Catch `setup_post_data` call without checking user capabilities in templates

[david-binda]

eg:

$post_id = get_query_var( 'post_id', null );
$post = get_post( $post_id );
setup_post_data( $post );

[rebeccahum]

@david-binda Do you mind explaining the reasoning behind why we need to check user capabilities when calling setup_post_data()?

[GaryJones]

Closing for lack of feedback. Can be re-opened if feedback arrives and it's still something that should be flagged.

[david-binda]

Sorry for being late here, and sorry for not being clear. The problem with the code above is following:

$post_id = get_query_var( 'post_id', null ); // Reads the `post_id` value from `$_GET` param.
$post = get_post( $post_id ); // Gets post data from DB.
setup_post_data( $post ); // Populates the data for usage in template (eg.: `the_title()`, `the_content()`).

The problem is that there is no check for whether the post_id passed via query string is visible to the current user (eg: private post ID is passed via GET param by non-logged in user). IMHO, current_user_can check would be appropriate here.