X-Git-Url: https://scripts.mit.edu/gitweb/autoinstalls/wordpress.git/blobdiff_plain/8f374b7233bc2815ccc387e448d208c5434eb961..refs/tags/wordpress-3.7:/wp-includes/class-wp-xmlrpc-server.php diff --git a/wp-includes/class-wp-xmlrpc-server.php b/wp-includes/class-wp-xmlrpc-server.php index 7334a85d..d3ebdb8b 100644 --- a/wp-includes/class-wp-xmlrpc-server.php +++ b/wp-includes/class-wp-xmlrpc-server.php @@ -12,8 +12,8 @@ * pingback. Additional WordPress API for managing comments, pages, posts, * options, etc. * - * Since WordPress 2.6.0, WordPress XMLRPC server can be disabled in the - * administration panels. + * As of WordPress 3.5.0, XML-RPC is enabled by default. It can be disabled + * via the xmlrpc_enabled filter found in wp_xmlrpc_server::login(). * * @package WordPress * @subpackage Publishing @@ -48,6 +48,10 @@ class wp_xmlrpc_server extends IXR_Server { 'wp.getTerms' => 'this:wp_getTerms', 'wp.getTaxonomy' => 'this:wp_getTaxonomy', 'wp.getTaxonomies' => 'this:wp_getTaxonomies', + 'wp.getUser' => 'this:wp_getUser', + 'wp.getUsers' => 'this:wp_getUsers', + 'wp.getProfile' => 'this:wp_getProfile', + 'wp.editProfile' => 'this:wp_editProfile', 'wp.getPage' => 'this:wp_getPage', 'wp.getPages' => 'this:wp_getPages', 'wp.newPage' => 'this:wp_newPage', @@ -78,14 +82,14 @@ class wp_xmlrpc_server extends IXR_Server { 'wp.getPostFormats' => 'this:wp_getPostFormats', 'wp.getPostType' => 'this:wp_getPostType', 'wp.getPostTypes' => 'this:wp_getPostTypes', + 'wp.getRevisions' => 'this:wp_getRevisions', + 'wp.restoreRevision' => 'this:wp_restoreRevision', // Blogger API 'blogger.getUsersBlogs' => 'this:blogger_getUsersBlogs', 'blogger.getUserInfo' => 'this:blogger_getUserInfo', 'blogger.getPost' => 'this:blogger_getPost', 'blogger.getRecentPosts' => 'this:blogger_getRecentPosts', - 'blogger.getTemplate' => 'this:blogger_getTemplate', - 'blogger.setTemplate' => 'this:blogger_setTemplate', 'blogger.newPost' => 'this:blogger_newPost', 'blogger.editPost' => 'this:blogger_editPost', 'blogger.deletePost' => 'this:blogger_deletePost', @@ -101,8 +105,6 @@ class wp_xmlrpc_server extends IXR_Server { // MetaWeblog API aliases for Blogger API // see http://www.xmlrpc.com/stories/storyReader$2460 'metaWeblog.deletePost' => 'this:blogger_deletePost', - 'metaWeblog.getTemplate' => 'this:blogger_getTemplate', - 'metaWeblog.setTemplate' => 'this:blogger_setTemplate', 'metaWeblog.getUsersBlogs' => 'this:blogger_getUsersBlogs', // MovableType API @@ -157,49 +159,34 @@ class wp_xmlrpc_server extends IXR_Server { return $number1 + $number2; } - /** - * Check user's credentials. - * - * @since 1.5.0 - * - * @param string $user_login User's username. - * @param string $user_pass User's password. - * @return bool Whether authentication passed. - * @deprecated use wp_xmlrpc_server::login - * @see wp_xmlrpc_server::login - */ - function login_pass_ok($user_login, $user_pass) { - if ( !get_option( 'enable_xmlrpc' ) ) { - $this->error = new IXR_Error( 405, sprintf( __( 'XML-RPC services are disabled on this site. An admin user can enable them at %s'), admin_url('options-writing.php') ) ); - return false; - } - - if (!user_pass_ok($user_login, $user_pass)) { - $this->error = new IXR_Error(403, __('Bad login/pass combination.')); - return false; - } - return true; - } - /** * Log user in. * - * @since 2.8 + * @since 2.8.0 * * @param string $username User's username. * @param string $password User's password. * @return mixed WP_User object if authentication passed, false otherwise */ - function login($username, $password) { - if ( !get_option( 'enable_xmlrpc' ) ) { - $this->error = new IXR_Error( 405, sprintf( __( 'XML-RPC services are disabled on this site. An admin user can enable them at %s'), admin_url('options-writing.php') ) ); + function login( $username, $password ) { + // Respect any old filters against get_option() for 'enable_xmlrpc'. + $enabled = apply_filters( 'pre_option_enable_xmlrpc', false ); // Deprecated + if ( false === $enabled ) + $enabled = apply_filters( 'option_enable_xmlrpc', true ); // Deprecated + + // Proper filter for turning off XML-RPC. It is on by default. + $enabled = apply_filters( 'xmlrpc_enabled', $enabled ); + + if ( ! $enabled ) { + $this->error = new IXR_Error( 405, sprintf( __( 'XML-RPC services are disabled on this site.' ) ) ); return false; } $user = wp_authenticate($username, $password); if (is_wp_error($user)) { - $this->error = new IXR_Error(403, __('Bad login/pass combination.')); + $this->error = new IXR_Error( 403, __( 'Incorrect username or password.' ) ); + $this->error = apply_filters( 'xmlrpc_login_error', $this->error, $user ); return false; } @@ -208,28 +195,38 @@ class wp_xmlrpc_server extends IXR_Server { } /** - * Sanitize string or array of strings for database. + * Check user's credentials. Deprecated. * - * @since 1.5.2 + * @since 1.5.0 + * @deprecated 2.8.0 + * @deprecated use wp_xmlrpc_server::login + * @see wp_xmlrpc_server::login * - * @param string|array $array Sanitize single string or array of strings. - * @return string|array Type matches $array and sanitized for the database. + * @param string $username User's username. + * @param string $password User's password. + * @return bool Whether authentication passed. */ - function escape(&$array) { - global $wpdb; + function login_pass_ok( $username, $password ) { + return (bool) $this->login( $username, $password ); + } - if (!is_array($array)) { - return($wpdb->escape($array)); - } else { - foreach ( (array) $array as $k => $v ) { - if ( is_array($v) ) { - $this->escape($array[$k]); - } else if ( is_object($v) ) { - //skip - } else { - $array[$k] = $wpdb->escape($v); - } - } + /** + * Escape string or array of strings for database. + * + * @since 1.5.2 + * + * @param string|array $data Escape single string or array of strings. + * @return string|array Type matches $data and sanitized for the database. + */ + function escape( &$data ) { + if ( ! is_array( $data ) ) + return wp_slash( $data ); + + foreach ( $data as &$v ) { + if ( is_array( $v ) ) + $this->escape( $v ); + elseif ( ! is_object( $v ) ) + $v = wp_slash( $v ); } } @@ -277,16 +274,16 @@ class wp_xmlrpc_server extends IXR_Server { $meta['id'] = (int) $meta['id']; $pmeta = get_metadata_by_mid( 'post', $meta['id'] ); if ( isset($meta['key']) ) { - $meta['key'] = stripslashes( $meta['key'] ); - if ( $meta['key'] != $pmeta->meta_key ) + $meta['key'] = wp_unslash( $meta['key'] ); + if ( $meta['key'] !== $pmeta->meta_key ) continue; - $meta['value'] = stripslashes_deep( $meta['value'] ); + $meta['value'] = wp_unslash( $meta['value'] ); if ( current_user_can( 'edit_post_meta', $post_id, $meta['key'] ) ) update_metadata_by_mid( 'post', $meta['id'], $meta['value'] ); } elseif ( current_user_can( 'delete_post_meta', $post_id, $pmeta->meta_key ) ) { delete_metadata_by_mid( 'post', $meta['id'] ); } - } elseif ( current_user_can( 'add_post_meta', $post_id, stripslashes( $meta['key'] ) ) ) { + } elseif ( current_user_can( 'add_post_meta', $post_id, wp_unslash( $meta['key'] ) ) ) { add_post_meta( $post_id, $meta['key'], $meta['value'] ); } } @@ -315,10 +312,25 @@ class wp_xmlrpc_server extends IXR_Server { 'value' => $wp_version ), 'blog_url' => array( - 'desc' => __( 'Site URL' ), + 'desc' => __( 'WordPress Address (URL)' ), 'readonly' => true, 'option' => 'siteurl' ), + 'home_url' => array( + 'desc' => __( 'Site Address (URL)' ), + 'readonly' => true, + 'option' => 'home' + ), + 'login_url' => array( + 'desc' => __( 'Login Address (URL)' ), + 'readonly' => true, + 'value' => wp_login_url( ) + ), + 'admin_url' => array( + 'desc' => __( 'The URL to the admin area' ), + 'readonly' => true, + 'value' => get_admin_url( ) + ), 'image_default_link_type' => array( 'desc' => __( 'Image default link type' ), 'readonly' => true, @@ -473,15 +485,17 @@ class wp_xmlrpc_server extends IXR_Server { continue; $blog_id = $blog->userblog_id; - switch_to_blog($blog_id); - $is_admin = current_user_can('manage_options'); + + switch_to_blog( $blog_id ); + + $is_admin = current_user_can( 'manage_options' ); $struct[] = array( 'isAdmin' => $is_admin, - 'url' => get_option( 'home' ) . '/', + 'url' => home_url( '/' ), 'blogid' => (string) $blog_id, 'blogName' => get_option( 'blogname' ), - 'xmlrpc' => site_url( 'xmlrpc.php' ) + 'xmlrpc' => site_url( 'xmlrpc.php', 'rpc' ), ); restore_current_blog(); @@ -533,6 +547,9 @@ class wp_xmlrpc_server extends IXR_Server { if ( in_array( 'cap', $fields ) ) $_taxonomy['cap'] = (array) $taxonomy->cap; + if ( in_array( 'menu', $fields ) ) + $_taxonomy['show_in_menu'] = (bool) $_taxonomy->show_in_menu; + if ( in_array( 'object_type', $fields ) ) $_taxonomy['object_type'] = array_unique( (array) $taxonomy->object_type ); @@ -552,13 +569,13 @@ class wp_xmlrpc_server extends IXR_Server { if ( ! is_array( $_term) ) $_term = get_object_vars( $_term ); - // For Intergers which may be largeer than XMLRPC supports ensure we return strings. + // For integers which may be larger than XML-RPC supports ensure we return strings. $_term['term_id'] = strval( $_term['term_id'] ); $_term['term_group'] = strval( $_term['term_group'] ); $_term['term_taxonomy_id'] = strval( $_term['term_taxonomy_id'] ); $_term['parent'] = strval( $_term['parent'] ); - // Count we are happy to return as an Integer because people really shouldn't use Terms that much. + // Count we are happy to return as an integer because people really shouldn't use terms that much. $_term['count'] = intval( $_term['count'] ); return apply_filters( 'xmlrpc_prepare_term', $_term, $term ); @@ -622,7 +639,11 @@ class wp_xmlrpc_server extends IXR_Server { 'post_password' => $post['post_password'], 'post_excerpt' => $post['post_excerpt'], 'post_content' => $post['post_content'], + 'post_parent' => strval( $post['post_parent'] ), + 'post_mime_type' => $post['post_mime_type'], 'link' => post_permalink( $post['ID'] ), + 'guid' => $post['guid'], + 'menu_order' => intval( $post['menu_order'] ), 'comment_status' => $post['comment_status'], 'ping_status' => $post['ping_status'], 'sticky' => ( $post['post_type'] === 'post' && is_sticky( $post['ID'] ) ), @@ -769,7 +790,7 @@ class wp_xmlrpc_server extends IXR_Server { // Get info the page parent if there is one. $parent_title = ""; if ( ! empty( $page->post_parent ) ) { - $parent = get_page( $page->post_parent ); + $parent = get_post( $page->post_parent ); $parent_title = $parent->post_title; } @@ -866,6 +887,46 @@ class wp_xmlrpc_server extends IXR_Server { return apply_filters( 'xmlrpc_prepare_comment', $_comment, $comment ); } + /** + * Prepares user data for return in an XML-RPC object. + * + * @access protected + * + * @param WP_User $user The unprepared user object + * @param array $fields The subset of user fields to return + * @return array The prepared user data + */ + protected function _prepare_user( $user, $fields ) { + $_user = array( 'user_id' => strval( $user->ID ) ); + + $user_fields = array( + 'username' => $user->user_login, + 'first_name' => $user->user_firstname, + 'last_name' => $user->user_lastname, + 'registered' => $this->_convert_date( $user->user_registered ), + 'bio' => $user->user_description, + 'email' => $user->user_email, + 'nickname' => $user->nickname, + 'nicename' => $user->user_nicename, + 'url' => $user->user_url, + 'display_name' => $user->display_name, + 'roles' => $user->roles, + ); + + if ( in_array( 'all', $fields ) ) { + $_user = array_merge( $_user, $user_fields ); + } else { + if ( in_array( 'basic', $fields ) ) { + $basic_fields = array( 'username', 'email', 'registered', 'display_name', 'nicename' ); + $fields = array_merge( $fields, $basic_fields ); + } + $requested_fields = array_intersect_key( $user_fields, array_flip( $fields ) ); + $_user = array_merge( $_user, $requested_fields ); + } + + return apply_filters( 'xmlrpc_prepare_user', $_user, $user, $fields ); + } + /** * Create a new post for any registered post type. * @@ -881,7 +942,7 @@ class wp_xmlrpc_server extends IXR_Server { * - post_status (default: 'draft') * - post_title * - post_author - * - post_exerpt + * - post_excerpt * - post_content * - post_date_gmt | post_date * - post_format @@ -953,12 +1014,12 @@ class wp_xmlrpc_server extends IXR_Server { if ( $update ) { if ( ! get_post( $post_data['ID'] ) ) return new IXR_Error( 401, __( 'Invalid post ID.' ) ); - if ( ! current_user_can( $post_type->cap->edit_post, $post_data['ID'] ) ) + if ( ! current_user_can( 'edit_post', $post_data['ID'] ) ) return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) ); if ( $post_data['post_type'] != get_post_type( $post_data['ID'] ) ) return new IXR_Error( 401, __( 'The post type may not be changed.' ) ); } else { - if ( ! current_user_can( $post_type->cap->edit_posts ) ) + if ( ! current_user_can( $post_type->cap->create_posts ) || ! current_user_can( $post_type->cap->edit_posts ) ) return new IXR_Error( 401, __( 'Sorry, you are not allowed to post on this site.' ) ); } @@ -976,7 +1037,8 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish posts in this post type' ) ); break; default: - $post_data['post_status'] = 'draft'; + if ( ! get_post_status_object( $post_data['post_status'] ) ) + $post_data['post_status'] = 'draft'; break; } @@ -1041,8 +1103,9 @@ class wp_xmlrpc_server extends IXR_Server { // empty value deletes, non-empty value adds/updates if ( ! $post_data['post_thumbnail'] ) delete_post_thumbnail( $post_ID ); - elseif ( ! set_post_thumbnail( $post_ID, $post_data['post_thumbnail'] ) ) - return new IXR_Error( 404, __( 'Invalid attachment ID.' ) ); + elseif ( ! get_post( absint( $post_data['post_thumbnail'] ) ) ) + return new IXR_Error( 404, __( 'Invalid attachment ID.' ) ); + set_post_thumbnail( $post_ID, $post_data['post_thumbnail'] ); unset( $content_struct['post_thumbnail'] ); } @@ -1153,7 +1216,7 @@ class wp_xmlrpc_server extends IXR_Server { $post_data = apply_filters( 'xmlrpc_wp_insert_post_data', $post_data, $content_struct ); - $post_ID = wp_insert_post( $post_data, true ); + $post_ID = $update ? wp_update_post( $post_data, true ) : wp_insert_post( $post_data, true ); if ( is_wp_error( $post_ID ) ) return new IXR_Error( 500, $post_ID->get_error_message() ); @@ -1201,6 +1264,13 @@ class wp_xmlrpc_server extends IXR_Server { if ( empty( $post['ID'] ) ) return new IXR_Error( 404, __( 'Invalid post ID.' ) ); + if ( isset( $content_struct['if_not_modified_since'] ) ) { + // If the post has been modified since the date provided, return an error. + if ( mysql2date( 'U', $post['post_modified_gmt'] ) > $content_struct['if_not_modified_since']->getTimestamp() ) { + return new IXR_Error( 409, __( 'There is a revision of this post that is more recent.' ) ); + } + } + // convert the date field back to IXR form $post['post_date'] = $this->_convert_date( $post['post_date'] ); @@ -1250,12 +1320,11 @@ class wp_xmlrpc_server extends IXR_Server { do_action( 'xmlrpc_call', 'wp.deletePost' ); - $post = wp_get_single_post( $post_id, ARRAY_A ); + $post = get_post( $post_id, ARRAY_A ); if ( empty( $post['ID'] ) ) return new IXR_Error( 404, __( 'Invalid post ID.' ) ); - $post_type = get_post_type_object( $post['post_type'] ); - if ( ! current_user_can( $post_type->cap->delete_post, $post_id ) ) + if ( ! current_user_can( 'delete_post', $post_id ) ) return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this post.' ) ); $result = wp_delete_post( $post_id ); @@ -1280,7 +1349,7 @@ class wp_xmlrpc_server extends IXR_Server { * groups are 'post' (all basic fields), 'taxonomies', 'custom_fields', * and 'enclosure'. * - * @uses wp_get_single_post() + * @uses get_post() * @param array $args Method parameters. Contains: * - int $post_id * - string $username @@ -1331,13 +1400,12 @@ class wp_xmlrpc_server extends IXR_Server { do_action( 'xmlrpc_call', 'wp.getPost' ); - $post = wp_get_single_post( $post_id, ARRAY_A ); + $post = get_post( $post_id, ARRAY_A ); if ( empty( $post['ID'] ) ) return new IXR_Error( 404, __( 'Invalid post ID.' ) ); - $post_type = get_post_type_object( $post['post_type'] ); - if ( ! current_user_can( $post_type->cap->edit_posts, $post_id ) ) + if ( ! current_user_can( 'edit_post', $post_id ) ) return new IXR_Error( 401, __( 'Sorry, you cannot edit this post.' ) ); return $this->_prepare_post( $post, $fields ); @@ -1394,12 +1462,14 @@ class wp_xmlrpc_server extends IXR_Server { $post_type = get_post_type_object( $filter['post_type'] ); if ( ! ( (bool) $post_type ) ) return new IXR_Error( 403, __( 'The post type specified is not valid' ) ); + } else { + $post_type = get_post_type_object( 'post' ); + } - if ( ! current_user_can( $post_type->cap->edit_posts ) ) - return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts in this post type' )); + if ( ! current_user_can( $post_type->cap->edit_posts ) ) + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts in this post type' )); - $query['post_type'] = $filter['post_type']; - } + $query['post_type'] = $post_type->name; if ( isset( $filter['post_status'] ) ) $query['post_status'] = $filter['post_status']; @@ -1417,6 +1487,10 @@ class wp_xmlrpc_server extends IXR_Server { $query['order'] = $filter['order']; } + if ( isset( $filter['s'] ) ) { + $query['s'] = $filter['s']; + } + $posts_list = wp_get_recent_posts( $query ); if ( ! $posts_list ) @@ -1426,8 +1500,7 @@ class wp_xmlrpc_server extends IXR_Server { $struct = array(); foreach ( $posts_list as $post ) { - $post_type = get_post_type_object( $post['post_type'] ); - if ( ! current_user_can( $post_type->cap->edit_posts, $post['ID'] ) ) + if ( ! current_user_can( 'edit_post', $post['ID'] ) ) continue; $struct[] = $this->_prepare_post( $post, $fields ); @@ -1911,6 +1984,262 @@ class wp_xmlrpc_server extends IXR_Server { return $struct; } + /** + * Retrieve a user. + * + * The optional $fields parameter specifies what fields will be included + * in the response array. This should be a list of field names. 'user_id' will + * always be included in the response regardless of the value of $fields. + * + * Instead of, or in addition to, individual field names, conceptual group + * names can be used to specify multiple fields. The available conceptual + * groups are 'basic' and 'all'. + * + * @uses get_userdata() + * @param array $args Method parameters. Contains: + * - int $blog_id + * - string $username + * - string $password + * - int $user_id + * - array $fields optional + * @return array contains (based on $fields parameter): + * - 'user_id' + * - 'username' + * - 'first_name' + * - 'last_name' + * - 'registered' + * - 'bio' + * - 'email' + * - 'nickname' + * - 'nicename' + * - 'url' + * - 'display_name' + * - 'roles' + */ + function wp_getUser( $args ) { + if ( ! $this->minimum_args( $args, 4 ) ) + return $this->error; + + $this->escape( $args ); + + $blog_id = (int) $args[0]; + $username = $args[1]; + $password = $args[2]; + $user_id = (int) $args[3]; + + if ( isset( $args[4] ) ) + $fields = $args[4]; + else + $fields = apply_filters( 'xmlrpc_default_user_fields', array( 'all' ), 'wp.getUser' ); + + if ( ! $user = $this->login( $username, $password ) ) + return $this->error; + + do_action( 'xmlrpc_call', 'wp.getUser' ); + + if ( ! current_user_can( 'edit_user', $user_id ) ) + return new IXR_Error( 401, __( 'Sorry, you cannot edit users.' ) ); + + $user_data = get_userdata( $user_id ); + + if ( ! $user_data ) + return new IXR_Error( 404, __( 'Invalid user ID' ) ); + + return $this->_prepare_user( $user_data, $fields ); + } + + /** + * Retrieve users. + * + * The optional $filter parameter modifies the query used to retrieve users. + * Accepted keys are 'number' (default: 50), 'offset' (default: 0), 'role', + * 'who', 'orderby', and 'order'. + * + * The optional $fields parameter specifies what fields will be included + * in the response array. + * + * @uses get_users() + * @see wp_getUser() for more on $fields and return values + * + * @param array $args Method parameters. Contains: + * - int $blog_id + * - string $username + * - string $password + * - array $filter optional + * - array $fields optional + * @return array users data + */ + function wp_getUsers( $args ) { + if ( ! $this->minimum_args( $args, 3 ) ) + return $this->error; + + $this->escape( $args ); + + $blog_id = (int) $args[0]; + $username = $args[1]; + $password = $args[2]; + $filter = isset( $args[3] ) ? $args[3] : array(); + + if ( isset( $args[4] ) ) + $fields = $args[4]; + else + $fields = apply_filters( 'xmlrpc_default_user_fields', array( 'all' ), 'wp.getUsers' ); + + if ( ! $user = $this->login( $username, $password ) ) + return $this->error; + + do_action( 'xmlrpc_call', 'wp.getUsers' ); + + if ( ! current_user_can( 'list_users' ) ) + return new IXR_Error( 401, __( 'Sorry, you cannot list users.' ) ); + + $query = array( 'fields' => 'all_with_meta' ); + + $query['number'] = ( isset( $filter['number'] ) ) ? absint( $filter['number'] ) : 50; + $query['offset'] = ( isset( $filter['offset'] ) ) ? absint( $filter['offset'] ) : 0; + + if ( isset( $filter['orderby'] ) ) { + $query['orderby'] = $filter['orderby']; + + if ( isset( $filter['order'] ) ) + $query['order'] = $filter['order']; + } + + if ( isset( $filter['role'] ) ) { + if ( get_role( $filter['role'] ) === null ) + return new IXR_Error( 403, __( 'The role specified is not valid' ) ); + + $query['role'] = $filter['role']; + } + + if ( isset( $filter['who'] ) ) { + $query['who'] = $filter['who']; + } + + $users = get_users( $query ); + + $_users = array(); + foreach ( $users as $user_data ) { + if ( current_user_can( 'edit_user', $user_data->ID ) ) + $_users[] = $this->_prepare_user( $user_data, $fields ); + } + return $_users; + } + + /** + * Retrieve information about the requesting user. + * + * @uses get_userdata() + * @param array $args Method parameters. Contains: + * - int $blog_id + * - string $username + * - string $password + * - array $fields optional + * @return array (@see wp_getUser) + */ + function wp_getProfile( $args ) { + if ( ! $this->minimum_args( $args, 3 ) ) + return $this->error; + + $this->escape( $args ); + + $blog_id = (int) $args[0]; + $username = $args[1]; + $password = $args[2]; + + if ( isset( $args[3] ) ) + $fields = $args[3]; + else + $fields = apply_filters( 'xmlrpc_default_user_fields', array( 'all' ), 'wp.getProfile' ); + + if ( ! $user = $this->login( $username, $password ) ) + return $this->error; + + do_action( 'xmlrpc_call', 'wp.getProfile' ); + + if ( ! current_user_can( 'edit_user', $user->ID ) ) + return new IXR_Error( 401, __( 'Sorry, you cannot edit your profile.' ) ); + + $user_data = get_userdata( $user->ID ); + + return $this->_prepare_user( $user_data, $fields ); + } + + /** + * Edit user's profile. + * + * @uses wp_update_user() + * @param array $args Method parameters. Contains: + * - int $blog_id + * - string $username + * - string $password + * - array $content_struct + * It can optionally contain: + * - 'first_name' + * - 'last_name' + * - 'website' + * - 'display_name' + * - 'nickname' + * - 'nicename' + * - 'bio' + * @return bool True, on success. + */ + function wp_editProfile( $args ) { + if ( ! $this->minimum_args( $args, 4 ) ) + return $this->error; + + $this->escape( $args ); + + $blog_id = (int) $args[0]; + $username = $args[1]; + $password = $args[2]; + $content_struct = $args[3]; + + if ( ! $user = $this->login( $username, $password ) ) + return $this->error; + + do_action( 'xmlrpc_call', 'wp.editProfile' ); + + if ( ! current_user_can( 'edit_user', $user->ID ) ) + return new IXR_Error( 401, __( 'Sorry, you cannot edit your profile.' ) ); + + // holds data of the user + $user_data = array(); + $user_data['ID'] = $user->ID; + + // only set the user details if it was given + if ( isset( $content_struct['first_name'] ) ) + $user_data['first_name'] = $content_struct['first_name']; + + if ( isset( $content_struct['last_name'] ) ) + $user_data['last_name'] = $content_struct['last_name']; + + if ( isset( $content_struct['url'] ) ) + $user_data['user_url'] = $content_struct['url']; + + if ( isset( $content_struct['display_name'] ) ) + $user_data['display_name'] = $content_struct['display_name']; + + if ( isset( $content_struct['nickname'] ) ) + $user_data['nickname'] = $content_struct['nickname']; + + if ( isset( $content_struct['nicename'] ) ) + $user_data['user_nicename'] = $content_struct['nicename']; + + if ( isset( $content_struct['bio'] ) ) + $user_data['description'] = $content_struct['bio']; + + $result = wp_update_user( $user_data ); + + if ( is_wp_error( $result ) ) + return new IXR_Error( 500, $result->get_error_message() ); + + if ( ! $result ) + return new IXR_Error( 500, __( 'Sorry, the user cannot be updated.' ) ); + + return true; + } + /** * Retrieve page. * @@ -1935,7 +2264,7 @@ class wp_xmlrpc_server extends IXR_Server { return $this->error; } - $page = get_page($page_id); + $page = get_post($page_id); if ( ! $page ) return new IXR_Error( 404, __( 'Invalid post ID.' ) ); @@ -2052,7 +2381,7 @@ class wp_xmlrpc_server extends IXR_Server { // Get the current page based on the page_id and // make sure it is a page and not a post. - $actual_page = wp_get_single_post($page_id, ARRAY_A); + $actual_page = get_post($page_id, ARRAY_A); if ( !$actual_page || ($actual_page['post_type'] != 'page') ) return(new IXR_Error(404, __('Sorry, no such page.'))); @@ -2093,7 +2422,7 @@ class wp_xmlrpc_server extends IXR_Server { do_action('xmlrpc_call', 'wp.editPage'); // Get the page data and make sure it is a page. - $actual_page = wp_get_single_post($page_id, ARRAY_A); + $actual_page = get_post($page_id, ARRAY_A); if ( !