Skip to content

Post statuses that have been allowed to be viewable by anonymous users not returned in GraphQL #2819

Description

@gblicharz

Description

We have extended the functionality of our WordPress site to allow posts with a status of "future" to be viewable to anonymous users. Making this change allows the posts with the "future" status to be viewable on our website, as well as be available via the JSON API.

This override is not respected by a graphQL query where the "stati" is specified, unless I toggle the "logged in user" in the WordPress, the GraphiQL IDE. Then the correct data is returned.

The WPGraphQL query should respect the current permissions/settings that allow posts to be visible to anonymous users similar to the logic in the WordPress front-end or JSON APIs.

Steps to reproduce

  1. Create a new post that will be published at a future date
  2. Take note of the post ID after saving
  3. Update the functions.php file for the active theme with the following:
function change_future_post_status_permissions() {
  global  $wp_post_statuses;
  $wp_post_statuses['future']->public = true;
}
add_action('init','change_future_post_status_permissions');
  1. Verify that the post is viewable on the website
  2. Verify that the post is viewable via the JSON API path: https://wfmt.lndo.site/wp-json/wp/v2/posts/[post_id], and that the "status" attribute has a value of "future".
  3. Go to the GraphiQL IDE and create the following query:
  posts(first: 1000, where: {stati: FUTURE}) {
    nodes {
      title
      postId
    }
  }
}

Actual results:

  "data": {
    "posts": {
      "nodes": []
    }
  }
}

Expected results:

  "data": {
    "posts": {
      "nodes": [
        {
          "postId": 159489,
          "status": "future"
        }      
     ]
    }
  }
}

Clicking the "Switch to execute as the logged-in user" button in the GraphiQL IDE and re-running the query produces the expected results.

Additional context

No response

WPGraphQL Version

1.13.7

WordPress Version

6.2

PHP Version

8.4.33

Additional enviornment details

No response

Please confirm that you have searched existing issues in the repo.

  • Yes

Please confirm that you have disabled ALL plugins except for WPGraphQL.

  • Yes
  • My issue is with compatibility with a specific WordPress plugin, and I have listed all my installed plugins (and version info) above.

Metadata

Metadata

Assignees

No one assigned

    Labels

    component: connectionsRelating to GraphQL Connectionscomponent: model layerRelating to the Model Layereffort: medLess than a weekimpact: medMinor performance improvements, fix broad user base issuesobject type: postRelating to the Post Object Typesscope: securitySecuring against vulnerabilities and threatsstatus: actionableReady for work to begintype: bugIssue that causes incorrect or unexpected behavior

    Type

    No fields configured for Bug.

    Projects

    Status
    ✅ Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions