X-Git-Url: https://scripts.mit.edu/gitweb/autoinstalls/wordpress.git/blobdiff_plain/138998bbd8f7a1ac38b2f1eacbdf7cd522be4b13..e3ff8f35458a959c1879c0a4976701ed8dcfe651:/wp-includes/class-wp-xmlrpc-server.php diff --git a/wp-includes/class-wp-xmlrpc-server.php b/wp-includes/class-wp-xmlrpc-server.php index 08897dc0..5084da65 100644 --- a/wp-includes/class-wp-xmlrpc-server.php +++ b/wp-includes/class-wp-xmlrpc-server.php @@ -14,7 +14,7 @@ * options, etc. * * As of WordPress 3.5.0, XML-RPC is enabled by default. It can be disabled - * via the xmlrpc_enabled filter found in wp_xmlrpc_server::login(). + * via the {@see 'xmlrpc_enabled'} filter found in wp_xmlrpc_server::login(). * * @package WordPress * @subpackage Publishing @@ -54,11 +54,11 @@ class wp_xmlrpc_server extends IXR_Server { protected $auth_failed = false; /** - * Register all of the XMLRPC methods that XMLRPC server understands. + * Registers all of the XMLRPC methods that XMLRPC server understands. * * Sets up server and method property. Passes XMLRPC - * methods through the 'xmlrpc_methods' filter to allow plugins to extend - * or replace XMLRPC methods. + * methods through the {@see 'xmlrpc_methods'} filter to allow plugins to extend + * or replace XML-RPC methods. * * @since 1.5.0 */ @@ -159,7 +159,7 @@ class wp_xmlrpc_server extends IXR_Server { $this->initialise_blog_option_info(); /** - * Filter the methods exposed by the XML-RPC server. + * Filters the methods exposed by the XML-RPC server. * * This filter can be used to add new methods, and remove built-in methods. * @@ -171,7 +171,7 @@ class wp_xmlrpc_server extends IXR_Server { } /** - * Make private/protected methods readable for backwards compatibility. + * Make private/protected methods readable for backward compatibility. * * @since 4.0.0 * @access public @@ -188,6 +188,9 @@ class wp_xmlrpc_server extends IXR_Server { } /** + * Serves the XML-RPC request. + * + * @since 2.9.0 * @access public */ public function serve_request() { @@ -244,9 +247,22 @@ class wp_xmlrpc_server extends IXR_Server { } /** - * Filter whether XML-RPC is enabled. + * Filters whether XML-RPC methods requiring authentication are enabled. + * + * Contrary to the way it's named, this filter does not control whether XML-RPC is *fully* + * enabled, rather, it only controls whether XML-RPC methods requiring authentication - such + * as for publishing purposes - are enabled. + * + * Further, the filter does not control whether pingbacks or other custom endpoints that don't + * require authentication are enabled. This behavior is expected, and due to how parity was matched + * with the `enable_xmlrpc` UI option the filter replaced when it was introduced in 3.5. + * + * To disable XML-RPC methods that require authentication, use: + * + * add_filter( 'xmlrpc_enabled', '__return_false' ); * - * This is the proper filter for turning off XML-RPC. + * For more granular control over all XML-RPC methods and requests, see the {@see 'xmlrpc_methods'} + * and {@see 'xmlrpc_element_limit'} hooks. * * @since 3.5.0 * @@ -272,7 +288,7 @@ class wp_xmlrpc_server extends IXR_Server { $this->auth_failed = true; /** - * Filter the XML-RPC user login error message. + * Filters the XML-RPC user login error message. * * @since 3.5.0 * @@ -388,12 +404,8 @@ class wp_xmlrpc_server extends IXR_Server { * Passes property through {@see 'xmlrpc_blog_options'} filter. * * @since 2.6.0 - * - * @global string $wp_version */ public function initialise_blog_option_info() { - global $wp_version; - $this->blog_options = array( // Read only options 'software_name' => array( @@ -404,7 +416,7 @@ class wp_xmlrpc_server extends IXR_Server { 'software_version' => array( 'desc' => __( 'Software Version' ), 'readonly' => true, - 'value' => $wp_version + 'value' => get_bloginfo( 'version' ) ), 'blog_url' => array( 'desc' => __( 'WordPress Address (URL)' ), @@ -546,7 +558,7 @@ class wp_xmlrpc_server extends IXR_Server { ); /** - * Filter the XML-RPC blog options property. + * Filters the XML-RPC blog options property. * * @since 2.6.0 * @@ -575,6 +587,10 @@ class wp_xmlrpc_server extends IXR_Server { * - 'xmlrpc' - url of xmlrpc endpoint */ public function wp_getUsersBlogs( $args ) { + if ( ! $this->minimum_args( $args, 2 ) ) { + return $this->error; + } + // If this isn't on WPMU then just use blogger_getUsersBlogs if ( !is_multisite() ) { array_unshift( $args, 1 ); @@ -612,7 +628,7 @@ class wp_xmlrpc_server extends IXR_Server { foreach ( $blogs as $blog ) { // Don't include blogs that aren't hosted at this site. - if ( $blog->site_id != get_current_site()->id ) + if ( $blog->site_id != get_current_network_id() ) continue; $blog_id = $blog->userblog_id; @@ -688,13 +704,13 @@ class wp_xmlrpc_server extends IXR_Server { $_taxonomy['object_type'] = array_unique( (array) $taxonomy->object_type ); /** - * Filter XML-RPC-prepared data for the given taxonomy. + * Filters XML-RPC-prepared data for the given taxonomy. * * @since 3.4.0 * - * @param array $_taxonomy An array of taxonomy data. - * @param object $taxonomy Taxonomy object. - * @param array $fields The subset of taxonomy fields to return. + * @param array $_taxonomy An array of taxonomy data. + * @param WP_Taxonomy $taxonomy Taxonomy object. + * @param array $fields The subset of taxonomy fields to return. */ return apply_filters( 'xmlrpc_prepare_taxonomy', $_taxonomy, $taxonomy, $fields ); } @@ -722,7 +738,7 @@ class wp_xmlrpc_server extends IXR_Server { $_term['count'] = intval( $_term['count'] ); /** - * Filter XML-RPC-prepared data for the given term. + * Filters XML-RPC-prepared data for the given term. * * @since 3.4.0 * @@ -851,7 +867,7 @@ class wp_xmlrpc_server extends IXR_Server { } /** - * Filter XML-RPC-prepared date for the given post. + * Filters XML-RPC-prepared date for the given post. * * @since 3.4.0 * @@ -865,10 +881,12 @@ class wp_xmlrpc_server extends IXR_Server { /** * Prepares post data for return in an XML-RPC object. * + * @since 3.4.0 + * @since 4.6.0 Converted the `$post_type` parameter to accept a WP_Post_Type object. * @access protected * - * @param object $post_type Post type object. - * @param array $fields The subset of post fields to return. + * @param WP_Post_Type $post_type Post type object. + * @param array $fields The subset of post fields to return. * @return array The prepared post type data. */ protected function _prepare_post_type( $post_type, $fields ) { @@ -902,12 +920,13 @@ class wp_xmlrpc_server extends IXR_Server { $_post_type['taxonomies'] = get_object_taxonomies( $post_type->name, 'names' ); /** - * Filter XML-RPC-prepared date for the given post type. + * Filters XML-RPC-prepared date for the given post type. * * @since 3.4.0 + * @since 4.6.0 Converted the `$post_type` parameter to accept a WP_Post_Type object. * - * @param array $_post_type An array of post type data. - * @param object $post_type Post type