$actual_page || ($actual_page['post_type'] != 'page') ) return(new IXR_Error(404, __('Sorry, no such page.'))); @@ -2653,9 +2982,9 @@ class wp_xmlrpc_server extends IXR_Server { $comment['comment_post_ID'] = $post_id; if ( $logged_in ) { - $comment['comment_author'] = $wpdb->escape( $user->display_name ); - $comment['comment_author_email'] = $wpdb->escape( $user->user_email ); - $comment['comment_author_url'] = $wpdb->escape( $user->user_url ); + $comment['comment_author'] = $this->escape( $user->display_name ); + $comment['comment_author_email'] = $this->escape( $user->user_email ); + $comment['comment_author_url'] = $this->escape( $user->user_url ); $comment['user_ID'] = $user->ID; } else { $comment['comment_author'] = ''; @@ -2867,6 +3196,7 @@ class wp_xmlrpc_server extends IXR_Server { */ function _getOptions($options) { $data = array(); + $can_manage = current_user_can( 'manage_options' ); foreach ( $options as $option ) { if ( array_key_exists( $option, $this->blog_options ) ) { $data[$option] = $this->blog_options[$option]; @@ -2875,6 +3205,9 @@ class wp_xmlrpc_server extends IXR_Server { $data[$option]['value'] = get_option( $data[$option]['option'] ); unset($data[$option]['option']); } + + if ( ! $can_manage ) + $data[$option]['readonly'] = true; } } @@ -3163,6 +3496,128 @@ class wp_xmlrpc_server extends IXR_Server { return $struct; } + /** + * Retrieve revisions for a specific post. + * + * @since 3.5.0 + * + * The optional $fields parameter specifies what fields will be included + * in the response array. + * + * @uses wp_get_post_revisions() + * @see wp_getPost() for more on $fields + * + * @param array $args Method parameters. Contains: + * - int $blog_id + * - string $username + * - string $password + * - int $post_id + * - array $fields + * @return array contains a collection of posts. + */ + function wp_getRevisions( $args ) { + if ( ! $this->minimum_args( $args, 4 ) ) + return $this->error; + + $this->escape( $args ); + + $blog_id = (int) $args[0]; + $username = $args[1]; + $password = $args[2]; + $post_id = (int) $args[3]; + + if ( isset( $args[4] ) ) + $fields = $args[4]; + else + $fields = apply_filters( 'xmlrpc_default_revision_fields', array( 'post_date', 'post_date_gmt' ), 'wp.getRevisions' ); + + if ( ! $user = $this->login( $username, $password ) ) + return $this->error; + + do_action( 'xmlrpc_call', 'wp.getRevisions' ); + + if ( ! $post = get_post( $post_id ) ) + return new IXR_Error( 404, __( 'Invalid post ID' ) ); + + if ( ! current_user_can( 'edit_post', $post_id ) ) + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts.' ) ); + + // Check if revisions are enabled. + if ( ! wp_revisions_enabled( $post ) ) + return new IXR_Error( 401, __( 'Sorry, revisions are disabled.' ) ); + + $revisions = wp_get_post_revisions( $post_id ); + + if ( ! $revisions ) + return array(); + + $struct = array(); + + foreach ( $revisions as $revision ) { + if ( ! current_user_can( 'read_post', $revision->ID ) ) + continue; + + // Skip autosaves + if ( wp_is_post_autosave( $revision ) ) + continue; + + $struct[] = $this->_prepare_post( get_object_vars( $revision ), $fields ); + } + + return $struct; + } + + /** + * Restore a post revision + * + * @since 3.5.0 + * + * @uses wp_restore_post_revision() + * + * @param array $args Method parameters. Contains: + * - int $blog_id + * - string $username + * - string $password + * - int $post_id + * @return bool false if there was an error restoring, true if success. + */ + function wp_restoreRevision( $args ) { + if ( ! $this->minimum_args( $args, 3 ) ) + return $this->error; + + $this->escape( $args ); + + $blog_id = (int) $args[0]; + $username = $args[1]; + $password = $args[2]; + $revision_id = (int) $args[3]; + + if ( ! $user = $this->login( $username, $password ) ) + return $this->error; + + do_action( 'xmlrpc_call', 'wp.restoreRevision' ); + + if ( ! $revision = wp_get_post_revision( $revision_id ) ) + return new IXR_Error( 404, __( 'Invalid post ID' ) ); + + if ( wp_is_post_autosave( $revision ) ) + return new IXR_Error( 404, __( 'Invalid post ID' ) ); + + if ( ! $post = get_post( $revision->post_parent ) ) + return new IXR_Error( 404, __( 'Invalid post ID' ) ); + + if ( ! current_user_can( 'edit_post', $revision->post_parent ) ) + return new IXR_Error( 401, __( 'Sorry, you cannot edit this post.' ) ); + + // Check if revisions are disabled. + if ( ! wp_revisions_enabled( $post ) ) + return new IXR_Error( 401, __( 'Sorry, revisions are disabled.' ) ); + + $post = wp_restore_post_revision( $revision_id ); + + return (bool) $post; + } + /* Blogger API functions. * specs on http://plant.blogger.com/api and http://groups.yahoo.com/group/bloggerDev/ */ @@ -3198,7 +3653,7 @@ class wp_xmlrpc_server extends IXR_Server { 'url' => get_option('home') . '/', 'blogid' => '1', 'blogName' => get_option('blogname'), - 'xmlrpc' => site_url( 'xmlrpc.php' ) + 'xmlrpc' => site_url( 'xmlrpc.php', 'rpc' ), ); return array($struct); @@ -3210,12 +3665,12 @@ class wp_xmlrpc_server extends IXR_Server { * @access protected */ function _multisite_getUsersBlogs($args) { - global $current_blog; + $current_blog = get_blog_details(); + $domain = $current_blog->domain; $path = $current_blog->path . 