Wordpress 3.7
[autoinstalls/wordpress.git] / wp-includes / class-wp-xmlrpc-server.php
index 3080696ff738be4205e75170732307d68726e295..d3ebdb8bb3ab2cc7604794505ced0f0434e26c22 100644 (file)
@@ -12,8 +12,8 @@
  * pingback. Additional WordPress API for managing comments, pages, posts,
  * options, etc.
  *
- * Since WordPress 2.6.0, WordPress XMLRPC server can be disabled in the
- * administration panels.
+ * As of WordPress 3.5.0, XML-RPC is enabled by default. It can be disabled
+ * via the xmlrpc_enabled filter found in wp_xmlrpc_server::login().
  *
  * @package WordPress
  * @subpackage Publishing
@@ -48,6 +48,10 @@ class wp_xmlrpc_server extends IXR_Server {
                        'wp.getTerms'                   => 'this:wp_getTerms',
                        'wp.getTaxonomy'                => 'this:wp_getTaxonomy',
                        'wp.getTaxonomies'              => 'this:wp_getTaxonomies',
+                       'wp.getUser'                    => 'this:wp_getUser',
+                       'wp.getUsers'                   => 'this:wp_getUsers',
+                       'wp.getProfile'                 => 'this:wp_getProfile',
+                       'wp.editProfile'                => 'this:wp_editProfile',
                        'wp.getPage'                    => 'this:wp_getPage',
                        'wp.getPages'                   => 'this:wp_getPages',
                        'wp.newPage'                    => 'this:wp_newPage',
@@ -78,14 +82,14 @@ class wp_xmlrpc_server extends IXR_Server {
                        'wp.getPostFormats'     => 'this:wp_getPostFormats',
                        'wp.getPostType'                => 'this:wp_getPostType',
                        'wp.getPostTypes'               => 'this:wp_getPostTypes',
+                       'wp.getRevisions'               => 'this:wp_getRevisions',
+                       'wp.restoreRevision'    => 'this:wp_restoreRevision',
 
                        // Blogger API
                        'blogger.getUsersBlogs' => 'this:blogger_getUsersBlogs',
                        'blogger.getUserInfo' => 'this:blogger_getUserInfo',
                        'blogger.getPost' => 'this:blogger_getPost',
                        'blogger.getRecentPosts' => 'this:blogger_getRecentPosts',
-                       'blogger.getTemplate' => 'this:blogger_getTemplate',
-                       'blogger.setTemplate' => 'this:blogger_setTemplate',
                        'blogger.newPost' => 'this:blogger_newPost',
                        'blogger.editPost' => 'this:blogger_editPost',
                        'blogger.deletePost' => 'this:blogger_deletePost',
@@ -101,8 +105,6 @@ class wp_xmlrpc_server extends IXR_Server {
                        // MetaWeblog API aliases for Blogger API
                        // see http://www.xmlrpc.com/stories/storyReader$2460
                        'metaWeblog.deletePost' => 'this:blogger_deletePost',
-                       'metaWeblog.getTemplate' => 'this:blogger_getTemplate',
-                       'metaWeblog.setTemplate' => 'this:blogger_setTemplate',
                        'metaWeblog.getUsersBlogs' => 'this:blogger_getUsersBlogs',
 
                        // MovableType API
@@ -157,49 +159,34 @@ class wp_xmlrpc_server extends IXR_Server {
                return $number1 + $number2;
        }
 
-       /**
-        * Check user's credentials.
-        *
-        * @since 1.5.0
-        *
-        * @param string $user_login User's username.
-        * @param string $user_pass User's password.
-        * @return bool Whether authentication passed.
-        * @deprecated use wp_xmlrpc_server::login
-        * @see wp_xmlrpc_server::login
-        */
-       function login_pass_ok($user_login, $user_pass) {
-               if ( !get_option( 'enable_xmlrpc' ) ) {
-                       $this->error = new IXR_Error( 405, sprintf( __( 'XML-RPC services are disabled on this site. An admin user can enable them at %s'),  admin_url('options-writing.php') ) );
-                       return false;
-               }
-
-               if (!user_pass_ok($user_login, $user_pass)) {
-                       $this->error = new IXR_Error(403, __('Bad login/pass combination.'));
-                       return false;
-               }
-               return true;
-       }
-
        /**
         * Log user in.
         *
-        * @since 2.8
+        * @since 2.8.0
         *
         * @param string $username User's username.
         * @param string $password User's password.
         * @return mixed WP_User object if authentication passed, false otherwise
         */
-       function login($username, $password) {
-               if ( !get_option( 'enable_xmlrpc' ) ) {
-                       $this->error = new IXR_Error( 405, sprintf( __( 'XML-RPC services are disabled on this site. An admin user can enable them at %s'),  admin_url('options-writing.php') ) );
+       function login( $username, $password ) {
+               // Respect any old filters against get_option() for 'enable_xmlrpc'.
+               $enabled = apply_filters( 'pre_option_enable_xmlrpc', false ); // Deprecated
+               if ( false === $enabled )
+                       $enabled = apply_filters( 'option_enable_xmlrpc', true ); // Deprecated
+
+               // Proper filter for turning off XML-RPC. It is on by default.
+               $enabled = apply_filters( 'xmlrpc_enabled', $enabled );
+
+               if ( ! $enabled ) {
+                       $this->error = new IXR_Error( 405, sprintf( __( 'XML-RPC services are disabled on this site.' ) ) );
                        return false;
                }
 
                $user = wp_authenticate($username, $password);
 
                if (is_wp_error($user)) {
-                       $this->error = new IXR_Error(403, __('Bad login/pass combination.'));
+                       $this->error = new IXR_Error( 403, __( 'Incorrect username or password.' ) );
+                       $this->error = apply_filters( 'xmlrpc_login_error', $this->error, $user );
                        return false;
                }
 
@@ -208,28 +195,38 @@ class wp_xmlrpc_server extends IXR_Server {
        }
 
        /**
-        * Sanitize string or array of strings for database.
+        * Check user's credentials. Deprecated.
         *
-        * @since 1.5.2
+        * @since 1.5.0
+        * @deprecated 2.8.0
+        * @deprecated use wp_xmlrpc_server::login
+        * @see wp_xmlrpc_server::login
         *
-        * @param string|array $array Sanitize single string or array of strings.
-        * @return string|array Type matches $array and sanitized for the database.
+        * @param string $username User's username.
+        * @param string $password User's password.
+        * @return bool Whether authentication passed.
         */
-       function escape(&$array) {
-               global $wpdb;
+       function login_pass_ok( $username, $password ) {
+               return (bool) $this->login( $username, $password );
+       }
 
-               if (!is_array($array)) {
-                       return($wpdb->escape($array));
-               } else {
-                       foreach ( (array) $array as $k => $v ) {
-                               if ( is_array($v) ) {
-                                       $this->escape($array[$k]);
-                               } else if ( is_object($v) ) {
-                                       //skip
-                               } else {
-                                       $array[$k] = $wpdb->escape($v);
-                               }
-                       }
+       /**
+        * Escape string or array of strings for database.
+        *
+        * @since 1.5.2
+        *
+        * @param string|array $data Escape single string or array of strings.
+        * @return string|array Type matches $data and sanitized for the database.
+        */
+       function escape( &$data ) {
+               if ( ! is_array( $data ) )
+                       return wp_slash( $data );
+
+               foreach ( $data as &$v ) {
+                       if ( is_array( $v ) )
+                               $this->escape( $v );
+                       elseif ( ! is_object( $v ) )
+                               $v = wp_slash( $v );
                }
        }
 
@@ -277,16 +274,16 @@ class wp_xmlrpc_server extends IXR_Server {
                                $meta['id'] = (int) $meta['id'];
                                $pmeta = get_metadata_by_mid( 'post', $meta['id'] );
                                if ( isset($meta['key']) ) {
-                                       $meta['key'] = stripslashes( $meta['key'] );
-                                       if ( $meta['key'] != $pmeta->meta_key )
+                                       $meta['key'] = wp_unslash( $meta['key'] );
+                                       if ( $meta['key'] !== $pmeta->meta_key )
                                                continue;
-                                       $meta['value'] = stripslashes_deep( $meta['value'] );
+                                       $meta['value'] = wp_unslash( $meta['value'] );
                                        if ( current_user_can( 'edit_post_meta', $post_id, $meta['key'] ) )
                                                update_metadata_by_mid( 'post', $meta['id'], $meta['value'] );
                                } elseif ( current_user_can( 'delete_post_meta', $post_id, $pmeta->meta_key ) ) {
                                        delete_metadata_by_mid( 'post', $meta['id'] );
                                }
-                       } elseif ( current_user_can( 'add_post_meta', $post_id, stripslashes( $meta['key'] ) ) ) {
+                       } elseif ( current_user_can( 'add_post_meta', $post_id, wp_unslash( $meta['key'] ) ) ) {
                                add_post_meta( $post_id, $meta['key'], $meta['value'] );
                        }
                }
@@ -315,10 +312,25 @@ class wp_xmlrpc_server extends IXR_Server {
                                'value'         => $wp_version
                        ),
                        'blog_url'          => array(
-                               'desc'          => __( 'Site URL' ),
+                               'desc'          => __( 'WordPress Address (URL)' ),
                                'readonly'      => true,
                                'option'        => 'siteurl'
                        ),
+                       'home_url'          => array(
+                               'desc'          => __( 'Site Address (URL)' ),
+                               'readonly'      => true,
+                               'option'        => 'home'
+                       ),
+                       'login_url'          => array(
+                               'desc'          => __( 'Login Address (URL)' ),
+                               'readonly'      => true,
+                               'value'         => wp_login_url( )
+                       ),
+                       'admin_url'          => array(
+                               'desc'          => __( 'The URL to the admin area' ),
+                               'readonly'      => true,
+                               'value'         => get_admin_url( )
+                       ),
                        'image_default_link_type' => array(
                                'desc'          => __( 'Image default link type' ),
                                'readonly'      => true,
@@ -473,15 +485,17 @@ class wp_xmlrpc_server extends IXR_Server {
                                continue;
 
                        $blog_id = $blog->userblog_id;
-                       switch_to_blog($blog_id);
-                       $is_admin = current_user_can('manage_options');
+
+                       switch_to_blog( $blog_id );
+
+                       $is_admin = current_user_can( 'manage_options' );
 
                        $struct[] = array(
                                'isAdmin'               => $is_admin,
-                               'url'                   => get_option( 'home' ) . '/',
+                               'url'                   => home_url( '/' ),
                                'blogid'                => (string) $blog_id,
                                'blogName'              => get_option( 'blogname' ),
-                               'xmlrpc'                => site_url( 'xmlrpc.php' )
+                               'xmlrpc'                => site_url( 'xmlrpc.php', 'rpc' ),
                        );
 
                        restore_current_blog();
@@ -533,6 +547,9 @@ class wp_xmlrpc_server extends IXR_Server {
                if ( in_array( 'cap', $fields ) )
                        $_taxonomy['cap'] = (array) $taxonomy->cap;
 
+               if ( in_array( 'menu', $fields ) )
+                       $_taxonomy['show_in_menu'] = (bool) $_taxonomy->show_in_menu;
+
                if ( in_array( 'object_type', $fields ) )
                        $_taxonomy['object_type'] = array_unique( (array) $taxonomy->object_type );
 
@@ -552,13 +569,13 @@ class wp_xmlrpc_server extends IXR_Server {
                if ( ! is_array( $_term) )
                        $_term = get_object_vars( $_term );
 
-               // For Intergers which may be largeer than XMLRPC supports ensure we return strings.
+               // For integers which may be larger than XML-RPC supports ensure we return strings.
                $_term['term_id'] = strval( $_term['term_id'] );
                $_term['term_group'] = strval( $_term['term_group'] );
                $_term['term_taxonomy_id'] = strval( $_term['term_taxonomy_id'] );
                $_term['parent'] = strval( $_term['parent'] );
 
-               // Count we are happy to return as an Integer because people really shouldn't use Terms that much.
+               // Count we are happy to return as an integer because people really shouldn't use terms that much.
                $_term['count'] = intval( $_term['count'] );
 
                return apply_filters( 'xmlrpc_prepare_term', $_term, $term );
@@ -622,7 +639,11 @@ class wp_xmlrpc_server extends IXR_Server {
                        'post_password'     => $post['post_password'],
                        'post_excerpt'      => $post['post_excerpt'],
                        'post_content'      => $post['post_content'],
+                       'post_parent'       => strval( $post['post_parent'] ),
+                       'post_mime_type'    => $post['post_mime_type'],
                        'link'              => post_permalink( $post['ID'] ),
+                       'guid'              => $post['guid'],
+                       'menu_order'        => intval( $post['menu_order'] ),
                        'comment_status'    => $post['comment_status'],
                        'ping_status'       => $post['ping_status'],
                        'sticky'            => ( $post['post_type'] === 'post' && is_sticky( $post['ID'] ) ),
@@ -769,7 +790,7 @@ class wp_xmlrpc_server extends IXR_Server {
                // Get info the page parent if there is one.
                $parent_title = "";
                if ( ! empty( $page->post_parent ) ) {
-                       $parent = get_page( $page->post_parent );
+                       $parent = get_post( $page->post_parent );
                        $parent_title = $parent->post_title;
                }
 
@@ -866,6 +887,46 @@ class wp_xmlrpc_server extends IXR_Server {
                return apply_filters( 'xmlrpc_prepare_comment', $_comment, $comment );
        }
 
+       /**
+        * Prepares user data for return in an XML-RPC object.
+        *
+        * @access protected
+        *
+        * @param WP_User $user The unprepared user object
+        * @param array $fields The subset of user fields to return
+        * @return array The prepared user data
+        */
+       protected function _prepare_user( $user, $fields ) {
+               $_user = array( 'user_id' => strval( $user->ID ) );
+
+               $user_fields = array(
+                       'username'          => $user->user_login,
+                       'first_name'        => $user->user_firstname,
+                       'last_name'         => $user->user_lastname,
+                       'registered'        => $this->_convert_date( $user->user_registered ),
+                       'bio'               => $user->user_description,
+                       'email'             => $user->user_email,
+                       'nickname'          => $user->nickname,
+                       'nicename'          => $user->user_nicename,
+                       'url'               => $user->user_url,
+                       'display_name'      => $user->display_name,
+                       'roles'             => $user->roles,
+               );
+
+               if ( in_array( 'all', $fields ) ) {
+                       $_user = array_merge( $_user, $user_fields );
+               } else {
+                       if ( in_array( 'basic', $fields ) ) {
+                               $basic_fields = array( 'username', 'email', 'registered', 'display_name', 'nicename' );
+                               $fields = array_merge( $fields, $basic_fields );
+                       }
+                       $requested_fields = array_intersect_key( $user_fields, array_flip( $fields ) );
+                       $_user = array_merge( $_user, $requested_fields );
+               }
+
+               return apply_filters( 'xmlrpc_prepare_user', $_user, $user, $fields );
+       }
+
        /**
         * Create a new post for any registered post type.
         *
@@ -881,7 +942,7 @@ class wp_xmlrpc_server extends IXR_Server {
         *      - post_status (default: 'draft')
         *      - post_title
         *      - post_author
-        *      - post_exerpt
+        *      - post_excerpt
         *      - post_content
         *      - post_date_gmt | post_date
         *      - post_format
@@ -953,12 +1014,12 @@ class wp_xmlrpc_server extends IXR_Server {
                if ( $update ) {
                        if ( ! get_post( $post_data['ID'] ) )
                                return new IXR_Error( 401, __( 'Invalid post ID.' ) );
-                       if ( ! current_user_can( $post_type->cap->edit_post, $post_data['ID'] ) )
+                       if ( ! current_user_can( 'edit_post', $post_data['ID'] ) )
                                return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
                        if ( $post_data['post_type'] != get_post_type( $post_data['ID'] ) )
                                return new IXR_Error( 401, __( 'The post type may not be changed.' ) );
                } else {
-                       if ( ! current_user_can( $post_type->cap->edit_posts ) )
+                       if ( ! current_user_can( $post_type->cap->create_posts ) || ! current_user_can( $post_type->cap->edit_posts ) )
                                return new IXR_Error( 401, __( 'Sorry, you are not allowed to post on this site.' ) );
                }
 
@@ -976,7 +1037,8 @@ class wp_xmlrpc_server extends IXR_Server {
                                        return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish posts in this post type' ) );
                                break;
                        default:
-                               $post_data['post_status'] = 'draft';
+                               if ( ! get_post_status_object( $post_data['post_status'] ) )
+                                       $post_data['post_status'] = 'draft';
                        break;
                }
 
@@ -1041,8 +1103,9 @@ class wp_xmlrpc_server extends IXR_Server {
                        // empty value deletes, non-empty value adds/updates
                        if ( ! $post_data['post_thumbnail'] )
                                delete_post_thumbnail( $post_ID );
-                       elseif ( ! set_post_thumbnail( $post_ID, $post_data['post_thumbnail'] ) )
-                                       return new IXR_Error( 404, __( 'Invalid attachment ID.' ) );
+                       elseif ( ! get_post( absint( $post_data['post_thumbnail'] ) ) )
+                               return new IXR_Error( 404, __( 'Invalid attachment ID.' ) );
+                       set_post_thumbnail( $post_ID, $post_data['post_thumbnail'] );
                        unset( $content_struct['post_thumbnail'] );
                }
 
@@ -1153,7 +1216,7 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $post_data = apply_filters( 'xmlrpc_wp_insert_post_data', $post_data, $content_struct );
 
-               $post_ID = wp_insert_post( $post_data, true );
+               $post_ID = $update ? wp_update_post( $post_data, true ) : wp_insert_post( $post_data, true );
                if ( is_wp_error( $post_ID ) )
                        return new IXR_Error( 500, $post_ID->get_error_message() );
 
@@ -1201,6 +1264,13 @@ class wp_xmlrpc_server extends IXR_Server {
                if ( empty( $post['ID'] ) )
                        return new IXR_Error( 404, __( 'Invalid post ID.' ) );
 
+               if ( isset( $content_struct['if_not_modified_since'] ) ) {
+                       // If the post has been modified since the date provided, return an error.
+                       if ( mysql2date( 'U', $post['post_modified_gmt'] ) > $content_struct['if_not_modified_since']->getTimestamp() ) {
+                               return new IXR_Error( 409, __( 'There is a revision of this post that is more recent.' ) );
+                       }
+               }
+
                // convert the date field back to IXR form
                $post['post_date'] = $this->_convert_date( $post['post_date'] );
 
@@ -1250,12 +1320,11 @@ class wp_xmlrpc_server extends IXR_Server {
 
                do_action( 'xmlrpc_call', 'wp.deletePost' );
 
-               $post = wp_get_single_post( $post_id, ARRAY_A );
+               $post = get_post( $post_id, ARRAY_A );
                if ( empty( $post['ID'] ) )
                        return new IXR_Error( 404, __( 'Invalid post ID.' ) );
 
-               $post_type = get_post_type_object( $post['post_type'] );
-               if ( ! current_user_can( $post_type->cap->delete_post, $post_id ) )
+               if ( ! current_user_can( 'delete_post', $post_id ) )
                        return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this post.' ) );
 
                $result = wp_delete_post( $post_id );
@@ -1280,7 +1349,7 @@ class wp_xmlrpc_server extends IXR_Server {
         * groups are 'post' (all basic fields), 'taxonomies', 'custom_fields',
         * and 'enclosure'.
         *
-        * @uses wp_get_single_post()
+        * @uses get_post()
         * @param array $args Method parameters. Contains:
         *  - int     $post_id
         *  - string  $username
@@ -1331,13 +1400,12 @@ class wp_xmlrpc_server extends IXR_Server {
 
                do_action( 'xmlrpc_call', 'wp.getPost' );
 
-               $post = wp_get_single_post( $post_id, ARRAY_A );
+               $post = get_post( $post_id, ARRAY_A );
 
                if ( empty( $post['ID'] ) )
                        return new IXR_Error( 404, __( 'Invalid post ID.' ) );
 
-               $post_type = get_post_type_object( $post['post_type'] );
-               if ( ! current_user_can( $post_type->cap->edit_post, $post_id ) )
+               if ( ! current_user_can( 'edit_post', $post_id ) )
                        return new IXR_Error( 401, __( 'Sorry, you cannot edit this post.' ) );
 
                return $this->_prepare_post( $post, $fields );
@@ -1419,6 +1487,10 @@ class wp_xmlrpc_server extends IXR_Server {
                                $query['order'] = $filter['order'];
                }
 
+               if ( isset( $filter['s'] ) ) {
+                       $query['s'] = $filter['s'];
+               }
+
                $posts_list = wp_get_recent_posts( $query );
 
                if ( ! $posts_list )
@@ -1428,8 +1500,7 @@ class wp_xmlrpc_server extends IXR_Server {
                $struct = array();
 
                foreach ( $posts_list as $post ) {
-                       $post_type = get_post_type_object( $post['post_type'] );
-                       if ( ! current_user_can( $post_type->cap->edit_post, $post['ID'] ) )
+                       if ( ! current_user_can( 'edit_post', $post['ID'] ) )
                                continue;
 
                        $struct[] = $this->_prepare_post( $post, $fields );
@@ -1913,6 +1984,262 @@ class wp_xmlrpc_server extends IXR_Server {
                return $struct;
        }
 
+       /**
+        * Retrieve a user.
+        *
+        * The optional $fields parameter specifies what fields will be included
+        * in the response array. This should be a list of field names. 'user_id' will
+        * always be included in the response regardless of the value of $fields.
+        *
+        * Instead of, or in addition to, individual field names, conceptual group
+        * names can be used to specify multiple fields. The available conceptual
+        * groups are 'basic' and 'all'.
+        *
+        * @uses get_userdata()
+        * @param array $args Method parameters. Contains:
+        *  - int     $blog_id
+        *  - string  $username
+        *  - string  $password
+        *  - int     $user_id
+        *  - array   $fields optional
+        * @return array contains (based on $fields parameter):
+        *  - 'user_id'
+        *  - 'username'
+        *  - 'first_name'
+        *  - 'last_name'
+        *  - 'registered'
+        *  - 'bio'
+        *  - 'email'
+        *  - 'nickname'
+        *  - 'nicename'
+        *  - 'url'
+        *  - 'display_name'
+        *  - 'roles'
+        */
+       function wp_getUser( $args ) {
+               if ( ! $this->minimum_args( $args, 4 ) )
+                       return $this->error;
+
+               $this->escape( $args );
+
+               $blog_id    = (int) $args[0];
+               $username   = $args[1];
+               $password   = $args[2];
+               $user_id    = (int) $args[3];
+
+               if ( isset( $args[4] ) )
+                       $fields = $args[4];
+               else
+                       $fields = apply_filters( 'xmlrpc_default_user_fields', array( 'all' ), 'wp.getUser' );
+
+               if ( ! $user = $this->login( $username, $password ) )
+                       return $this->error;
+
+               do_action( 'xmlrpc_call', 'wp.getUser' );
+
+               if ( ! current_user_can( 'edit_user', $user_id ) )
+                       return new IXR_Error( 401, __( 'Sorry, you cannot edit users.' ) );
+
+               $user_data = get_userdata( $user_id );
+
+               if ( ! $user_data )
+                       return new IXR_Error( 404, __( 'Invalid user ID' ) );
+
+               return $this->_prepare_user( $user_data, $fields );
+       }
+
+       /**
+        * Retrieve users.
+        *
+        * The optional $filter parameter modifies the query used to retrieve users.
+        * Accepted keys are 'number' (default: 50), 'offset' (default: 0), 'role',
+        * 'who', 'orderby', and 'order'.
+        *
+        * The optional $fields parameter specifies what fields will be included
+        * in the response array.
+        *
+        * @uses get_users()
+        * @see wp_getUser() for more on $fields and return values
+        *
+        * @param array $args Method parameters. Contains:
+        *  - int     $blog_id
+        *  - string  $username
+        *  - string  $password
+        *  - array   $filter optional
+        *  - array   $fields optional
+        * @return array users data
+        */
+       function wp_getUsers( $args ) {
+               if ( ! $this->minimum_args( $args, 3 ) )
+                       return $this->error;
+
+               $this->escape( $args );
+
+               $blog_id    = (int) $args[0];
+               $username   = $args[1];
+               $password   = $args[2];
+               $filter     = isset( $args[3] ) ? $args[3] : array();
+
+               if ( isset( $args[4] ) )
+                       $fields = $args[4];
+               else
+                       $fields = apply_filters( 'xmlrpc_default_user_fields', array( 'all' ), 'wp.getUsers' );
+
+               if ( ! $user = $this->login( $username, $password ) )
+                       return $this->error;
+
+               do_action( 'xmlrpc_call', 'wp.getUsers' );
+
+               if ( ! current_user_can( 'list_users' ) )
+                       return new IXR_Error( 401, __( 'Sorry, you cannot list users.' ) );
+
+               $query = array( 'fields' => 'all_with_meta' );
+
+               $query['number'] = ( isset( $filter['number'] ) ) ? absint( $filter['number'] ) : 50;
+               $query['offset'] = ( isset( $filter['offset'] ) ) ? absint( $filter['offset'] ) : 0;
+
+               if ( isset( $filter['orderby'] ) ) {
+                       $query['orderby'] = $filter['orderby'];
+
+                       if ( isset( $filter['order'] ) )
+                               $query['order'] = $filter['order'];
+               }
+
+               if ( isset( $filter['role'] ) ) {
+                       if ( get_role( $filter['role'] ) === null )
+                               return new IXR_Error( 403, __( 'The role specified is not valid' ) );
+
+                       $query['role'] = $filter['role'];
+               }
+
+               if ( isset( $filter['who'] ) ) {
+                       $query['who'] = $filter['who'];
+               }
+
+               $users = get_users( $query );
+
+               $_users = array();
+               foreach ( $users as $user_data ) {
+                       if ( current_user_can( 'edit_user', $user_data->ID ) )
+                               $_users[] = $this->_prepare_user( $user_data, $fields );
+               }
+               return $_users;
+       }
+
+       /**
+        * Retrieve information about the requesting user.
+        *
+        * @uses get_userdata()
+        * @param array $args Method parameters. Contains:
+        *  - int     $blog_id
+        *  - string  $username
+        *  - string  $password
+        *  - array   $fields optional
+        * @return array (@see wp_getUser)
+        */
+       function wp_getProfile( $args ) {
+               if ( ! $this->minimum_args( $args, 3 ) )
+                       return $this->error;
+
+               $this->escape( $args );
+
+               $blog_id    = (int) $args[0];
+               $username   = $args[1];
+               $password   = $args[2];
+
+               if ( isset( $args[3] ) )
+                       $fields = $args[3];
+               else
+                       $fields = apply_filters( 'xmlrpc_default_user_fields', array( 'all' ), 'wp.getProfile' );
+
+               if ( ! $user = $this->login( $username, $password ) )
+                       return $this->error;
+
+               do_action( 'xmlrpc_call', 'wp.getProfile' );
+
+               if ( ! current_user_can( 'edit_user', $user->ID ) )
+                       return new IXR_Error( 401, __( 'Sorry, you cannot edit your profile.' ) );
+
+               $user_data = get_userdata( $user->ID );
+
+               return $this->_prepare_user( $user_data, $fields );
+       }
+
+       /**
+        * Edit user's profile.
+        *
+        * @uses wp_update_user()
+        * @param array $args Method parameters. Contains:
+        *  - int     $blog_id
+        *  - string  $username
+        *  - string  $password
+        *  - array   $content_struct
+        *      It can optionally contain:
+        *      - 'first_name'
+        *      - 'last_name'
+        *      - 'website'
+        *      - 'display_name'
+        *      - 'nickname'
+        *      - 'nicename'
+        *      - 'bio'
+        * @return bool True, on success.
+        */
+       function wp_editProfile( $args ) {
+               if ( ! $this->minimum_args( $args, 4 ) )
+                       return $this->error;
+
+               $this->escape( $args );
+
+               $blog_id        = (int) $args[0];
+               $username       = $args[1];
+               $password       = $args[2];
+               $content_struct = $args[3];
+
+               if ( ! $user = $this->login( $username, $password ) )
+                       return $this->error;
+
+               do_action( 'xmlrpc_call', 'wp.editProfile' );
+
+               if ( ! current_user_can( 'edit_user', $user->ID ) )
+                       return new IXR_Error( 401, __( 'Sorry, you cannot edit your profile.' ) );
+
+               // holds data of the user
+               $user_data = array();
+               $user_data['ID'] = $user->ID;
+
+               // only set the user details if it was given
+               if ( isset( $content_struct['first_name'] ) )
+                       $user_data['first_name'] = $content_struct['first_name'];
+
+               if ( isset( $content_struct['last_name'] ) )
+                       $user_data['last_name'] = $content_struct['last_name'];
+
+               if ( isset( $content_struct['url'] ) )
+                       $user_data['user_url'] = $content_struct['url'];
+
+               if ( isset( $content_struct['display_name'] ) )
+                       $user_data['display_name'] = $content_struct['display_name'];
+
+               if ( isset( $content_struct['nickname'] ) )
+                       $user_data['nickname'] = $content_struct['nickname'];
+
+               if ( isset( $content_struct['nicename'] ) )
+                       $user_data['user_nicename'] = $content_struct['nicename'];
+
+               if ( isset( $content_struct['bio'] ) )
+                       $user_data['description'] = $content_struct['bio'];
+
+               $result = wp_update_user( $user_data );
+
+               if ( is_wp_error( $result ) )
+                       return new IXR_Error( 500, $result->get_error_message() );
+
+               if ( ! $result )
+                       return new IXR_Error( 500, __( 'Sorry, the user cannot be updated.' ) );
+
+               return true;
+       }
+
        /**
         * Retrieve page.
         *
@@ -1937,7 +2264,7 @@ class wp_xmlrpc_server extends IXR_Server {
                        return $this->error;
                }
 
-               $page = get_page($page_id);
+               $page = get_post($page_id);
                if ( ! $page )
                        return new IXR_Error( 404, __( 'Invalid post ID.' ) );
 
@@ -2054,7 +2381,7 @@ class wp_xmlrpc_server extends IXR_Server {
 
                // Get the current page based on the page_id and
                // make sure it is a page and not a post.
-               $actual_page = wp_get_single_post($page_id, ARRAY_A);
+               $actual_page = get_post($page_id, ARRAY_A);
                if ( !$actual_page || ($actual_page['post_type'] != 'page') )
                        return(new IXR_Error(404, __('Sorry, no such page.')));
 
@@ -2095,7 +2422,7 @@ class wp_xmlrpc_server extends IXR_Server {
                do_action('xmlrpc_call', 'wp.editPage');
 