object. + * @param array $_post_type An array of post type data. + * @param WP_Post_Type $post_type Post type object. */ return apply_filters( 'xmlrpc_prepare_post_type', $_post_type, $post_type ); } @@ -941,7 +960,7 @@ class wp_xmlrpc_server extends IXR_Server { $_media_item['thumbnail'] = $_media_item['link']; /** - * Filter XML-RPC-prepared data for the given media item. + * Filters XML-RPC-prepared data for the given media item. * * @since 3.4.0 * @@ -1023,7 +1042,7 @@ class wp_xmlrpc_server extends IXR_Server { ); /** - * Filter XML-RPC-prepared data for the given page. + * Filters XML-RPC-prepared data for the given page. * * @since 3.4.0 * @@ -1072,7 +1091,7 @@ class wp_xmlrpc_server extends IXR_Server { ); /** - * Filter XML-RPC-prepared data for the given comment. + * Filters XML-RPC-prepared data for the given comment. * * @since 3.4.0 * @@ -1120,7 +1139,7 @@ class wp_xmlrpc_server extends IXR_Server { } /** - * Filter XML-RPC-prepared data for the given user. + * Filters XML-RPC-prepared data for the given user. * * @since 3.5.0 * @@ -1136,7 +1155,7 @@ class wp_xmlrpc_server extends IXR_Server { * * @since 3.4.0 * - * @link http://en.wikipedia.org/wiki/RSS_enclosure for information on RSS enclosures. + * @link https://en.wikipedia.org/wiki/RSS_enclosure for information on RSS enclosures. * * @param array $args { * Method arguments. Note: top-level arguments must be ordered as documented. @@ -1251,7 +1270,7 @@ class wp_xmlrpc_server extends IXR_Server { } } elseif ( isset( $post_data['sticky'] ) ) { if ( ! current_user_can( $post_type->cap->edit_others_posts ) ) { - return new IXR_Error( 401, __( 'Sorry, you are not allowed to stick this post.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to make posts sticky.' ) ); } $sticky = wp_validate_boolean( $post_data['sticky'] ); @@ -1283,7 +1302,7 @@ class wp_xmlrpc_server extends IXR_Server { $post_type = get_post_type_object( $post_data['post_type'] ); if ( ! $post_type ) - return new IXR_Error( 403, __( 'Invalid post type' ) ); + return new IXR_Error( 403, __( 'Invalid post type.' ) ); $update = ! empty( $post_data['ID'] ); @@ -1305,12 +1324,12 @@ class wp_xmlrpc_server extends IXR_Server { break; case 'private': if ( ! current_user_can( $post_type->cap->publish_posts ) ) - return new IXR_Error( 401, __( 'Sorry, you are not allowed to create private posts in this post type' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to create private posts in this post type.' ) ); break; case 'publish': case 'future': if ( ! current_user_can( $post_type->cap->publish_posts ) ) - return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish posts in this post type' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish posts in this post type.' ) ); break; default: if ( ! get_post_status_object( $post_data['post_status'] ) ) @@ -1319,12 +1338,12 @@ class wp_xmlrpc_server extends IXR_Server { } if ( ! empty( $post_data['post_password'] ) && ! current_user_can( $post_type->cap->publish_posts ) ) - return new IXR_Error( 401, __( 'Sorry, you are not allowed to create password protected posts in this post type' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to create password protected posts in this post type.' ) ); $post_data['post_author'] = absint( $post_data['post_author'] ); if ( ! empty( $post_data['post_author'] ) && $post_data['post_author'] != $user->ID ) { if ( ! current_user_can( $post_type->cap->edit_others_posts ) ) - return new IXR_Error( 401, __( 'You are not allowed to create posts as this user.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to create posts as this user.' ) ); $author = get_userdata( $post_data['post_author'] ); @@ -1348,9 +1367,15 @@ class wp_xmlrpc_server extends IXR_Server { $dateCreated = $post_data['post_date']->getIso(); } + // Default to not flagging the post date to be edited unless it's intentional. + $post_data['edit_date'] = false; + if ( ! empty( $dateCreated ) ) { - $post_data['post_date'] = iso8601_to_datetime( $dateCreated ); - $post_data['post_date_gmt'] = get_gmt_from_date( $post_data['post_date'] ); + $post_data['post_date'] = get_date_from_gmt( iso8601_to_datetime( $dateCreated ) ); + $post_data['post_date_gmt'] = iso8601_to_datetime( $dateCreated, 'GMT' ); + + // Flag the post date to be edited. + $post_data['edit_date'] = true; } if ( ! isset( $post_data['ID'] ) ) @@ -1401,7 +1426,7 @@ class wp_xmlrpc_server extends IXR_Server { $term = get_term_by( 'id', $term_id, $taxonomy ); if ( ! $term ) - return new IXR_Error( 403, __( 'Invalid term ID' ) ); + return new IXR_Error( 403, __( 'Invalid term ID.' ) ); $terms[$taxonomy][] = (int) $term_id; } @@ -1484,7 +1509,7 @@ class wp_xmlrpc_server extends IXR_Server { $this->attach_uploads( $post_ID, $post_data['post_content'] ); /** - * Filter post data array to be inserted via XML-RPC. + * Filters post data array to be inserted via XML-RPC. * * @since 3.4.0 * @@ -1498,7 +1523,7 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error( 500, $post_ID->get_error_message() ); if ( ! $post_ID ) - return new IXR_Error( 401, __( 'Sorry, your entry could not be posted. Something wrong happened.' ) ); + return new IXR_Error( 401, __( 'Sorry, your entry could not be posted.' ) ); return strval( $post_ID ); } @@ -1612,7 +1637,7 @@ class wp_xmlrpc_server extends IXR_Server { } if ( ! current_user_can( 'delete_post', $post_id ) ) { - return new IXR_Error( 401, __( 'Sorry, you do not have the right to delete this post.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this post.' ) ); } $result = wp_delete_post( $post_id ); @@ -1687,7 +1712,7 @@ class wp_xmlrpc_server extends IXR_Server { $fields = $args[4]; } else { /** - * Filter the list of post query fields used by the given XML-RPC method. + * Filters the list of post query fields used by the given XML-RPC method. * * @since 3.4.0 * @@ -1709,7 +1734,7 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error( 404, __( 'Invalid post ID.' ) ); if ( ! current_user_can( 'edit_post', $post_id ) ) - return new IXR_Error( 401, __( 'Sorry, you cannot edit this post.