'xmlrpc.php'; - $protocol = is_ssl() ? 'https' : 'http'; - $rpc = new IXR_Client("$protocol://{$domain}{$path}"); + $rpc = new IXR_Client( set_url_scheme( "http://{$domain}{$path}" ) ); $rpc->query('wp.getUsersBlogs', $args[1], $args[2]); $blogs = $rpc->getResponse(); @@ -3288,7 +3743,7 @@ class wp_xmlrpc_server extends IXR_Server { if ( !$user = $this->login($username, $password) ) return $this->error; - $post_data = wp_get_single_post($post_ID, ARRAY_A); + $post_data = get_post($post_ID, ARRAY_A); if ( ! $post_data ) return new IXR_Error( 404, __( 'Invalid post ID.' ) ); @@ -3299,9 +3754,9 @@ class wp_xmlrpc_server extends IXR_Server { $categories = implode(',', wp_get_post_categories($post_ID)); - $content = ''.stripslashes($post_data['post_title']).''; + $content = ''.wp_unslash($post_data['post_title']).''; $content .= ''.$categories.''; - $content .= stripslashes($post_data['post_content']); + $content .= wp_unslash($post_data['post_content']); $struct = array( 'userid' => $post_data['post_author'], @@ -3337,6 +3792,9 @@ class wp_xmlrpc_server extends IXR_Server { if ( !$user = $this->login($username, $password) ) return $this->error; + if ( ! current_user_can( 'edit_posts' ) ) + return new IXR_Error( 401, __( 'Sorry, you cannot edit posts on this site.' ) ); + do_action('xmlrpc_call', 'blogger.getRecentPosts'); $posts_list = wp_get_recent_posts( $query ); @@ -3353,9 +3811,9 @@ class wp_xmlrpc_server extends IXR_Server { $post_date = $this->_convert_date( $entry['post_date'] ); $categories = implode(',', wp_get_post_categories($entry['ID'])); - $content = ''.stripslashes($entry['post_title']).''; + $content = ''.wp_unslash($entry['post_title']).''; $content .= ''.$categories.''; - $content .= stripslashes($entry['post_content']); + $content .= wp_unslash($entry['post_content']); $struct[] = array( 'userid' => $entry['post_author'], @@ -3375,82 +3833,23 @@ class wp_xmlrpc_server extends IXR_Server { } /** - * Retrieve blog_filename content. + * Deprecated. * * @since 1.5.0 - * - * @param array $args Method parameters. - * @return string + * @deprecated 3.5.0 */ function blogger_getTemplate($args) { - - $this->escape($args); - - $blog_ID = (int) $args[1]; - $username = $args[2]; - $password = $args[3]; - $template = $args[4]; /* could be 'main' or 'archiveIndex', but we don't use it */ - - if ( !$user = $this->login($username, $password) ) - return $this->error; - - do_action('xmlrpc_call', 'blogger.getTemplate'); - - if ( !current_user_can('edit_themes') ) - return new IXR_Error(401, __('Sorry, this user cannot edit the template.')); - - /* warning: here we make the assumption that the blog's URL is on the same server */ - $filename = get_option('home') . '/'; - $filename = preg_replace('#https?://.+?/#', $_SERVER['DOCUMENT_ROOT'].'/', $filename); - - $f = fopen($filename, 'r'); - $content = fread($f, filesize($filename)); - fclose($f); - - /* so it is actually editable with a windows/mac client */ - // FIXME: (or delete me) do we really want to cater to bad clients at the expense of good ones by BEEPing up their line breaks? commented. $content = str_replace("\n", "\r\n", $content); - - return $content; + return new IXR_Error( 403, __('Sorry, that file cannot be edited.' ) ); } /** - * Updates the content of blog_filename. + * Deprecated. * * @since 1.5.0 - * - * @param array $args Method parameters. - * @return bool True when done. + * @deprecated 3.5.0 */ function blogger_setTemplate($args) { - - $this->escape($args); - - $blog_ID = (int) $args[1]; - $username = $args[2]; - $password = $args[3]; - $content = $args[4]; - $template = $args[5]; /* could be 'main' or 'archiveIndex', but we don't use it */ - - if ( !$user = $this->login($username, $password) ) - return $this->error; - - do_action('xmlrpc_call', 'blogger.setTemplate'); - - if ( !current_user_can('edit_themes') ) - return new IXR_Error(401, __('Sorry, this user cannot edit the template.')); - - /* warning: here we make the assumption that the blog's URL is on the same server */ - $filename = get_option('home') . '/'; - $filename = preg_replace('#https?://.+?/#', $_SERVER['DOCUMENT_ROOT'].'/', $filename); - - if ($f = fopen($filename, 'w+')) { - fwrite($f, $content); - fclose($f); - } else { - return new IXR_Error(500, __('Either the file is not writable, or something wrong happened. The file has not been updated.')); - } - - return true; + return new IXR_Error( 403, __('Sorry, that file cannot be edited.' ) ); } /** @@ -3477,7 +3876,7 @@ class wp_xmlrpc_server extends IXR_Server { do_action('xmlrpc_call', 'blogger.newPost'); $cap = ($publish) ? 'publish_posts' : 'edit_posts'; - if ( !current_user_can($cap) ) + if ( ! current_user_can( get_post_type_object( 'post' )->cap->create_posts ) || !current_user_can($cap) ) return new IXR_Error(401, __('Sorry, you are not allowed to post on this site.')); $post_status = ($publish) ? 'publish' : 'draft'; @@ -3530,7 +3929,7 @@ class wp_xmlrpc_server extends IXR_Server { do_action('xmlrpc_call', 'blogger.editPost'); - $actual_post = wp_get_single_post($post_ID,ARRAY_A); + $actual_post = get_post($post_ID,ARRAY_A); if ( !