[wp-hackers] Private posts and get_posts()

[Micky Hulse]

Question:

On the front-end, should any admin see private posts made by other
users? Or, are private posts only visible to the person who made the
post?

Details (feel free to skip this part):

The get_posts() docs say:

"Unlike get_pages(), get_posts() will return private pages in the
appropriate context (i.e., for an administrator). "
- <http://codex.wordpress.org/Template_Tags/get_posts#Return_Value>

Looking at get_posts() source code, I see:

if ( empty( $r['post_status'] ) )
        $r['post_status'] = ( 'attachment' == $r['post_type'] ) ?
'inherit' : 'publish';

... the default post status is "publish" (or "inherit" if attachment).

Looking further, get_post() calls WP_Query:

"post_status (string / array) - use post status. Retrieves posts by
Post Status. Default value is 'publish', but if the user is logged in,
'private' is added."
- <http://codex.wordpress.org/Class_Reference/WP_Query#Status_Parameters>

I could have been doing something wrong, but when I tried to view posts using:

get_posts(array('orderby' => 'rand'));

My admin user didn't see the posts statused as private.

Then again, I wasn't the one that created the private post, so maybe
only authors of private posts can see their own privately statused
posts?

Currently, as a patch, I'm using this code:

$args = array('orderby' => 'rand');
if (is_user_logged_in()) $args['post_status'] = array('publish', 'private',);
$rand_posts = get_posts($args);

Thanks!