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) ); return $this->_prepare_post( $post, $fields ); } @@ -1764,13 +1789,13 @@ class wp_xmlrpc_server extends IXR_Server { if ( isset( $filter['post_type'] ) ) { $post_type = get_post_type_object( $filter['post_type'] ); if ( ! ( (bool) $post_type ) ) - return new IXR_Error( 403, __( 'The post type specified is not valid' ) ); + return new IXR_Error( 403, __( 'Invalid post type.' ) ); } else { $post_type = get_post_type_object( 'post' ); } if ( ! current_user_can( $post_type->cap->edit_posts ) ) - return new IXR_Error( 401, __( 'You are not allowed to edit posts in this post type.' )); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts in this post type.' ) ); $query['post_type'] = $post_type->name; @@ -1848,12 +1873,13 @@ class wp_xmlrpc_server extends IXR_Server { do_action( 'xmlrpc_call', 'wp.newTerm' ); if ( ! taxonomy_exists( $content_struct['taxonomy'] ) ) - return new IXR_Error( 403, __( 'Invalid taxonomy' ) ); + return new IXR_Error( 403, __( 'Invalid taxonomy.' ) ); $taxonomy = get_taxonomy( $content_struct['taxonomy'] ); - if ( ! current_user_can( $taxonomy->cap->manage_terms ) ) - return new IXR_Error( 401, __( 'You are not allowed to create terms in this taxonomy.' ) ); + if ( ! current_user_can( $taxonomy->cap->edit_terms ) ) { + return new IXR_Error( 401, __( 'Sorry, you are not allowed to create terms in this taxonomy.' ) ); + } $taxonomy = (array) $taxonomy; @@ -1892,7 +1918,7 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error( 500, $term->get_error_message() ); if ( ! $term ) - return new IXR_Error( 500, __( 'Sorry, your term could not be created. Something wrong happened.' ) ); + return new IXR_Error( 500, __( 'Sorry, your term could not be created.' ) ); return strval( $term['term_id'] ); } @@ -1935,13 +1961,10 @@ class wp_xmlrpc_server extends IXR_Server { do_action( 'xmlrpc_call', 'wp.editTerm' ); if ( ! taxonomy_exists( $content_struct['taxonomy'] ) ) - return new IXR_Error( 403, __( 'Invalid taxonomy' ) ); + return new IXR_Error( 403, __( 'Invalid taxonomy.' ) ); $taxonomy = get_taxonomy( $content_struct['taxonomy'] ); - if ( ! current_user_can( $taxonomy->cap->edit_terms ) ) - return new IXR_Error( 401, __( 'You are not allowed to edit terms in this taxonomy.' ) ); - $taxonomy = (array) $taxonomy; // hold the data of the term @@ -1953,7 +1976,11 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error( 500, $term->get_error_message() ); if ( ! $term ) - return new IXR_Error( 404, __( 'Invalid term ID' ) ); + return new IXR_Error( 404, __( 'Invalid term ID.' ) ); + + if ( ! current_user_can( 'edit_term', $term_id ) ) { + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this term.' ) ); + } if ( isset( $content_struct['name'] ) ) { $term_data['name'] = trim( $content_struct['name'] ); @@ -2031,20 +2058,20 @@ class wp_xmlrpc_server extends IXR_Server { do_action( 'xmlrpc_call', 'wp.deleteTerm' ); if ( ! taxonomy_exists( $taxonomy ) ) - return new IXR_Error( 403, __( 'Invalid taxonomy' ) ); + return new IXR_Error( 403, __( 'Invalid taxonomy.' ) ); $taxonomy = get_taxonomy( $taxonomy ); - - if ( ! current_user_can( $taxonomy->cap->delete_terms ) ) - return new IXR_Error( 401, __( 'You are not allowed to delete terms in this taxonomy.' ) ); - $term = get_term( $term_id, $taxonomy->name ); if ( is_wp_error( $term ) ) return new IXR_Error( 500, $term->get_error_message() ); if ( ! $term ) - return new IXR_Error( 404, __( 'Invalid term ID' ) ); + return new IXR_Error( 404, __( 'Invalid term ID.' ) ); + + if ( ! current_user_can( 'delete_term', $term_id ) ) { + return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this term.' ) ); + } $result = wp_delete_term( $term_id, $taxonomy->name ); @@ -2102,20 +2129,21 @@ class wp_xmlrpc_server extends IXR_Server { do_action( 'xmlrpc_call', 'wp.getTerm' ); if ( ! taxonomy_exists( $taxonomy ) ) - return new IXR_Error( 403, __( 'Invalid taxonomy' ) ); + return new IXR_Error( 403, __( 'Invalid taxonomy.' ) ); $taxonomy = get_taxonomy( $taxonomy ); - if ( ! current_user_can( $taxonomy->cap->assign_terms ) ) - return new IXR_Error( 401, __( 'You are not allowed to assign terms in this taxonomy.' ) ); - $term = get_term( $term_id , $taxonomy->name, ARRAY_A ); if ( is_wp_error( $term ) ) return new IXR_Error( 500, $term->get_error_message() ); if ( ! $term ) - return new IXR_Error( 404, __( 'Invalid term ID' ) ); + return new IXR_Error( 404, __( 'Invalid term ID.' ) ); + + if ( ! current_user_can( 'assign_term', $term_id ) ) { + return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign this term.' ) ); + } return $this->_prepare_term( $term ); } @@ -2160,12 +2188,12 @@ class wp_xmlrpc_server extends IXR_Server { do_action( 'xmlrpc_call', 'wp.getTerms' ); if ( ! taxonomy_exists( $taxonomy ) ) - return new IXR_Error( 403, __( 'Invalid taxonomy' ) ); + return new IXR_Error( 403, __( 'Invalid taxonomy.' ) ); $taxonomy = get_taxonomy( $taxonomy ); if ( ! current_user_can( $taxonomy->cap->assign_terms ) ) - return new IXR_Error( 401, __( 'You are not allowed to assign terms in this taxonomy.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign terms in this taxonomy.' ) ); $query = array(); @@ -2238,7 +2266,7 @@ class wp_xmlrpc_server extends IXR_Server { $fields = $args[4]; } else { /** - * Filter the taxonomy query fields used by the given XML-RPC method. + * Filters the taxonomy query fields used by the given XML-RPC method. * * @since 3.4.0 * @@ -2255,12 +2283,12 @@ class wp_xmlrpc_server extends IXR_Server { do_action( 'xmlrpc_call', 'wp.getTaxonomy' ); if ( ! taxonomy_exists( $taxonomy ) ) - return new IXR_Error( 403, __( 'Invalid taxonomy' ) ); + return new IXR_Error( 403, __( 'Invalid taxonomy.' ) ); $taxonomy = get_taxonomy( $taxonomy ); if ( ! current_user_can( $taxonomy->cap->assign_terms ) ) - return new IXR_Error( 401, __( 'You are not allowed to assign terms in this taxonomy.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign terms in this taxonomy.' ) ); return $this->_prepare_taxonomy( $taxonomy, $fields ); } @@ -2373,7 +2401,7 @@ class wp_xmlrpc_server extends IXR_Server { $fields = $args[4]; } else { /** - * Filter the default user query fields used by the given XML-RPC method. + * Filters the default user query fields used by the given XML-RPC method. * * @since 3.5.0 * @@ -2390,7 +2418,7 @@ class wp_xmlrpc_server extends IXR_Server { do_action( 'xmlrpc_call', 'wp.getUser' ); if ( ! current_user_can( 'edit_user', $user_id ) ) - return new IXR_Error( 401, __( 'Sorry, you cannot edit users.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this user.' ) ); $user_data = get_userdata( $user_id ); @@ -2448,7 +2476,7 @@ class wp_xmlrpc_server extends IXR_Server { do_action( 'xmlrpc_call', 'wp.getUsers' ); if ( ! current_user_can( 'list_users' ) ) - return new IXR_Error( 401, __( 'You are not allowed to browse users.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to list users.' ) ); $query = array( 'fields' => 'all_with_meta' ); @@ -2464,7 +2492,7 @@ class wp_xmlrpc_server extends IXR_Server { if ( isset( $filter['role'] ) ) { if ( get_role( $filter['role'] ) === null ) - return new IXR_Error( 403, __( 'The role specified is not valid' ) ); + return new IXR_Error( 403, __( 'Invalid role.' ) ); $query['role'] = $filter['role']; } @@ -2521,7 +2549,7 @@ class wp_xmlrpc_server extends IXR_Server { do_action( 'xmlrpc_call', 'wp.getProfile' ); if ( ! current_user_can( 'edit_user', $user->ID ) ) - return new IXR_Error( 401, __( 'Sorry, you cannot edit your profile.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit your profile.' ) ); $user_data = get_userdata( $user->ID ); @@ -2567,7 +2595,7 @@ class wp_xmlrpc_server extends IXR_Server { do_action( 'xmlrpc_call', 'wp.editProfile' ); if ( ! current_user_can( 'edit_user', $user->ID ) ) - return new IXR_Error( 401, __( 'Sorry, you cannot edit your profile.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit your profile.' ) ); // holds data of the user $user_data = array(); @@ -2637,7 +2665,7 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error( 404, __( 'Invalid post ID.' ) ); if ( !current_user_can( 'edit_page', $page_id ) ) - return new IXR_Error( 401, __( 'Sorry, you cannot edit this page.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this page.' ) ); /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'wp.getPage' ); @@ -2678,7 +2706,7 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; if ( !current_user_can( 'edit_pages' ) ) - return new IXR_Error( 401, __( 'Sorry, you cannot edit pages.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit pages.' ) ); /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'wp.getPages' ); @@ -2772,7 +2800,7 @@ class wp_xmlrpc_server extends IXR_Server { // Make sure the user can delete pages. if ( !current_user_can('delete_page', $page_id) ) - return new IXR_Error( 401, __( 'Sorry, you do not have the right to delete this page.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this page.' ) ); // Attempt to delete the page. $result = wp_delete_post($page_id); @@ -2834,7 +2862,7 @@ class wp_xmlrpc_server extends IXR_Server { // Make sure the user is allowed to edit pages. if ( !current_user_can('edit_page', $page_id) ) - return new IXR_Error( 401, __( 'Sorry, you do not have the right to edit this page.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this page.' ) ); // Mark this as content for a page. $content['post_type'] = 'page'; @@ -2880,7 +2908,7 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; if ( !current_user_can( 'edit_pages' ) ) - return new IXR_Error( 401, __( 'Sorry, you cannot edit pages.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit pages.' ) ); /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'wp.getPageList' ); @@ -2936,7 +2964,7 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; if ( !current_user_can('edit_posts') ) - return new IXR_Error( 401, __( 'Sorry, you cannot edit posts on this site.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts.' ) ); /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'wp.getAuthors' ); @@ -3031,7 +3059,7 @@ class wp_xmlrpc_server extends IXR_Server { // Make sure the user is allowed to add a category. if ( !current_user_can('manage_categories') ) - return new IXR_Error(401, __('Sorry, you do not have the right to add a category.')); + return new IXR_Error(401, __('Sorry, you are not allowed to add a category.')); // If no slug was provided make it empty so that // WordPress will generate one. @@ -3090,7 +3118,7 @@ class wp_xmlrpc_server extends IXR_Server { * @type string $password * @type int $category_id * } - * @return bool|IXR_Error See {@link wp_delete_term()} for return info. + * @return bool|IXR_Error See wp_delete_term() for return info. */ public function wp_deleteCategory( $args ) { $this->escape( $args ); @@ -3106,7 +3134,7 @@ class wp_xmlrpc_server extends IXR_Server { do_action( 'xmlrpc_call', 'wp.deleteCategory' ); if ( !current_user_can('manage_categories') ) - return new IXR_Error( 401, __( 'Sorry, you do not have the right to delete a category.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete a category.' ) ); $status = wp_delete_term( $category_id, 'category' ); @@ -3204,7 +3232,7 @@ class wp_xmlrpc_server extends IXR_Server { } if ( ! current_user_can( 'edit_comment', $comment_id ) ) { - return new IXR_Error( 403, __( 'You are not allowed to moderate or edit this comment.' ) ); + return new IXR_Error( 403, __( 'Sorry, you are not allowed to moderate or edit this comment.' ) ); } return $this->_prepare_comment( $comment ); @@ -3222,7 +3250,7 @@ class wp_xmlrpc_server extends IXR_Server { * - 'status' - Default is ''. Filter by status (e.g., 'approve', 'hold') * - 'post_id' - Default is ''. The post where the comment is posted. Empty string shows all comments. * - 'number' - Default is 10. Total number of media items to retrieve. - * - 'offset' - Default is 0. See {@link WP_Query::query()} for more. + * - 'offset' - Default is 0. See WP_Query::query() for more. * * @since 2.7.0 * @@ -3234,7 +3262,7 @@ class wp_xmlrpc_server extends IXR_Server { * @type string $password * @type array $struct * } - * @return array|IXR_Error Contains a collection of comments. See {@link wp_xmlrpc_server::wp_getComment()} for a description of each item contents + * @return array|IXR_Error Contains a collection of comments. See wp_xmlrpc_server::wp_getComment() for a description of each item contents */ public function wp_getComments( $args ) { $this->escape( $args ); @@ -3306,8 +3334,7 @@ class wp_xmlrpc_server extends IXR_Server { * Delete a comment. * * By default, the comment will be moved to the trash instead of deleted. - * See {@link wp_delete_comment()} for more information on - * this behavior. + * See wp_delete_comment() for more information on this behavior. * * @since 2.7.0 * @@ -3319,7 +3346,7 @@ class wp_xmlrpc_server extends IXR_Server { * @type string $password * @type int $comment_ID * } - * @return bool|IXR_Error {@link wp_delete_comment()} + * @return bool|IXR_Error See wp_delete_comment(). */ public function wp_deleteComment( $args ) { $this->escape($args); @@ -3337,7 +3364,7 @@ class wp_xmlrpc_server extends IXR_Server { } if ( !current_user_can( 'edit_comment', $comment_ID ) ) { - return new IXR_Error( 403, __( 'You are not allowed to moderate or edit this comment.' ) ); + return new IXR_Error( 403, __( 'Sorry, you are not allowed to moderate or edit this comment.' ) ); } /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ @@ -3404,7 +3431,7 @@ class wp_xmlrpc_server extends IXR_Server { } if ( ! current_user_can( 'edit_comment', $comment_ID ) ) { - return new IXR_Error( 403, __( 'You are not allowed to moderate or edit this comment.' ) ); + return new IXR_Error( 403, __( 'Sorry, you are not allowed to moderate or edit this comment.' ) ); } /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ @@ -3423,8 +3450,8 @@ class wp_xmlrpc_server extends IXR_Server { if ( !empty( $content_struct['date_created_gmt'] ) ) { // We know this is supposed to be GMT, so we're going to slap that Z on there by force $dateCreated = rtrim( $content_struct['date_created_gmt']->getIso(), 'Z' ) . 'Z'; - $comment_date = iso8601_to_datetime( $dateCreated ); - $comment_date_gmt = get_gmt_from_date( $comment_date ); + $comment_date = get_date_from_gmt(iso8601_to_datetime($dateCreated)); + $comment_date_gmt = iso8601_to_datetime($dateCreated, 'GMT'); } if ( isset($content_struct['content']) ) @@ -3447,7 +3474,7 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error(500, $result->get_error_message()); if ( !