Merge pull request #1189 from tomusborne/release/1.8.3

Release: 1.8.3

dist/blocks.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-api-fetch', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-notices', 'wp-primitives', 'wp-rich-text'), 'version' => 'fda41331ac8ec0795fbf');
+<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-api-fetch', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-notices', 'wp-primitives', 'wp-rich-text'), 'version' => '99e78c68264b9c1883a4');

includes/class-query-loop.php

@@ -129,6 +129,15 @@ public static function get_query_args( $block, $page ) {
 			$query_args['posts_per_page'] = $per_page;
 		}
 
+		if (
+			isset( $query_args['post_status'] ) &&
+			'publish' !== $query_args['post_status'] &&
+			! current_user_can( 'read_private_posts' )
+		) {
+			// If the user can't read private posts, we'll force the post status to be public.
+			$query_args['post_status'] = 'publish';
+		}
+
 		return $query_args;
 	}
 

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "generateblocks",
-	"version": "1.8.2",
+	"version": "1.8.3",
 	"private": true,
 	"description": "A small collection of lightweight WordPress blocks that can accomplish nearly anything.",
 	"author": "Tom Usborne",

plugin.php

@@ -5,7 +5,7 @@
  * Description: A small collection of lightweight WordPress blocks that can accomplish nearly anything.
  * Author: Tom Usborne
  * Author URI: https://tomusborne.com
- * Version: 1.8.2
+ * Version: 1.8.3
  * Requires at least: 5.9
  * Requires PHP: 7.2
  * License: GPL2+
@@ -19,7 +19,7 @@
 	exit; // Exit if accessed directly.
 }
 
-define( 'GENERATEBLOCKS_VERSION', '1.8.2' );
+define( 'GENERATEBLOCKS_VERSION', '1.8.3' );
 define( 'GENERATEBLOCKS_DIR', plugin_dir_path( __FILE__ ) );
 define( 'GENERATEBLOCKS_DIR_URL', plugin_dir_url( __FILE__ ) );
 

readme.txt

@@ -5,7 +5,7 @@ Tags: blocks, gutenberg, container, headline, grid, columns, page builder, wysiw
 Requires at least: 5.9
 Tested up to: 6.4
 Requires PHP: 7.2
-Stable tag: 1.8.2
+Stable tag: 1.8.3
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
@@ -83,6 +83,9 @@ GenerateBlocks was built to work hand-in-hand with [GeneratePress](https://gener
 
 == Changelog ==
 
+= 1.8.3 =
+* Security: Add user capability check to Query Loop post status
+
 = 1.8.2 =
 * Fix: Border colors not showing when old attributes are set.
 * Tweak: Add support for the newly created core function "wp_img_tag_add_loading_optimization_attrs"

src/blocks/query-loop/components/QueryLoopRenderer.js

@@ -17,9 +17,20 @@ export default function QueryLoopRenderer( props ) {
 			getEntityRecords,
 			isResolving,
 			hasFinishedResolution,
+			canUser,
 		} = select( coreStore );
 
-		const queryParams = [ 'postType', query.post_type || 'post', normalizedQuery ];
+		let queryData = normalizedQuery;
+
+		// If the user can't update settings, we'll only show published posts.
+		if ( ! canUser( 'update', 'settings' ) ) {
+			queryData = {
+				...queryData,
+				status: 'publish',
+			};
+		}
+
+		const queryParams = [ 'postType', query.post_type || 'post', queryData ];
 
 		return {
 			data: getEntityRecords( ...queryParams ),