Fix handling of password protected posts

README.md

@@ -4,7 +4,7 @@
 **Tags:** OStatus, fediverse, activitypub, activitystream  
 **Requires at least:** 4.7  
 **Tested up to:** 6.1  
-**Stable tag:** 0.16.4  
+**Stable tag:** 0.16.5  
 **Requires PHP:** 5.6  
 **License:** MIT  
 **License URI:** http://opensource.org/licenses/MIT  
@@ -88,6 +88,10 @@ Where 'blog' is the path to the subdirectory at which your blog resides.
 
 Project maintained on GitHub at [pfefferle/wordpress-activitypub](https://github.com/pfefferle/wordpress-activitypub).
 
+### 0.16.5 ###
+
+* Return empty content/excerpt on password protected posts/pages
+
 ### 0.16.4 ###
 
 * Remove scripts later in the queue, to also handle scripts added by blocks

activitypub.php

@@ -3,7 +3,7 @@
  * Plugin Name: ActivityPub
  * Plugin URI: https://github.com/pfefferle/wordpress-activitypub/
  * Description: The ActivityPub protocol is a decentralized social networking protocol based upon the ActivityStreams 2.0 data format.
- * Version: 0.16.4
+ * Version: 0.16.5
  * Author: Matthias Pfefferle
  * Author URI: https://notiz.blog/
  * License: MIT

readme.txt

@@ -4,7 +4,7 @@ Donate link: https://notiz.blog/donate/
 Tags: OStatus, fediverse, activitypub, activitystream
 Requires at least: 4.7
 Tested up to: 6.1
-Stable tag: 0.16.4
+Stable tag: 0.16.5
 Requires PHP: 5.6
 License: MIT
 License URI: http://opensource.org/licenses/MIT
@@ -88,6 +88,10 @@ Where 'blog' is the path to the subdirectory at which your blog resides.
 
 Project maintained on GitHub at [pfefferle/wordpress-activitypub](https://github.com/pfefferle/wordpress-activitypub).
 
+= 0.16.5 =
+
+* Return empty content/excerpt on password protected posts/pages
+
 = 0.16.4 =
 
 * Remove scripts later in the queue, to also handle scripts added by blocks

tests/test-class-activitypub-shortcodes.php

@@ -27,4 +27,33 @@ class Test_Activitypub_Shortcodes extends WP_UnitTestCase {
 
 		$this->assertEquals( '<p>hallo</p>', $content );
 	}
+
+	public function test_password_protected_content() {
+		global $post;
+
+		$post_id = -98; // negative ID, to avoid clash with a valid post
+		$post = new stdClass();
+		$post->ID = $post_id;
+		$post->post_author = 1;
+		$post->post_date = current_time( 'mysql' );
+		$post->post_date_gmt = current_time( 'mysql', 1 );
+		$post->post_title = 'Some title or other';
+		$post->post_content = '<script>test</script>hallo<script type="javascript">{"asdf": "qwerty"}</script><style></style>';
+		$post->post_status = 'publish';
+		$post->comment_status = 'closed';
+		$post->ping_status = 'closed';
+		$post->post_name = 'fake-page-' . rand( 1, 99999 ); // append random number to avoid clash
+		$post->post_type = 'page';
+		$post->post_password = 'abc';
+		$post->filter = 'raw'; // important!
+
+		$content = '[ap_content]';
+
+		// Fill in the shortcodes.
+		setup_postdata( $post );
+		$content = do_shortcode( $content );
+		wp_reset_postdata();
+
+		$this->assertEquals( '', $content );
+	}
 }