$result ) - return new IXR_Error(500, __('Sorry, the comment could not be edited. Something wrong happened.')); + return new IXR_Error(500, __('Sorry, the comment could not be edited.')); /** * Fires after a comment has been successfully updated via XML-RPC. @@ -3476,7 +3503,7 @@ class wp_xmlrpc_server extends IXR_Server { * @type string|int $post * @type array $content_struct * } - * @return int|IXR_Error {@link wp_new_comment()} + * @return int|IXR_Error See wp_new_comment(). */ public function wp_newComment($args) { $this->escape($args); @@ -3487,7 +3514,7 @@ class wp_xmlrpc_server extends IXR_Server { $content_struct = $args[4]; /** - * Filter whether to allow anonymous comments over XML-RPC. + * Filters whether to allow anonymous comments over XML-RPC. * * @since 2.7.0 * @@ -3501,7 +3528,7 @@ class wp_xmlrpc_server extends IXR_Server { if ( !$user ) { $logged_in = false; if ( $allow_anon && get_option('comment_registration') ) { - return new IXR_Error( 403, __( 'You must be registered to comment' ) ); + return new IXR_Error( 403, __( 'You must be registered to comment.' ) ); } elseif ( ! $allow_anon ) { return $this->error; } @@ -3526,8 +3553,14 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error( 403, __( 'Sorry, comments are closed for this item.' ) ); } - $comment = array(); - $comment['comment_post_ID'] = $post_id; + if ( empty( $content_struct['content'] ) ) { + return new IXR_Error( 403, __( 'Comment is required.' ) ); + } + + $comment = array( + 'comment_post_ID' => $post_id, + 'comment_content' => $content_struct['content'], + ); if ( $logged_in ) { $display_name = $user->display_name; @@ -3555,20 +3588,25 @@ class wp_xmlrpc_server extends IXR_Server { if ( get_option('require_name_email') ) { if ( 6 > strlen($comment['comment_author_email']) || '' == $comment['comment_author'] ) - return new IXR_Error( 403, __( 'Comment author name and email are required' ) ); + return new IXR_Error( 403, __( 'Comment author name and email are required.' ) ); elseif ( !is_email($comment['comment_author_email']) ) - return new IXR_Error( 403, __( 'A valid email address is required' ) ); + return new IXR_Error( 403, __( 'A valid email address is required.' ) ); } } $comment['comment_parent'] = isset($content_struct['comment_parent']) ? absint($content_struct['comment_parent']) : 0; - $comment['comment_content'] = isset($content_struct['content']) ? $content_struct['content'] : null; - /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'wp.newComment' ); - $comment_ID = wp_new_comment( $comment ); + $comment_ID = wp_new_comment( $comment, true ); + if ( is_wp_error( $comment_ID ) ) { + return new IXR_Error( 403, $comment_ID->get_error_message() ); + } + + if ( ! $comment_ID ) { + return new IXR_Error( 403, __( 'An unknown error occurred' ) ); + } /** * Fires after a new comment has been successfully created via XML-RPC. @@ -3608,7 +3646,7 @@ class wp_xmlrpc_server extends IXR_Server { } if ( ! current_user_can( 'publish_posts' ) ) { - return new IXR_Error( 403, __( 'You are not allowed access to details about this site.' ) ); + return new IXR_Error( 403, __( 'Sorry, you are not allowed access to details about this site.' ) ); } /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ @@ -3649,7 +3687,7 @@ class wp_xmlrpc_server extends IXR_Server { } if ( ! current_user_can( 'edit_post', $post_id ) ) { - return new IXR_Error( 403, __( 'You are not allowed access to details of this post.' ) ); + return new IXR_Error( 403, __( 'Sorry, you are not allowed access to details of this post.' ) ); } /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ @@ -3689,7 +3727,7 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; if ( !current_user_can( 'edit_posts' ) ) - return new IXR_Error( 403, __( 'You are not allowed access to details about this site.' ) ); + return new IXR_Error( 403, __( 'Sorry, you are not allowed access to details about this site.' ) ); /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'wp.getPostStatusList' ); @@ -3721,7 +3759,7 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; if ( !current_user_can( 'edit_pages' ) ) - return new IXR_Error( 403, __( 'You are not allowed access to details about this site.' ) ); + return new IXR_Error( 403, __( 'Sorry, you are not allowed access to details about this site.' ) ); /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'wp.getPageStatusList' ); @@ -3753,7 +3791,7 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; if ( !current_user_can( 'edit_pages' ) ) - return new IXR_Error( 403, __( 'You are not allowed access to details about this site.' ) ); + return new IXR_Error( 403, __( 'Sorry, you are not allowed access to details about this site.' ) ); $templates = get_page_templates(); $templates['Default'] = 'default'; @@ -3847,7 +3885,7 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; if ( !current_user_can( 'manage_options' ) ) - return new IXR_Error( 403, __( 'You are not allowed to update options.' ) ); + return new IXR_Error( 403, __( 'Sorry, you are not allowed to update options.' ) ); $option_names = array(); foreach ( $options as $o_name => $o_value ) { @@ -3899,7 +3937,7 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; if ( !current_user_can( 'upload_files' ) ) - return new IXR_Error( 403, __( 'You do not have permission to upload files.' ) ); + return new IXR_Error( 403, __( 'Sorry, you are not allowed to upload files.' ) ); /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'wp.getMediaItem' ); @@ -3947,7 +3985,7 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; if ( !current_user_can( 'upload_files' ) ) - return new IXR_Error( 401, __( 'You do not have permission to upload files.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to upload files.' ) ); /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'wp.getMediaLibrary' ); @@ -3991,7 +4029,7 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; if ( !current_user_can( 'edit_posts' ) ) - return new IXR_Error( 403, __( 'You are not allowed access to details about this site.' ) ); + return new IXR_Error( 403, __( 'Sorry, you are not allowed access to details about this site.' ) ); /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'wp.getPostFormats' ); @@ -4057,7 +4095,7 @@ class wp_xmlrpc_server extends IXR_Server { $fields = $args[4]; } else { /** - * Filter the default query fields used by the given XML-RPC method. + * Filters the default query fields used by the given XML-RPC method. * * @since 3.4.0 * @@ -4074,12 +4112,12 @@ class wp_xmlrpc_server extends IXR_Server { do_action( 'xmlrpc_call', 'wp.getPostType' ); if ( ! post_type_exists( $post_type_name ) ) - return new IXR_Error( 403, __( 'Invalid post type' ) ); + return new IXR_Error( 403, __( 'Invalid post type.' ) ); $post_type = get_post_type_object( $post_type_name ); if ( ! current_user_can( $post_type->cap->edit_posts ) ) - return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post type.