                // Get the page data and make sure it is a page.
-               $actual_page = wp_get_single_post($page_id, ARRAY_A);
+               $actual_page = get_post($page_id, ARRAY_A);
                if ( !$actual_page || ($actual_page['post_type'] != 'page') )
                        return(new IXR_Error(404, __('Sorry, no such page.')));
 
@@ -2655,9 +2982,9 @@ class wp_xmlrpc_server extends IXR_Server {
                $comment['comment_post_ID'] = $post_id;
 
                if ( $logged_in ) {
-                       $comment['comment_author'] = $wpdb->escape( $user->display_name );
-                       $comment['comment_author_email'] = $wpdb->escape( $user->user_email );
-                       $comment['comment_author_url'] = $wpdb->escape( $user->user_url );
+                       $comment['comment_author'] = $this->escape( $user->display_name );
+                       $comment['comment_author_email'] = $this->escape( $user->user_email );
+                       $comment['comment_author_url'] = $this->escape( $user->user_url );
                        $comment['user_ID'] = $user->ID;
                } else {
                        $comment['comment_author'] = '';
@@ -2869,6 +3196,7 @@ class wp_xmlrpc_server extends IXR_Server {
         */
        function _getOptions($options) {
                $data = array();
+               $can_manage = current_user_can( 'manage_options' );
                foreach ( $options as $option ) {
                        if ( array_key_exists( $option, $this->blog_options ) ) {
                                $data[$option] = $this->blog_options[$option];
@@ -2877,6 +3205,9 @@ class wp_xmlrpc_server extends IXR_Server {
                                        $data[$option]['value'] = get_option( $data[$option]['option'] );
                                        unset($data[$option]['option']);
                                }
+
+                               if ( ! $can_manage )
+                                       $data[$option]['readonly'] = true;
                        }
                }
 
@@ -3165,6 +3496,128 @@ class wp_xmlrpc_server extends IXR_Server {
                return $struct;
        }
 
+       /**
+        * Retrieve revisions for a specific post.
+        *
+        * @since 3.5.0
+        *
+        * The optional $fields parameter specifies what fields will be included
+        * in the response array.
+        *
+        * @uses wp_get_post_revisions()
+        * @see wp_getPost() for more on $fields
+        *
+        * @param array $args Method parameters. Contains:
+        *  - int     $blog_id
+        *  - string  $username
+        *  - string  $password
+        *  - int     $post_id
+        *  - array   $fields
+        * @return array contains a collection of posts.
+        */
+       function wp_getRevisions( $args ) {
+               if ( ! $this->minimum_args( $args, 4 ) )
+                       return $this->error;
+
+               $this->escape( $args );
+
+               $blog_id    = (int) $args[0];
+               $username   = $args[1];
+               $password   = $args[2];
+               $post_id    = (int) $args[3];
+
+               if ( isset( $args[4] ) )
+                       $fields = $args[4];
+               else
+                       $fields = apply_filters( 'xmlrpc_default_revision_fields', array( 'post_date', 'post_date_gmt' ), 'wp.getRevisions' );
+
+               if ( ! $user = $this->login( $username, $password ) )
+                       return $this->error;
+
+               do_action( 'xmlrpc_call', 'wp.getRevisions' );
+
+               if ( ! $post = get_post( $post_id ) )
+                       return new IXR_Error( 404, __( 'Invalid post ID' ) );
+
+               if ( ! current_user_can( 'edit_post', $post_id ) )
+                       return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts.' ) );
+
+               // Check if revisions are enabled.
+               if ( ! wp_revisions_enabled( $post ) )
+                       return new IXR_Error( 401, __( 'Sorry, revisions are disabled.' ) );
+
+               $revisions = wp_get_post_revisions( $post_id );
+
+               if ( ! $revisions )
+                       return array();
+
+               $struct = array();
+
+               foreach ( $revisions as $revision ) {
+                       if ( ! current_user_can( 'read_post', $revision->ID ) )
+                               continue;
+
+                       // Skip autosaves
+                       if ( wp_is_post_autosave( $revision ) )
+                               continue;
+
+                       $struct[] = $this->_prepare_post( get_object_vars( $revision ), $fields );
+               }
+
+               return $struct;
+       }
+
+       /**
+        * Restore a post revision
+        *
+        * @since 3.5.0
+        *
+        * @uses wp_restore_post_revision()
+        *
+        * @param array $args Method parameters. Contains:
+        *  - int     $blog_id
+        *  - string  $username
+        *  - string  $password
+        *  - int     $post_id
+        * @return bool false if there was an error restoring, true if success.
+        */
+       function wp_restoreRevision( $args ) {
+               if ( ! $this->minimum_args( $args, 3 ) )
+                       return $this->error;
+
+               $this->escape( $args );
+
+               $blog_id     = (int) $args[0];
+               $username    = $args[1];
+               $password    = $args[2];
+               $revision_id = (int) $args[3];
+
+               if ( ! $user = $this->login( $username, $password ) )
+                       return $this->error;
+
+               do_action( 'xmlrpc_call', 'wp.restoreRevision' );
+
+               if ( ! $revision = wp_get_post_revision( $revision_id ) )
+                       return new IXR_Error( 404, __( 'Invalid post ID' ) );
+
+               if ( wp_is_post_autosave( $revision ) )
+                       return new IXR_Error( 404, __( 'Invalid post ID' ) );
+
+               if ( ! $post = get_post( $revision->post_parent ) )
+                       return new IXR_Error( 404, __( 'Invalid post ID' ) );
+
+               if ( ! current_user_can( 'edit_post', $revision->post_parent ) )
+                       return new IXR_Error( 401, __( 'Sorry, you cannot edit this post.' ) );
+
+               // Check if revisions are disabled.
+               if ( ! wp_revisions_enabled( $post ) )
+                       return new IXR_Error( 401, __( 'Sorry, revisions are disabled.' ) );
+
+               $post = wp_restore_post_revision( $revision_id );
+
+               return (bool) $post;
+       }
+
        /* Blogger API functions.
         * specs on http://plant.blogger.com/api and http://groups.yahoo.com/group/bloggerDev/
         */
@@ -3200,7 +3653,7 @@ class wp_xmlrpc_server extends IXR_Server {
                        'url'      => get_option('home') . '/',
                        'blogid'   => '1',
                        'blogName' => get_option('blogname'),
-                       'xmlrpc'   => site_url( 'xmlrpc.php' )
+                       'xmlrpc'   => site_url( 'xmlrpc.php', 'rpc' ),
                );
 
                return array($struct);
@@ -3212,12 +3665,12 @@ class wp_xmlrpc_server extends IXR_Server {
         * @access protected
         */
        function _multisite_getUsersBlogs($args) {
-               global $current_blog;
+               $current_blog = get_blog_details();
+
                $domain = $current_blog->domain;
                $path = $current_blog->path . 'xmlrpc.php';
-               $protocol = is_ssl() ? 'https' : 'http';
 
-               $rpc = new IXR_Client("$protocol://{$domain}{$path}");
+               $rpc = new IXR_Client( set_url_scheme( "http://{$domain}{$path}" ) );
                $rpc->query('wp.getUsersBlogs', $args[1], $args[2]);
                $blogs = $rpc->getResponse();
 
@@ -3290,7 +3743,7 @@ class wp_xmlrpc_server extends IXR_Server {
                if ( !$user = $this->login($username, $password) )
                        return $this->error;
 
-               $post_data = wp_get_single_post($post_ID, ARRAY_A);
+               $post_data = get_post($post_ID, ARRAY_A);
                if ( ! $post_data )
                        return new IXR_Error( 404, __( 'Invalid post ID.' ) );
 
@@ -3301,9 +3754,9 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $categories = implode(',', wp_get_post_categories($post_ID));
 
-               $content  = '<title>'.stripslashes($post_data['post_title']).'</title>';
+               $content  = '<title>'.wp_unslash($post_data['post_title']).'</title>';
                $content .= '<category>'.$categories.'</category>';
-               $content .= stripslashes($post_data['post_content']);
+               $content .= wp_unslash($post_data['post_content']);
 
                $struct = array(
                        'userid'    => $post_data['post_author'],
@@ -3339,6 +3792,9 @@ class wp_xmlrpc_server extends IXR_Server {
                if ( !$user = $this->login($username, $password) )
                        return $this->error;
 
+               if ( ! current_user_can( 'edit_posts' ) )
+                       return new IXR_Error( 401, __( 'Sorry, you cannot edit posts on this site.' ) );
+
                do_action('xmlrpc_call', 'blogger.getRecentPosts');
 
                $posts_list = wp_get_recent_posts( $query );
@@ -3355,9 +3811,9 @@ class wp_xmlrpc_server extends IXR_Server {
                        $post_date  = $this->_convert_date( $entry['post_date'] );
                        $categories = implode(',', wp_get_post_categories($entry['ID']));
 
-                       $content  = '<title>'.stripslashes($entry['post_title']).'</title>';
+                       $content  = '<title>'.wp_unslash($entry['post_title']).'</title>';
                        $content .= '<category>'.$categories.'</category>';
-                       $content .= stripslashes($entry['post_content']);
+                       $content .= wp_unslash($entry['post_content']);
 
                        $struct[] = array(
                                'userid' => $entry['post_author'],
@@ -3377,82 +3833,23 @@ class wp_xmlrpc_server extends IXR_Server {
        }
 
        /**
-        * Retrieve blog_filename content.
+        * Deprecated.
         *
         * @since 1.5.0
-        *
-        * @param array $args Method parameters.
-        * @return string
+        * @deprecated 3.5.0
         */
        function blogger_getTemplate($args) {
-
-               $this->escape($args);
-
-               $blog_ID    = (int) $args[1];
-               $username = $args[2];
-               $password  = $args[3];
-               $template   = $args[4]; /* could be 'main' or 'archiveIndex', but we don't use it */
-
-               if ( !$user = $this->login($username, $password) )
-                       return $this->error;
-
-               do_action('xmlrpc_call', 'blogger.getTemplate');
-
-               if ( !current_user_can('edit_themes') )
-                       return new IXR_Error(401, __('Sorry, this user cannot edit the template.'));
-
-               /* warning: here we make the assumption that the blog's URL is on the same server */
-               $filename = get_option('home') . '/';
-               $filename = preg_replace('#https?://.+?/#', $_SERVER['DOCUMENT_ROOT'].'/', $filename);
-
-               $f = fopen($filename, 'r');
-               $content = fread($f, filesize($filename));
-               fclose($f);
-
-               /* so it is actually editable with a windows/mac client */
-               // FIXME: (or delete me) do we really want to cater to bad clients at the expense of good ones by BEEPing up their line breaks? commented. $content = str_replace("\n", "\r\n", $content);
-
-               return $content;
+               return new IXR_Error( 403, __('Sorry, that file cannot be edited.' ) );
        }
 
        /**
-        * Updates the content of blog_filename.
+        * Deprecated.
         *
         * @since 1.5.0
-        *
-        * @param array $args Method parameters.
-        * @return bool True when done.
+        * @deprecated 3.5.0
         */
        function blogger_setTemplate($args) {
-
-               $this->escape($args);
-
-               $blog_ID    = (int) $args[1];
-               $username = $args[2];
-               $password  = $args[3];
-               $content    = $args[4];
-               $template   = $args[5]; /* could be 'main' or 'archiveIndex', but we don't use it */
-
-               if ( !$user = $this->login($username, $password) )
-                       return $this->error;
-
-               do_action('xmlrpc_call', 'blogger.setTemplate');
-
-               if ( !current_user_can('edit_themes') )
-                       return new IXR_Error(401, __('Sorry, this user cannot edit the template.'));
-
-               /* warning: here we make the assumption that the blog's URL is on the same server */
-               $filename = get_option('home') . '/';
-               $filename = preg_replace('#https?://.+?/#', $_SERVER['DOCUMENT_ROOT'].'/', $filename);
-
-               if ($f = fopen($filename, 'w+')) {
-                       fwrite($f, $content);
-                       fclose($f);
-               } else {
-                       return new IXR_Error(500, __('Either the file is not writable, or something wrong happened. The file has not been updated.'));
-               }
-
-               return true;
+               return new IXR_Error( 403, __('Sorry, that file cannot be edited.' ) );
        }
 
        /**
@@ -3479,7 +3876,7 @@ class wp_xmlrpc_server extends IXR_Server {
                do_action('xmlrpc_call', 'blogger.newPost');
 
                $cap = ($publish) ? 'publish_posts' : 'edit_posts';
-               if ( !current_user_can($cap) )
+               if ( ! current_user_can( get_post_type_object( 'post' )->cap->create_posts ) || !current_user_can($cap) )
                        return new IXR_Error(401, __('Sorry, you are not allowed to post on this site.'));
 
                $post_status = ($publish) ? 'publish' : 'draft';
@@ -3532,7 +3929,7 @@ class wp_xmlrpc_server extends IXR_Server {
 
                do_action('xmlrpc_call', 'blogger.editPost');
 
-               $actual_post = wp_get_single_post($post_ID,ARRAY_A);
+               $actual_post = get_post($post_ID,ARRAY_A);
 
                if ( !$actual_post || $actual_post['post_type'] != 'post' )
                        return new IXR_Error(404, __('Sorry, no such post.'));
@@ -3586,7 +3983,7 @@ class wp_xmlrpc_server extends IXR_Server {
 
                do_action('xmlrpc_call', 'blogger.deletePost');
 
-               $actual_post = wp_get_single_post($post_ID,ARRAY_A);
+               $actual_post = get_post($post_ID,ARRAY_A);
 
                if ( !$actual_post || $actual_post['post_type'] != 'post' )
                        return new IXR_Error(404, __('Sorry, no such post.'));
@@ -3694,6 +4091,8 @@ class wp_xmlrpc_server extends IXR_Server {
                        $post_type = 'post';
                }
 
+               if ( ! current_user_can( get_post_type_object( $post_type )->cap->create_posts ) )
+                       return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish posts on this site.' ) );
                if ( !current_user_can( $cap ) )
                        return new IXR_Error( 401, $error_message );
 
@@ -3726,18 +4125,18 @@ class wp_xmlrpc_server extends IXR_Server {
                $post_author = $user->ID;
 
                // If an author id was provided then use it instead.
-               if ( isset($content_struct['wp_author_id']) && ($user->ID != $content_struct['wp_author_id']) ) {
+               if ( isset( $content_struct['wp_author_id'] ) && ( $user->ID != $content_struct['wp_author_id'] ) ) {
                        switch ( $post_type ) {
                                case "post":
-                                       if ( !current_user_can('edit_others_posts') )
-                                               return(new IXR_Error(401, __('You are not allowed to post as this user')));
+                                       if ( !current_user_can( 'edit_others_posts' ) )
+                                               return( new IXR_Error( 401, __( 'You are not allowed to create posts as this user.' ) ) );
                                        break;
                                case "page":
-                                       if ( !current_user_can('edit_others_pages') )
-                                               return(new IXR_Error(401, __('You are not allowed to create pages as this user')));
+                                       if ( !current_user_can( 'edit_others_pages' ) )
+                                               return( new IXR_Error( 401, __( 'You are not allowed to create pages as this user.' ) ) );
                                        break;
                                default:
-                                       return(new IXR_Error(401, __('Invalid post type')));
+                                       return( new IXR_Error( 401, __( 'Invalid post type' ) ) );
                                        break;
                        }
                        $author = get_userdata( $content_struct['wp_author_id'] );
@@ -3898,7 +4297,7 @@ class wp_xmlrpc_server extends IXR_Server {
                // Handle post formats if assigned, value is validated earlier
                // in this function
                if ( isset( $content_struct['wp_post_format'] ) )
-                       wp_set_post_terms( $post_ID, array( 'post-format-' . $content_struct['wp_post_format'] ), 'post_format' );
+                       set_post_format( $post_ID, $content_struct['wp_post_format'] );
 
                $post_ID = wp_insert_post( $postdata, true );
                if ( is_wp_error( $post_ID ) )
@@ -3912,22 +4311,20 @@ class wp_xmlrpc_server extends IXR_Server {
                return strval($post_ID);
        }
 
-       function add_enclosure_if_new($post_ID, $enclosure) {
+       function add_enclosure_if_new( $post_ID, $enclosure ) {
                if ( is_array( $enclosure ) && isset( $enclosure['url'] ) && isset( $enclosure['length'] ) && isset( $enclosure['type'] ) ) {
-
-                       $encstring = $enclosure['url'] . "\n" . $enclosure['length'] . "\n" . $enclosure['type'];
+                       $encstring = $enclosure['url'] . "\n" . $enclosure['length'] . "\n" . $enclosure['type'] . "\n";
                        $found = false;
-                       foreach ( (array) get_post_custom($post_ID) as $key => $val) {
-                               if ($key == 'enclosure') {
-                                       foreach ( (array) $val as $enc ) {
-                                               if ($enc == $encstring) {
-                                                       $found = true;
-                                                       break 2;
-                                               }
+                       if ( $enclosures = get_post_meta( $post_ID, 'enclosure' ) ) {
+                               foreach ( $enclosures as $enc ) {
+                                       // This method used to omit the trailing new line. #23219
+                                       if ( rtrim( $enc, "\n" ) == rtrim( $encstring, "\n" ) ) {
+                                               $found = true;
+                                               break;
                                        }
                                }
                        }
-                       if (!$found)
+                       if ( ! $found )
                                add_post_meta( $post_ID, 'enclosure', $encstring );
                }
        }
@@ -3947,7 +4344,7 @@ class wp_xmlrpc_server extends IXR_Server {
                $attachments = $wpdb->get_results( "SELECT ID, guid FROM {$wpdb->posts} WHERE post_parent = '0' AND post_type = 'attachment'" );
                if ( is_array( $attachments ) ) {
                        foreach ( $attachments as $file ) {
-                               if ( strpos( $post_content, $file->guid ) !== false )
+                               if ( ! empty( $file->guid ) && strpos( $post_content, $file->guid ) !== false )
                                        $wpdb->update($wpdb->posts, array('post_parent' => $post_ID), array('ID' => $file->ID) );
                        }
                }
@@ -3976,7 +4373,7 @@ class wp_xmlrpc_server extends IXR_Server {
 
                do_action('xmlrpc_call', 'metaWeblog.editPost');
 
-               $postdata = wp_get_single_post( $post_ID, ARRAY_A );
+               $postdata = get_post( $post_ID, ARRAY_A );
 
                // If there is no post data for the give post id, stop
                // now and return an error. Other wise a new post will be
@@ -4215,7 +4612,7 @@ class wp_xmlrpc_server extends IXR_Server {
                // Handle post formats if assigned, validation is handled
                // earlier in this function
                if ( isset( $content_struct['wp_post_format'] ) )
-                       wp_set_post_terms( $post_ID, array( 'post-format-' . $content_struct['wp_post_format'] ), 'post_format' );
+                       set_post_format( $post_ID, $content_struct['wp_post_format'] );
 
                do_action( 'xmlrpc_call_success_mw_editPost', $post_ID, $args );
 
@@ -4241,7 +4638,7 @@ class wp_xmlrpc_server extends IXR_Server {
                if ( !$user = $this->login($username, $password) )
                        return $this->error;
 
-               $postdata = wp_get_single_post($post_ID, ARRAY_A);
+               $postdata = get_post($post_ID, ARRAY_A);
                if ( ! $postdata )
                        return new IXR_Error( 404, __( 'Invalid post ID.' ) );
 
@@ -4369,6 +4766,9 @@ class wp_xmlrpc_server extends IXR_Server {
                if ( !$user = $this->login($username, $password) )
                        return $this->error;
 
+               if ( ! current_user_can( 'edit_posts' ) )
+                       return new IXR_Error( 401, __( 'Sorry, you cannot edit posts on this site.' ) );
+
                do_action('xmlrpc_call', 'metaWeblog.getRecentPosts');
 
                $posts_list = wp_get_recent_posts( $query );
@@ -4376,6 +4776,7 @@ class wp_xmlrpc_server extends IXR_Server {
                if ( !$posts_list )
                        return array();
 
+               $struct = array();
                foreach ($posts_list as $entry) {
                        if ( !current_user_can( 'edit_post', $entry['ID'] ) )
                                continue;
@@ -4519,8 +4920,8 @@ class wp_xmlrpc_server extends IXR_Server {
                global $wpdb;
 
                $blog_ID     = (int) $args[0];
-               $username  = $wpdb->escape($args[1]);
-               $password   = $wpdb->escape($args[2]);
+               $username  = $this->escape($args[1]);
+               $password   = $this->escape($args[2]);
                $data        = $args[3];
 
                $name = sanitize_file_name( $data['name'] );
@@ -4564,8 +4965,13 @@ class wp_xmlrpc_server extends IXR_Server {
                        return new IXR_Error(500, $errorString);
                }
                // Construct the attachment array
-               // attach to post_id 0
                $post_id = 0;
+               if ( ! empty( $data['post_id'] ) ) {
+                       $post_id = (int) $data['post_id'];
+
+                       if ( ! current_user_can( 'edit_post', $post_id ) )
+                               return new IXR_Error( 401, __( 'Sorry, you cannot edit this post.' ) );
+               }
                $attachment = array(
                        'post_title' => $name,
                        'post_content' => '',
@@ -4763,6 +5169,7 @@ class wp_xmlrpc_server extends IXR_Server {
                if ( !current_user_can('edit_post', $post_ID) )
                        return new IXR_Error(401, __('Sorry, you cannot edit this post.'));
 
+               $catids = array();
                foreach ( $categories as $cat ) {
                        $catids[] = $cat['categoryId'];
                }
@@ -4820,7 +5227,7 @@ class wp_xmlrpc_server extends IXR_Server {
 
                do_action('xmlrpc_call', 'mt.getTrackbackPings');
 
-               $actual_post = wp_get_single_post($post_ID, ARRAY_A);
+               $actual_post = get_post($post_ID, ARRAY_A);
 
                if ( !$actual_post )
                        return new IXR_Error(404, __('Sorry, no such post.'));
@@ -4867,7 +5274,7 @@ class wp_xmlrpc_server extends IXR_Server {
 
                do_action('xmlrpc_call', 'mt.publishPost');
 
-               $postdata = wp_get_single_post($post_ID, ARRAY_A);
+               $postdata = get_post($post_ID, ARRAY_A);
                if ( ! $postdata )
                        return new IXR_Error( 404, __( 'Invalid post ID.' ) );
 
@@ -4914,10 +5321,14 @@ class wp_xmlrpc_server extends IXR_Server {
                $pagelinkedto = str_replace('&amp;', '&', $pagelinkedto);
                $pagelinkedto = str_replace('&', '&amp;', $pagelinkedto);
 
+               $pagelinkedfrom = apply_filters( 'pingback_ping_source_uri', $pagelinkedfrom, $pagelinkedto );
+               if ( ! $pagelinkedfrom )
+                       return $this->pingback_error( 0, __( 'A valid URL was not provided.' ) );
+
                // Check if the page linked to is in our site
                $pos1 = strpos($pagelinkedto, str_replace(array('http://www.','http://','https://www.','https://'), '', get_option('home')));
                if ( !$pos1 )
-                       return new IXR_Error(0, __('Is there no link to us?'));
+                       return $this->pingback_error( 0, __( 'Is there no link to us?' ) );
 
