Cheon, YoungMin

I am waiting for this security patch as well

Hosting provider recommended me to delete plugins right now 🙁

Add lines below to custom-post-templates.php:176 (version 1.5)

$post_templates = array();

		$files = (array) $theme->get_files( 'php', 1 );
		// MOD START
		if ( $theme->parent() )
			$files += (array) $theme->parent()->get_files( 'php', 1 );
		// MOD END

I’ve just tested with WordPress 2.8.4 and it worked 🙂

It was not a K2 bug.

It’s the matter of when $wp_the_query->get_queried_object() is firstly called.

As I mentioned above, $wp_the_query->post is overrod by $post.

wp-settings.php
$wp_the_query =& new WP_Query();
$wp_query     =& $wp_the_query;

wp-includes/class.php WP::register_globals()
$GLOBALS['posts'] = & $wp_query->posts;
$GLOBALS['post'] = & $wp_query->post;

If a page haven’t called $wp_the_query->get_queried_object() before a ‘custom loop’ (or something overriding $post or $posts), get_queried_object_id() would retun last post id of the ‘custom loop’.

$wp_the_query->get_queried_object() would not stable until it is firstly called before any plugin or theme.

It seems stable ’cause it returns pre-set value if available.

function get_queried_object() {
	if (isset($this->queried_object)) {
		return $this->queried_object;
	}

Because almost wordpress theme use ‘wp_title()’ for <title> </title> and wp_title call ‘wp_query->get_queried_object()’, there seems no problem.

For current K2 does not use wp_title() but the_title() which does not call ‘get_queried_object’, this issue seems related to K2.

Here’s my suggestion to wordpress and I think it will help make $wp_the_query stable.

wp-includes/class.php ‘WP::query_posts()’

function query_posts() {
	global $wp_the_query;
	$this->build_query_string();
	$wp_the_query->query($this->query_vars);
	$wp_the_query->get_queried_object();// add this line
}

And temporary patch for K2 is replacing the_title() with wp_title() on header.php but it will not solve the whole problem.

I was wrong, it’s not about WP_Query but $post.

$post variable overrides $wp_query->post and $wp_the_query->post.

And any plugin or theme using ‘custom loop’ would replace the wordpress $post, and ‘latest post’ sidebar module is one of them.

e.g.
foreach($myposts as $post) {……}
or
while($myposts->have_posts): $myposts->the_post(); …… endwhile;

$myposts would be get_posts(‘query…’) or new WP_Query(‘query…’)

Since almost stat plugin do their job at the end of the page load, they got overridden post values.

And here’s a temporary patch.

WordPress.com Stats
Find :

if ( ( $wp_the_query->is_single || $wp_the_query->is_page ) && !$wp_the_query->is_attachment )
		$a['post'] = $wp_the_query->get_queried_object_id();
	else

Replace with :

if ( ( $wp_the_query->is_single || $wp_the_query->is_page ) && !$wp_the_query->is_attachment ) {
		$wp_the_query->rewind_posts();
		$a['post'] = $wp_the_query->get_queried_object_id();
	} else

SlimStat-Ex
(I’ll update this plugin soon.)
Find : (inside of function _getPostTitle – lib/functions.php)

if($track) {
			$_query =& $wp_query;
		} else {

Replace with :

if($track) {
			$_query =& $wp_query;
			$_query->rewind_posts();
		} else {