A password protected post can be sticky but sometimes this behaviour is forbidden.

[clementpolito]

A password protected post can be sticky, in several ways, but sometimes it is forbidden.

With Block Editor
When working on a post, I can check the ‘Password Protected’ and ‘Sticky’ boxes at the same time.
But if I set a password and save, I get the error message :

Creating a new post

Publishing failed. A post can not be sticky and have a password.

Updating a post

Updating failed. A sticky post cannot be password protected.

Quick Edit
When using quick edit, I can set both at the same time (Password Protected and Sticky)

With Classic Editor 1.6.7
With the classic editor, in the UI, I cannot set a password-protected post as Sticky because "Password protected" is only available as an sub-option of Public page.

In REST API
I get an Error 400 :

curl --request POST \
  --url 'https://zip-website.ddev.site/wp-json/wp/v2/posts?title=sticky%20bis&password=123456&sticky=true' \
  --header 'authorization: Basic cGxsLWFkbWluOnY0WkUgZUxwYSBGVktaIGJUSGMgcUJjMiBadmJs'

Answer :

{
  "code": "rest_invalid_field",
  "message": "A post can not be sticky and have a password.",
  "data": {
    "status": 400
  }
}

Can we improve the UI in the editor so that we don't have the two possible options?
Can we standardise the behaviour so that it is blocked everywhere or accepted everywhere?

[clementpolito]

I can check password protected and sticky in the same time

[clementpolito]

When I publish the post, I get an error message : "A post can not be sticky and have a password."

[clementpolito]

I can define a password and stick the post in the quick edit 01/02

[clementpolito]

I can define a password and stick the post in the quick edit 02/02

[jsmansart]

In REST API, the code show that it's not possible to have both sticky and password proctected posts.

Code can be reach here : ​https://github.com/WordPress/wordpress-develop/blob/6.9.1/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php#L1407-L1428

Visibility is never set for password when using quick edit, thus edit_post() cannot unset sticky status in ​https://github.com/WordPress/wordpress-develop/blob/6.9.1/src/wp-admin/includes/post.php#L308-L322.

Looking at it, I thought that wp_ajax_inline_save() would handle that like it does for private status. But it might be dead code around ​https://github.com/WordPress/wordpress-develop/blob/6.9.1/src/wp-admin/includes/ajax-actions.php#L2117-L2122.
Removing it does effect the feature (remove sticky status when a post is private).

Trac ticket: https://core.trac.wordpress.org/ticket/64810

[audrasjb]

Looks like it moved enough to be milestoned to 7.1

[khushi1501]

I tested this issue and was able to reproduce the behavior.

I also tested the provided patch, and it is working as expected. The issue with sticky posts and password-protected posts appears to be resolved after applying the patch.

Editor without applying patch:-
​https://prnt.sc/vt86y5NOEo0d

Quick edit:-
​https://prnt.sc/56vvH2IXQutt

Editor after applying the patch:-
​https://prnt.sc/hJ2AfH5yCg_N