Skip to content

Instant Results search template is generated as the current user #2650

Closed
@JakePT

Description

Describe the bug
When the Elasticsearch query template is created by Instant Results to be used by EP.io for API search results a WP_Query is performed with a placeholder search term, and the Elasticsearch version of that query is sent to EP.io or a proxy as the template for API search requests. This query is generated while the admin user is logged in.

This means that when the query is generated, if a plugin is filtering the query with pre_get_posts or similar, then is_user_logged_in() and wp_get_current_user() etc. all return for the current user. This means that if a query is being modified to exclude certain posts for anonymous users then those posts will not be excluded from Instant Results searches.

This affected us because ProtectedContent:: exclude_protected_posts() is checking is_user_logged_in() before adding the query filter to exclude password protected posts from results. This means that this filter is not present in the search template used by Elasticsearch.

Steps to Reproduce
With ElasticPress enabled and the Protected Content feature enabled, but not Instant Results:

  1. Add a password protected post.
  2. In an incognito window search for that post. It should not be returned.
  3. Activate Instant Results.
  4. In an incognito window search for that post. The post will be returned.

Expected behavior
Search results in Instant Results should match what's seen by anonymous users in regular search results.

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions