Update: Exclude password protected posts from search

[dinhtungdu]

Description of the Change

This PR is a replacement for #1789. Instead of adding a new meta, we use has_password argument of WP_Query to control the visibility of protected posts.

By default, EP doesn't index password-protected posts. They will be indexed if Protected content feature is enabled. Again, only admin queries return protected posts; this PR introduces a new filter to enabled it on the frontend: ep_exclude_password_protected_from_search.

Alternate Designs

See #1789.

Benefits

Hide password-protected posts from search results.

Possible Drawbacks

None that I'm aware of.

Verification Process

Reindex site contains password protected posts with Protected Content enabled. See protected posts in the admin area but not on the frontend.

Checklist:

• I have read the CONTRIBUTING document.
• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my change.
• All new and existing tests passed.

Applicable Issues

Closes #1789

Changelog Entry

[dinhtungdu]

@tlovett1 Excluding password-protected posts is not the default behavior of WordPress core but it makes sense to me. Should we respect core behavior here? Given that we can change it by using the new filter introduced in this PR.

[sagarsdeshmukh]

Is there any blocker in review & merging this PR?

[abdullah1908]

@dinhtungdu thank you so much for submitting MR. We'll surely take a look & bring under consideration while tech discussion would be continued.

[rebeccahum]

Hi all,

Any timeline or update on the status of this?

[rebeccahum]

Did some extensive testing on the current state of the PR and I found the below scenarios occurring:

Scenario 1

1. Enable protected_content
2. Create post
3. Create another post with password
4. Do front-end search for a term in post_content of step 3 and expect to see no post

At step 4, it actually shows the post. The only way to fix this is by running index --setup.

Scenario 2

Continuing from scenario 1, after running index --setup

1. Remove password from passworded post
2. Do front-end search and see post
3. Add back password to same post in step 1)
4. Repeat step 2)

At step 4, it still shows the passworded post as well.

Scenario 3

1. Before protected_content is enabled, create one or two password-protected posts
2. Run index with --setup
3. Go to wp-admin and expect to see the password protected posts listed

At step 3, you do not see the password protected posts listed.

[oscarssanchez]

closing in favor of #2408