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts in this post type.' ) ); return $this->_prepare_post_type( $post_type, $fields ); } @@ -4175,7 +4213,7 @@ class wp_xmlrpc_server extends IXR_Server { $fields = $args[4]; } else { /** - * Filter the default revision query fields used by the given XML-RPC method. + * Filters the default revision query fields used by the given XML-RPC method. * * @since 3.5.0 * @@ -4265,7 +4303,7 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error( 404, __( 'Invalid post ID.' ) ); if ( ! current_user_can( 'edit_post', $revision->post_parent ) ) - return new IXR_Error( 401, __( 'Sorry, you cannot edit this post.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) ); // Check if revisions are disabled. if ( ! wp_revisions_enabled( $post ) ) @@ -4277,7 +4315,7 @@ class wp_xmlrpc_server extends IXR_Server { } /* Blogger API functions. - * specs on http://plant.blogger.com/api and http://groups.yahoo.com/group/bloggerDev/ + * specs on http://plant.blogger.com/api and https://groups.yahoo.com/group/bloggerDev/ */ /** @@ -4297,8 +4335,13 @@ class wp_xmlrpc_server extends IXR_Server { * @return array|IXR_Error */ public function blogger_getUsersBlogs($args) { - if ( is_multisite() ) + if ( ! $this->minimum_args( $args, 3 ) ) { + return $this->error; + } + + if ( is_multisite() ) { return $this->_multisite_getUsersBlogs($args); + } $this->escape($args); @@ -4327,12 +4370,19 @@ class wp_xmlrpc_server extends IXR_Server { /** * Private function for retrieving a users blogs for multisite setups * + * @since 3.0.0 * @access protected * + * @param array $args { + * Method arguments. Note: arguments must be ordered as documented. + * + * @type string $username Username. + * @type string $password Password. + * } * @return array|IXR_Error */ - protected function _multisite_getUsersBlogs($args) { - $current_blog = get_blog_details(); + protected function _multisite_getUsersBlogs( $args ) { + $current_blog = get_site(); $domain = $current_blog->domain; $path = $current_blog->path . 'xmlrpc.php'; @@ -4381,7 +4431,7 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; if ( !current_user_can( 'edit_posts' ) ) - return new IXR_Error( 401, __( 'Sorry, you do not have access to user data on this site.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to access user data on this site.' ) ); /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'blogger.getUserInfo' ); @@ -4427,7 +4477,7 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error( 404, __( 'Invalid post ID.' ) ); if ( !current_user_can( 'edit_post', $post_ID ) ) - return new IXR_Error( 401, __( 'Sorry, you cannot edit this post.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) ); /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'blogger.getPost' ); @@ -4480,7 +4530,7 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; if ( ! current_user_can( 'edit_posts' ) ) - return new IXR_Error( 401, __( 'Sorry, you cannot edit posts on this site.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts.' ) ); /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'blogger.getRecentPosts' ); @@ -4520,7 +4570,9 @@ class wp_xmlrpc_server extends IXR_Server { * * @since 1.5.0 * @deprecated 3.5.0 - * @return IXR_Error + * + * @param array $args Unused. + * @return IXR_Error Error object. */ public function blogger_getTemplate($args) { return new IXR_Error( 403, __('Sorry, that file cannot be edited.' ) ); @@ -4531,18 +4583,20 @@ class wp_xmlrpc_server extends IXR_Server { * * @since 1.5.0 * @deprecated 3.5.0 - * @return IXR_Error + * + * @param array $args Unused. + * @return IXR_Error Error object. */ public function blogger_setTemplate($args) { return new IXR_Error( 403, __('Sorry, that file cannot be edited.' ) ); } /** - * Create new post. + * Creates new post. * * @since 1.5.0 * - * @param array $args { + * @param array $args { * Method arguments. Note: arguments must be ordered as documented. * * @type string $appkey (unused) @@ -4590,7 +4644,7 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error(500, $post_ID->get_error_message()); if ( !$post_ID ) - return new IXR_Error(500, __('Sorry, your entry could not be posted. Something wrong happened.')); + return new IXR_Error(500, __('Sorry, your entry could not be posted.')); $this->attach_uploads( $post_ID, $post_content ); @@ -4650,10 +4704,10 @@ class wp_xmlrpc_server extends IXR_Server { $this->escape($actual_post); if ( ! current_user_can( 'edit_post', $post_ID ) ) { - return new IXR_Error(401, __('Sorry, you do not have the right to edit this post.')); + return new IXR_Error(401, __('Sorry, you are not allowed to edit this post.')); } if ( 'publish' == $actual_post['post_status'] && ! current_user_can( 'publish_posts' ) ) { - return new IXR_Error( 401, __( 'Sorry, you do not have the right to publish this post.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish this post.' ) ); } $postdata = array(); @@ -4720,7 +4774,7 @@ class wp_xmlrpc_server extends IXR_Server { } if ( ! current_user_can( 'delete_post', $post_ID ) ) { - return new IXR_Error( 401, __( 'Sorry, you do not have the right to delete this post.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this post.' ) ); } $result = wp_delete_post( $post_ID ); @@ -4822,7 +4876,7 @@ class wp_xmlrpc_server extends IXR_Server { $post_type = 'post'; } else { // No other post_type values are allowed here - return new IXR_Error( 401, __( 'Invalid post type' ) ); + return new IXR_Error( 401, __( 'Invalid post type.' ) ); } } else { if ( $publish ) @@ -4844,7 +4898,7 @@ class wp_xmlrpc_server extends IXR_Server { if ( isset( $content_struct['wp_post_format'] ) ) { $content_struct['wp_post_format'] = sanitize_key( $content_struct['wp_post_format'] ); if ( !array_key_exists( $content_struct['wp_post_format'], get_post_format_strings() ) ) { - return new IXR_Error( 404, __( 'Invalid post format' ) ); + return new IXR_Error( 404, __( 'Invalid post format.' ) ); } } @@ -4873,14 +4927,14 @@ class wp_xmlrpc_server extends IXR_Server { switch ( $post_type ) { case "post": if ( !current_user_can( 'edit_others_posts' ) ) - return new IXR_Error( 401, __( 'You are not allowed to create posts as this user.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to create posts as this user.' ) ); break; case "page": if ( !current_user_can( 'edit_others_pages' ) ) - return new IXR_Error( 401, __( 'You are not allowed to create pages as this user.