                // let's find which post is linked to
                // FIXME: does url_to_postid() cover all these cases already?
@@ -4930,7 +5341,7 @@ class wp_xmlrpc_server extends IXR_Server {
                        $blah = explode('/', $match[0]);
                        $post_ID = (int) $blah[1];
                        $way = 'from the path';
-               } elseif ( preg_match('#p=[0-9]{1,}#', $urltest['query'], $match) ) {
+               } elseif ( isset( $urltest['query'] ) && preg_match('#p=[0-9]{1,}#', $urltest['query'], $match) ) {
                        // the querystring defines the post_ID (?p=XXXX)
                        $blah = explode('=', $match[0]);
                        $post_ID = (int) $blah[1];
@@ -4951,51 +5362,57 @@ class wp_xmlrpc_server extends IXR_Server {
                                $sql = $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_title RLIKE %s", like_escape( $title ) );
                                if (! ($post_ID = $wpdb->get_var($sql)) ) {
                                        // returning unknown error '0' is better than die()ing
-                                       return new IXR_Error(0, '');
+                                       return $this->pingback_error( 0, '' );
                                }
                                $way = 'from the fragment (title)';
                        }
                } else {
                        // TODO: Attempt to extract a post ID from the given URL
-                       return new IXR_Error(33, __('The specified target URL cannot be used as a target. It either doesn&#8217;t exist, or it is not a pingback-enabled resource.'));
+                       return $this->pingback_error( 33, __('The specified target URL cannot be used as a target. It either doesn&#8217;t exist, or it is not a pingback-enabled resource.' ) );
                }
                $post_ID = (int) $post_ID;
 
                $post = get_post($post_ID);
 
                if ( !$post ) // Post_ID not found
-                       return new IXR_Error(33, __('The specified target URL cannot be used as a target. It either doesn&#8217;t exist, or it is not a pingback-enabled resource.'));
+                       return $this->pingback_error( 33, __( 'The specified target URL cannot be used as a target. It either doesn&#8217;t exist, or it is not a pingback-enabled resource.' ) );
 
                if ( $post_ID == url_to_postid($pagelinkedfrom) )
-                       return new IXR_Error(0, __('The source URL and the target URL cannot both point to the same resource.'));
+                       return $this->pingback_error( 0, __( 'The source URL and the target URL cannot both point to the same resource.' ) );
 
                // Check if pings are on
                if ( !pings_open($post) )
-                       return new IXR_Error(33, __('The specified target URL cannot be used as a target. It either doesn&#8217;t exist, or it is not a pingback-enabled resource.'));
+                       return $this->pingback_error( 33, __( 'The specified target URL cannot be used as a target. It either doesn&#8217;t exist, or it is not a pingback-enabled resource.' ) );
 
                // Let's check that the remote site didn't already pingback this entry
                if ( $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_author_url = %s", $post_ID, $pagelinkedfrom) ) )
-                       return new IXR_Error( 48, __( 'The pingback has already been registered.' ) );
+                       return $this->pingback_error( 48, __( 'The pingback has already been registered.' ) );
 
                // very stupid, but gives time to the 'from' server to publish !
                sleep(1);
 
                // Let's check the remote site
-               $linea = wp_remote_fopen( $pagelinkedfrom );
+               $http_api_args = array(
+                       'timeout' => 10,
+                       'redirection' => 0,
+                       'limit_response_size' => 153600, // 150 KB
+               );
+               $linea = wp_remote_retrieve_body( wp_safe_remote_get( $pagelinkedfrom, $http_api_args ) );
+
                if ( !$linea )
-                       return new IXR_Error(16, __('The source URL does not exist.'));
+                       return $this->pingback_error( 16, __( 'The source URL does not exist.' ) );
 
                $linea = apply_filters('pre_remote_source', $linea, $pagelinkedto);
 
                // Work around bug in strip_tags():
                $linea = str_replace('<!DOC', '<DOC', $linea);
-               $linea = preg_replace( '/[\s\r\n\t]+/', ' ', $linea ); // normalize spaces
-               $linea = preg_replace( "/ <(h1|h2|h3|h4|h5|h6|p|th|td|li|dt|dd|pre|caption|input|textarea|button|body)[^>]*>/", "\n\n", $linea );
+               $linea = preg_replace( '/[\r\n\t ]+/', ' ', $linea ); // normalize spaces
+               $linea = preg_replace( "/<\/*(h1|h2|h3|h4|h5|h6|p|th|td|li|dt|dd|pre|caption|input|textarea|button|body)[^>]*>/", "\n\n", $linea );
 
                preg_match('|<title>([^<]*?)</title>|is', $linea, $matchtitle);
                $title = $matchtitle[1];
                if ( empty( $title ) )
-                       return new IXR_Error(32, __('We cannot find a title on that page.'));
+                       return $this->pingback_error( 32, __('We cannot find a title on that page.' ) );
 
                $linea = strip_tags( $linea, '<a>' ); // just keep the tag we need
 
@@ -5017,7 +5434,7 @@ class wp_xmlrpc_server extends IXR_Server {
 
                                // prevent really long link text
                                if ( strlen($context[1]) > 100 )
-                                       $context[1] = substr($context[1], 0, 100) . '...';
+                                       $context[1] = substr($context[1], 0, 100) . '&#8230;';
 
                                $marker = '<wpcontext>'.$context[1].'</wpcontext>';    // set up our marker
                                $excerpt= str_replace($context[0], $marker, $excerpt); // swap out the link for our marker
@@ -5031,12 +5448,12 @@ class wp_xmlrpc_server extends IXR_Server {
                }
 
                if ( empty($context) ) // Link to target not found
-                       return new IXR_Error(17, __('The source URL does not contain a link to the target URL, and so cannot be used as a source.'));
+                       return $this->pingback_error( 17, __( 'The source URL does not contain a link to the target URL, and so cannot be used as a source.' ) );
 
                $pagelinkedfrom = str_replace('&', '&amp;', $pagelinkedfrom);
 
-               $context = '[...] ' . esc_html( $excerpt ) . ' [...]';
-               $pagelinkedfrom = $wpdb->escape( $pagelinkedfrom );
+               $context = '[&#8230;] ' . esc_html( $excerpt ) . ' [&#8230;]';
+               $pagelinkedfrom = $this->escape( $pagelinkedfrom );
 
                $comment_post_ID = (int) $post_ID;
                $comment_author = $title;
@@ -5078,14 +5495,14 @@ class wp_xmlrpc_server extends IXR_Server {
                $post_ID = url_to_postid($url);
                if ( !$post_ID ) {
                        // We aren't sure that the resource is available and/or pingback enabled
-                       return new IXR_Error(33, __('The specified target URL cannot be used as a target. It either doesn&#8217;t exist, or it is not a pingback-enabled resource.'));
+                       return $this->pingback_error( 33, __( 'The specified target URL cannot be used as a target. It either doesn&#8217;t exist, or it is not a pingback-enabled resource.' ) );
                }
 
-               $actual_post = wp_get_single_post($post_ID, ARRAY_A);
+               $actual_post = get_post($post_ID, ARRAY_A);
 
                if ( !$actual_post ) {
                        // No such post = resource not found
-                       return new IXR_Error(32, __('The specified target URL does not exist.'));
+                       return $this->pingback_error( 32, __('The specified target URL does not exist.' ) );
                }
 
                $comments = $wpdb->get_results( $wpdb->prepare("SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID) );
@@ -5101,4 +5518,8 @@ class wp_xmlrpc_server extends IXR_Server {
 
                return $pingbacks;
        }
+
+       protected function pingback_error( $code, $message ) {
+               return apply_filters( 'xmlrpc_pingback_error', new IXR_Error( $code, $message ) );
+       }
 }