groups_post_access_filter_widget_categories_dropdown_args', true, $cat_args, $instance ) ) {
	1224	+ self::$filter_get_terms_widget = $instance;
	1225	+ add_filter( 'get_terms', array( __CLASS__, 'get_terms' ), 10, 4 );
	1226	+ }
	1227	+ }
	1228	+ return $cat_args;
	1229	+ }
	1230	+
	1231	+ /**
	1232	+ * Filter get_terms to adjust counts.
	1233	+ *
	1234	+ * @since 2.20.0
	1235	+ *
	1236	+ * @param array $terms
	1237	+ * @param array|null $taxonomies
	1238	+ * @param array $query_vars
	1239	+ * @param \WP_Term_Query $term_query
	1240	+ *
	1241	+ * @return array
	1242	+ */
	1243	+ public static function get_terms( $terms, $taxonomies, $query_vars, $term_query ) {
	1244	+
	1245	+ // act only once per add_filter we do in the specific cases we cover
	1246	+ remove_filter( 'get_terms', array( __CLASS__, 'get_terms' ), 10 );
	1247	+
	1248	+ if ( !is_admin() ) {
	1249	+ /**
	1250	+ * Whether to filter get_terms.
	1251	+ *
	1252	+ * @param boolean $filter whether to filter
	1253	+ * @param array $terms
	1254	+ * @param array|null $taxonomies
	1255	+ * @param array $query_vars
	1256	+ * @param \WP_Term_Query $term_query
	1257	+ *
	1258	+ * @return array
	1259	+ */
	1260	+ if ( apply_filters( 'groups_post_access_filter_get_terms', true, $terms, $taxonomies, $query_vars, $term_query ) ) {
	1261	+ foreach ( $terms as $term ) {
	1262	+ if ( is_object( $term ) && property_exists( $term, 'term_id' ) ) {
	1263	+ $query_args = array(
	1264	+ 'cat' => $term->term_id, // this category term
	1265	+ 'fields' => 'ids',
	1266	+ 'post_type' => 'post',
	1267	+ 'post_status' => 'publish',
	1268	+ 'numberposts' => -1, // all
	1269	+ 'suppress_filters' => false, // apply restrictions
	1270	+ 'orderby' => 'none', // performance
	1271	+ 'no_found_rows' => true, // performance
	1272	+ 'nopaging' => true // all
	1273	+ );
	1274	+ $post_ids = get_posts( $query_args );
	1275	+ $term->count = count( $post_ids );
	1276	+ }
	1277	+ }
	1278	+ _pad_term_counts( $terms, $taxonomies[0] );
	1279	+ $remove_empty = false;
	1280	+ if ( self::$filter_get_terms_block !== null ) {
	1281	+ if (
	1282	+ is_object( self::$filter_get_terms_block ) &&
	1283	+ // will mislead returning false because of dynamic properties : property_exists( self::$filter_get_terms_block, 'attributes' ) &&
	1284	+ is_array( self::$filter_get_terms_block->attributes ) &&
	1285	+ array_key_exists( 'showEmpty', self::$filter_get_terms_block->attributes ) &&
	1286	+ !self::$filter_get_terms_block->attributes['showEmpty']
	1287	+ ) {
	1288	+ $remove_empty = true;
	1289	+ }
	1290	+ }
	1291	+ if ( self::$filter_get_terms_widget !== null ) {
	1292	+ // There is no option to hide empty categories for the widget, so we always remove them.
	1293	+ // Otherwise the condition would be like ...
	1294	+ // if ( is_array( self::$filter_get_terms_widget ) && array_key_exists( 'show_empty', self::$filter_get_terms_widget ) && !self::$filter_get_terms_widget['show_empty'] )
	1295	+ // There seems to be a bug in WP_Widget_Categories with showing the counts. Even though the "Show post counts" option was checked, the post counts are not shown. Tested with WP 6.4.2 and Classic Widgets 0.3.
	1296	+ $remove_empty = true;
	1297	+ }
	1298	+ if ( $remove_empty ) {
	1299	+ $_terms = array();
	1300	+ foreach ( $terms as $term ) {
	1301	+ if ( is_object( $term ) && property_exists( $term, 'count' ) ) {
	1302	+ if ( $term->count > 0 ) {
	1303	+ $_terms[] = $term;
	1304	+ }
	1305	+ }
	1306	+ }
	1307	+ $terms = $_terms;
	1308	+ }
	1309	+ }
	1310	+ }
	1311	+
	1312	+ // void context
	1313	+ self::$filter_get_terms_block = null;
	1314	+ self::$filter_get_terms_widget = null;
	1315	+
	1316	+ return $terms;
	1317	+ }
	1318	+
	1319	+ /**
	1320	+ * Cache group for post type.
	1321	+ *
	1322	+ * @since 4.0.0
	1323	+ *
	1324	+ * @param string|WP_Post_Type $post_type
	1325	+ *
	1326	+ * @return string
	1327	+ */
	1328	+ public static function get_post_type_cache_group( $post_type ) {
	1329	+ if ( $post_type instanceof WP_Post_Type ) {
	1330	+ $post_type = $post_type->name;
	1331	+ }
	1332	+ $post_type = is_string( $post_type ) ? trim( sanitize_key( $post_type ) ) : 'void';
	1333	+ if ( strlen( $post_type ) === 0 ) {
	1334	+ $post_type = 'void';
	1335	+ }
	1336	+ return self::CACHE_GROUP . '_pt_' . $post_type;
	1337	+ }
439	1338	}
440	1339	Groups_Post_Access::init();