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to create pages as this user.' ) ); break; default: - return new IXR_Error( 401, __( 'Invalid post type' ) ); + return new IXR_Error( 401, __( 'Invalid post type.' ) ); } $author = get_userdata( $content_struct['wp_author_id'] ); if ( ! $author ) @@ -4991,8 +5045,8 @@ class wp_xmlrpc_server extends IXR_Server { $dateCreated = $content_struct['dateCreated']->getIso(); if ( !empty( $dateCreated ) ) { - $post_date = iso8601_to_datetime( $dateCreated ); - $post_date_gmt = get_gmt_from_date( $post_date ); + $post_date = get_date_from_gmt(iso8601_to_datetime($dateCreated)); + $post_date_gmt = iso8601_to_datetime($dateCreated, 'GMT'); } else { $post_date = ''; $post_date_gmt = ''; @@ -5049,7 +5103,7 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error(500, $post_ID->get_error_message()); if ( !$post_ID ) - return new IXR_Error(500, __('Sorry, your entry could not be posted. Something wrong happened.')); + return new IXR_Error(500, __('Sorry, your entry could not be posted.')); /** * Fires after a new post has been successfully created via the XML-RPC MovableType API. @@ -5065,8 +5119,12 @@ class wp_xmlrpc_server extends IXR_Server { } /** - * @param integer $post_ID - * @param array $enclosure + * Adds an enclosure to a post if it's new. + * + * @since 2.8.0 + * + * @param integer $post_ID Post ID. + * @param array $enclosure Enclosure data. */ public function add_enclosure_if_new( $post_ID, $enclosure ) { if ( is_array( $enclosure ) && isset( $enclosure['url'] ) && isset( $enclosure['length'] ) && isset( $enclosure['type'] ) ) { @@ -5150,11 +5208,11 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error( 404, __( 'Invalid post ID.' ) ); if ( ! current_user_can( 'edit_post', $post_ID ) ) - return new IXR_Error( 401, __( 'Sorry, you do not have the right to edit this post.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) ); // Use wp.editPost to edit post types other than post and page. if ( ! in_array( $postdata[ 'post_type' ], array( 'post', 'page' ) ) ) - return new IXR_Error( 401, __( 'Invalid post type' ) ); + return new IXR_Error( 401, __( 'Invalid post type.' ) ); // Thwart attempt to change the post type. if ( ! empty( $content_struct[ 'post_type' ] ) && ( $content_struct['post_type'] != $postdata[ 'post_type' ] ) ) @@ -5164,7 +5222,7 @@ class wp_xmlrpc_server extends IXR_Server { if ( isset( $content_struct['wp_post_format'] ) ) { $content_struct['wp_post_format'] = sanitize_key( $content_struct['wp_post_format'] ); if ( !array_key_exists( $content_struct['wp_post_format'], get_post_format_strings() ) ) { - return new IXR_Error( 404, __( 'Invalid post format' ) ); + return new IXR_Error( 404, __( 'Invalid post format.' ) ); } } @@ -5209,16 +5267,16 @@ class wp_xmlrpc_server extends IXR_Server { switch ( $post_type ) { case 'post': if ( ! current_user_can( 'edit_others_posts' ) ) { - return new IXR_Error( 401, __( 'You are not allowed to change the post author as this user.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to change the post author as this user.' ) ); } break; case 'page': if ( ! current_user_can( 'edit_others_pages' ) ) { - return new IXR_Error( 401, __( 'You are not allowed to change the page author as this user.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to change the page author as this user.' ) ); } break; default: - return new IXR_Error( 401, __( 'Invalid post type' ) ); + return new IXR_Error( 401, __( 'Invalid post type.' ) ); } $post_author = $content_struct['wp_author_id']; } @@ -5321,9 +5379,9 @@ class wp_xmlrpc_server extends IXR_Server { if ( 'publish' == $post_status || 'private' == $post_status ) { if ( 'page' == $post_type && ! current_user_can( 'publish_pages' ) ) { - return new IXR_Error( 401, __( 'Sorry, you do not have the right to publish this page.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish this page.' ) ); } elseif ( ! current_user_can( 'publish_posts' ) ) { - return new IXR_Error( 401, __( 'Sorry, you do not have the right to publish this post.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish this post.' ) ); } } @@ -5344,23 +5402,29 @@ class wp_xmlrpc_server extends IXR_Server { elseif ( !empty( $content_struct['dateCreated']) ) $dateCreated = $content_struct['dateCreated']->getIso(); + // Default to not flagging the post date to be edited unless it's intentional. + $edit_date = false; + if ( !empty( $dateCreated ) ) { - $post_date = iso8601_to_datetime( $dateCreated ); - $post_date_gmt = get_gmt_from_date( $post_date, 'GMT' ); + $post_date = get_date_from_gmt(iso8601_to_datetime($dateCreated)); + $post_date_gmt = iso8601_to_datetime($dateCreated, 'GMT'); + + // Flag the post date to be edited. + $edit_date = true; } else { $post_date = $postdata['post_date']; $post_date_gmt = $postdata['post_date_gmt']; } // We've got all the data -- post it. - $newpost = compact('ID', 'post_content', 'post_title', 'post_category', 'post_status', 'post_excerpt', 'comment_status', 'ping_status', 'post_date', 'post_date_gmt', 'to_ping', 'post_name', 'post_password', 'post_parent', 'menu_order', 'post_author', 'tags_input', 'page_template'); + $newpost = compact('ID', 'post_content', 'post_title', 'post_category', 'post_status', 'post_excerpt', 'comment_status', 'ping_status', 'edit_date', 'post_date', 'post_date_gmt', 'to_ping', 'post_name', 'post_password', 'post_parent', 'menu_order', 'post_author', 'tags_input', 'page_template'); $result = wp_update_post($newpost, true); if ( is_wp_error( $result ) ) return new IXR_Error(500, $result->get_error_message()); if ( !$result ) - return new IXR_Error(500, __('Sorry, your entry could not be edited. Something wrong happened.')); + return new IXR_Error(500, __('Sorry, your entry could not be edited.')); // Only posts can be sticky if ( $post_type == 'post' && isset( $content_struct['sticky'] ) ) { @@ -5441,7 +5505,7 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error( 404, __( 'Invalid post ID.' ) ); if ( !current_user_can( 'edit_post', $post_ID ) ) - return new IXR_Error( 401, __( 'Sorry, you cannot edit this post.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) ); /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'metaWeblog.getPost' ); @@ -5571,7 +5635,7 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; if ( ! current_user_can( 'edit_posts' ) ) - return new IXR_Error( 401, __( 'Sorry, you cannot edit posts on this site.