Post Status should be removed

[billerickson]

Someone contacted me directly, pointing out that the post status field allowed people to view private posts:

All site users with create_post permission can do the following and are
able to see the contents of private posts of all users, e.g. administrators:

[display-posts posts_per_page="-1" post_status="private" include_content="true"]

In fact the plugin is a db query tool without permission management.
This hurts privacy strongly. Probably only admins ("manage_options"
permission) should be able at all to save the "display posts" shortcode
to the db. Why anybody else should be allowed to create post lists?

I responded by limiting private posts to users with permission to view it ( @ee038a7 ). His recommendation is to remove post_status it altogether.

The "post_status" db
field is really a very dangeerous attribute to offer, because it
bypasses at least in some cases the content permission strategy of WP.

@danielbachhuber, what are your thoughts?

[billerickson]

My opinion:

The purpose of this plugin is to query posts. It's not limited to a certain kind of query or a specific use-case. I personally think all query arguments should be available so it can satisfy all uses of the plugin.

If your specific use-case requires limiting certain query arguments, I think that limit should be implemented through code. You can add this to your theme or core functionality plugin ( http://www.billerickson.net/code/display-posts-lockdown/ ).

[danielbachhuber]

My personal opinion is to keep the argument. I know of at least one WordPress.com user who is keeping pages unpublished so they don't appear elsewhere, but then using the post status argument to dynamically pull in content.

However, in 'untrusted' environments (where editors really don't want contributors to see other posts), the ability to query arbitrary statuses is problematic.

The best option is probably to limit use of post statuses for 'edit_others_posts' and higher caps.

[wpsmith]

What about just adding a filter for that so users/developers can lock this down tighter if they feel the need?

[billerickson]

@wpsmith a filter is in place. display_posts_shortcode_args lets you control what's included in the WP Query.

Closing this question. Thanks guys for confirming what I thought