From 2ce808cc7f78a3377e3d608e05585a93e7f701c9 Mon Sep 17 00:00:00 2001
From: Peter Wilson <wilson@peterwilson.cc>
Date: Sat, 20 Jan 2024 00:00:11 +0000
Subject: [PATCH] Media: Revert [57310].

This commit reintroduced a minor data exposure issue.

Props swissspidy.
See #59866, #57913.


Built from https://develop.svn.wordpress.org/trunk@57318


git-svn-id: http://core.svn.wordpress.org/trunk@56824 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/canonical.php | 17 +++++------------
 wp-includes/version.php   |  2 +-
 2 files changed, 6 insertions(+), 13 deletions(-)

diff --git a/wp-includes/canonical.php b/wp-includes/canonical.php
index 2935a72662..0b94791fd9 100644
--- a/wp-includes/canonical.php
+++ b/wp-includes/canonical.php
@@ -550,20 +550,13 @@ function redirect_canonical( $requested_url = null, $do_redirect = true ) {
 	$is_attachment_redirect = false;
 
 	if ( is_attachment() && ! get_option( 'wp_attachment_pages_enabled' ) ) {
-		$attachment_id        = get_query_var( 'attachment_id' );
-		$attachment_post      = get_post( $attachment_id );
-		$attachment_parent_id = $attachment_post ? $attachment_post->post_parent : 0;
+		$attachment_id = get_query_var( 'attachment_id' );
 
-		/*
-		 * If an attachment is attached to a post, it inherits the parent post's status. Fetch the
-		 * parent post to check its status later.
-		 */
-		if ( $attachment_parent_id ) {
-			$redirect_obj = get_post( $attachment_parent_id );
+		if ( current_user_can( 'read_post', $attachment_id ) ) {
+			$redirect_url = wp_get_attachment_url( $attachment_id );
+
+			$is_attachment_redirect = true;
 		}
-		$redirect_url = wp_get_attachment_url( $attachment_id );
-
-		$is_attachment_redirect = true;
 	}
 
 	$redirect['query'] = preg_replace( '#^\??&*?#', '', $redirect['query'] );
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 8191882f61..266a2e02ec 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.5-alpha-57317';
+$wp_version = '6.5-alpha-57318';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.