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts.' ) ); /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'metaWeblog.getRecentPosts' ); @@ -5748,7 +5812,7 @@ class wp_xmlrpc_server extends IXR_Server { do_action( 'xmlrpc_call', 'metaWeblog.newMediaObject' ); if ( !current_user_can('upload_files') ) { - $this->error = new IXR_Error( 401, __( 'You do not have permission to upload files.' ) ); + $this->error = new IXR_Error( 401, __( 'Sorry, you are not allowed to upload files.' ) ); return $this->error; } @@ -5758,7 +5822,7 @@ class wp_xmlrpc_server extends IXR_Server { } /** - * Filter whether to preempt the XML-RPC media upload. + * Filters whether to preempt the XML-RPC media upload. * * Passing a truthy value will effectively short-circuit the media upload, * returning that value as a 500 error instead. @@ -5773,8 +5837,9 @@ class wp_xmlrpc_server extends IXR_Server { $upload = wp_upload_bits($name, null, $bits); if ( ! empty($upload['error']) ) { - $errorString = sprintf(__('Could not write file %1$s (%2$s)'), $name, $upload['error']); - return new IXR_Error(500, $errorString); + /* translators: 1: file name, 2: error message */ + $errorString = sprintf( __( 'Could not write file %1$s (%2$s).' ), $name, $upload['error'] ); + return new IXR_Error( 500, $errorString ); } // Construct the attachment array $post_id = 0; @@ -5782,7 +5847,7 @@ class wp_xmlrpc_server extends IXR_Server { $post_id = (int) $data['post_id']; if ( ! current_user_can( 'edit_post', $post_id ) ) - return new IXR_Error( 401, __( 'Sorry, you cannot edit this post.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) ); } $attachment = array( 'post_title' => $name, @@ -5953,7 +6018,7 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error( 404, __( 'Invalid post ID.' ) ); if ( !current_user_can( 'edit_post', $post_ID ) ) - return new IXR_Error( 401, __( 'Sorry, you can not edit this post.' ) ); + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) ); /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'mt.getPostCategories' ); @@ -6007,7 +6072,7 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error( 404, __( 'Invalid post ID.' ) ); if ( !current_user_can('edit_post', $post_ID) ) - return new IXR_Error(401, __('Sorry, you cannot edit this post.')); + return new IXR_Error(401, __('Sorry, you are not allowed to edit this post.')); $catids = array(); foreach ( $categories as $cat ) { @@ -6043,7 +6108,7 @@ class wp_xmlrpc_server extends IXR_Server { do_action( 'xmlrpc_call', 'mt.supportedTextFilters' ); /** - * Filter the MoveableType text filters list for XML-RPC. + * Filters the MoveableType text filters list for XML-RPC. * * @since 2.2.0 * @@ -6126,7 +6191,7 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error( 404, __( 'Invalid post ID.' ) ); if ( !current_user_can('publish_posts') || !current_user_can('edit_post', $post_ID) ) - return new IXR_Error(401, __('Sorry, you cannot publish this post.')); + return new IXR_Error(401, __('Sorry, you are not allowed to publish this post.')); $postdata['post_status'] = 'publish'; @@ -6147,9 +6212,6 @@ class wp_xmlrpc_server extends IXR_Server { * * @since 1.5.0 * - * @global wpdb $wpdb WordPress database abstraction object. - * @global string $wp_version - * * @param array $args { * Method arguments. Note: arguments must be ordered as documented. * @@ -6159,7 +6221,7 @@ class wp_xmlrpc_server extends IXR_Server { * @return string|IXR_Error */ public function pingback_ping( $args ) { - global $wpdb, $wp_version; + global $wpdb; /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'pingback.ping' ); @@ -6171,7 +6233,7 @@ class wp_xmlrpc_server extends IXR_Server { $pagelinkedto = str_replace( '&', '&', $pagelinkedto ); /** - * Filter the pingback source URI. + * Filters the pingback source URI. * * @since 3.6.0 * @@ -6247,7 +6309,7 @@ class wp_xmlrpc_server extends IXR_Server { $remote_ip = preg_replace( '/[^0-9a-fA-F:., ]/', '', $_SERVER['REMOTE_ADDR'] ); /** This filter is documented in wp-includes/class-http.php */ - $user_agent = apply_filters( 'http_headers_useragent', 'WordPress/' . $wp_version . '; ' . get_bloginfo( 'url' ) ); + $user_agent = apply_filters( 'http_headers_useragent', 'WordPress/' . get_bloginfo( 'version' ) . '; ' . get_bloginfo( 'url' ) ); // Let's check the remote site $http_api_args = array( @@ -6259,35 +6321,38 @@ class wp_xmlrpc_server extends IXR_Server { 'X-Pingback-Forwarded-For' => $remote_ip, ), ); + $request = wp_safe_remote_get( $pagelinkedfrom, $http_api_args ); - $linea = wp_remote_retrieve_body( $request ); + $remote_source = $remote_source_original = wp_remote_retrieve_body( $request ); - if ( !$linea ) + if ( ! $remote_source ) { return $this->pingback_error( 16, __( 'The source URL does not exist.' ) ); + } /** - * Filter the pingback remote source. + * Filters the pingback remote source. * * @since 2.5.0 * - * @param string $linea Response object for the page linked from. - * @param string $pagelinkedto URL of the page linked to. + * @param string $remote_source Response source for the page linked from. + * @param string $pagelinkedto URL of the page linked to. */ - $linea = apply_filters( 'pre_remote_source', $linea, $pagelinkedto ); + $remote_source = apply_filters( 'pre_remote_source', $remote_source, $pagelinkedto ); // Work around bug in strip_tags(): - $linea = str_replace(']*>/", "\n\n", $linea ); + $remote_source = str_replace( ']*>/", "\n\n", $remote_source ); - preg_match('|([^<]*?)|is', $linea, $matchtitle); - $title = $matchtitle[1]; - if ( empty( $title ) ) - return $this->pingback_error( 32, __('We cannot find a title on that page.' ) ); + preg_match( '|([^<]*?)|is', $remote_source, $matchtitle ); + $title = isset( $matchtitle[1] ) ? $matchtitle[1] : ''; + if ( empty( $title ) ) { + return $this->pingback_error( 32, __( 'We cannot find a title on that page.' ) ); + } - $linea = strip_tags( $linea, '' ); // just keep the tag we need + $remote_source = strip_tags( $remote_source, '' ); // just keep the tag we need - $p = explode( "\n\n", $linea ); + $p = explode( "\n\n", $remote_source ); $preg_target = preg_quote($pagelinkedto, '|'); @@ -6335,7 +6400,10 @@ class wp_xmlrpc_server extends IXR_Server { $this->escape($comment_content); $comment_type = 'pingback'; - $commentdata = compact('comment_post_ID', 'comment_author', 'comment_author_url', 'comment_author_email', 'comment_content', 'comment_type'); + $commentdata = compact( + 'comment_post_ID', 'comment_author', 'comment_author_url', 'comment_author_email', + 'comment_content', 'comment_type', 'remote_source', 'remote_source_original' + ); $comment_ID = wp_new_comment($commentdata); @@ -6348,7 +6416,8 @@ class wp_xmlrpc_server extends IXR_Server { */ do_action( 'pingback_post', $comment_ID ); - return sprintf(__('Pingback from %1$s to %2$s registered. Keep the web talking! :-)'), $pagelinkedfrom, $pagelinkedto); + /* translators: 1: URL of the page linked from, 2: URL of the page linked to */ + return sprintf( __( 'Pingback from %1$s to %2$s registered. Keep the web talking! :-)' ), $pagelinkedfrom, $pagelinkedto ); } /** @@ -6399,13 +6468,17 @@ class wp_xmlrpc_server extends IXR_Server { } /** - * @param integer $code - * @param string $message - * @return IXR_Error + * Sends a pingback error based on the given error code and message. + * + * @since 3.6.0 + * + * @param int $code Error code. + * @param string $message Error message. + * @return IXR_Error Error object. */ protected function pingback_error( $code, $message ) { /** - * Filter the XML-RPC pingback error return. + * Filters the XML-RPC pingback error return. * * @since 3.5.1 *