$actual_post || $actual_post['post_type'] != 'post' ) return new IXR_Error(404, __('Sorry, no such post.')); @@ -3584,7 +3983,7 @@ class wp_xmlrpc_server extends IXR_Server { do_action('xmlrpc_call', 'blogger.deletePost'); - $actual_post = wp_get_single_post($post_ID,ARRAY_A); + $actual_post = get_post($post_ID,ARRAY_A); if ( !$actual_post || $actual_post['post_type'] != 'post' ) return new IXR_Error(404, __('Sorry, no such post.')); @@ -3692,6 +4091,8 @@ class wp_xmlrpc_server extends IXR_Server { $post_type = 'post'; } + if ( ! current_user_can( get_post_type_object( $post_type )->cap->create_posts ) ) + return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish posts on this site.' ) ); if ( !current_user_can( $cap ) ) return new IXR_Error( 401, $error_message ); @@ -3724,18 +4125,18 @@ class wp_xmlrpc_server extends IXR_Server { $post_author = $user->ID; // If an author id was provided then use it instead. - if ( isset($content_struct['wp_author_id']) && ($user->ID != $content_struct['wp_author_id']) ) { + if ( isset( $content_struct['wp_author_id'] ) && ( $user->ID != $content_struct['wp_author_id'] ) ) { switch ( $post_type ) { case "post": - if ( !current_user_can('edit_others_posts') ) - return(new IXR_Error(401, __('You are not allowed to post as this user'))); + if ( !current_user_can( 'edit_others_posts' ) ) + return( new IXR_Error( 401, __( 'You are not allowed to create posts as this user.' ) ) ); break; case "page": - if ( !current_user_can('edit_others_pages') ) - return(new IXR_Error(401, __('You are not allowed to create pages as this user'))); + if ( !current_user_can( 'edit_others_pages' ) ) + return( new IXR_Error( 401, __( 'You are not allowed to create pages as this user.' ) ) ); break; default: - return(new IXR_Error(401, __('Invalid post type'))); + return( new IXR_Error( 401, __( 'Invalid post type' ) ) ); break; } $author = get_userdata( $content_struct['wp_author_id'] ); @@ -3896,7 +4297,7 @@ class wp_xmlrpc_server extends IXR_Server { // Handle post formats if assigned, value is validated earlier // in this function if ( isset( $content_struct['wp_post_format'] ) ) - wp_set_post_terms( $post_ID, array( 'post-format-' . $content_struct['wp_post_format'] ), 'post_format' ); + set_post_format( $post_ID, $content_struct['wp_post_format'] ); $post_ID = wp_insert_post( $postdata, true ); if ( is_wp_error( $post_ID ) ) @@ -3910,22 +4311,20 @@ class wp_xmlrpc_server extends IXR_Server { return strval($post_ID); } - function add_enclosure_if_new($post_ID, $enclosure) { + function add_enclosure_if_new( $post_ID, $enclosure ) { if ( is_array( $enclosure ) && isset( $enclosure['url'] ) && isset( $enclosure['length'] ) && isset( $enclosure['type'] ) ) { - - $encstring = $enclosure['url'] . "\n" . $enclosure['length'] . "\n" . $enclosure['type']; + $encstring = $enclosure['url'] . "\n" . $enclosure['length'] . "\n" . $enclosure['type'] . "\n"; $found = false; - foreach ( (array) get_post_custom($post_ID) as $key => $val) { - if ($key == 'enclosure') { - foreach ( (array) $val as $enc ) { - if ($enc == $encstring) { - $found = true; - break 2; - } + if ( $enclosures = get_post_meta( $post_ID, 'enclosure' ) ) { + foreach ( $enclosures as $enc ) { + // This method used to omit the trailing new line. #23219 + if ( rtrim( $enc, "\n" ) == rtrim( $encstring, "\n" ) ) { + $found = true; + break; } } } - if (!$found) + if ( ! $found ) add_post_meta( $post_ID, 'enclosure', $encstring ); } } @@ -3945,7 +4344,7 @@ class wp_xmlrpc_server extends IXR_Server { $attachments = $wpdb->get_results( "SELECT ID, guid FROM {$wpdb->posts} WHERE post_parent = '0' AND post_type = 'attachment'" ); if ( is_array( $attachments ) ) { foreach ( $attachments as $file ) { - if ( strpos( $post_content, $file->guid ) !== false ) + if ( ! empty( $file->guid ) && strpos( $post_content, $file->guid ) !== false ) $wpdb->update($wpdb->posts, array('post_parent' => $post_ID), array('ID' => $file->ID) ); } } @@ -3974,7 +4373,7 @@ class wp_xmlrpc_server extends IXR_Server { do_action('xmlrpc_call', 'metaWeblog.editPost'); - $postdata = wp_get_single_post( $post_ID, ARRAY_A ); + $postdata = get_post( $post_ID, ARRAY_A ); // If there is no post data for the give post id, stop // now and return an error. Other wise a new post will be @@ -4213,7 +4612,7 @@ class wp_xmlrpc_server extends IXR_Server { // Handle post formats if assigned, validation is handled // earlier in this function if ( isset( $content_struct['wp_post_format'] ) ) - wp_set_post_terms( $post_ID, array( 'post-format-' . $content_struct['wp_post_format'] ), 'post_format' ); + set_post_format( $post_ID, $content_struct['wp_post_format'] ); do_action( 'xmlrpc_call_success_mw_editPost', $post_ID, $args ); @@ -4239,7 +4638,7 @@ class wp_xmlrpc_server extends IXR_Server { if ( !$user = $this->login($username, $password) ) return $this->error; - $postdata = wp_get_single_post($post_ID, ARRAY_A); + $postdata = get_post($post_ID, ARRAY_A); if ( ! $postdata ) return new IXR_Error( 404, __( 'Invalid post ID.' ) ); @@ -4367,6 +4766,9 @@ class wp_xmlrpc_server extends IXR_Server { if ( !$user = $this->login($username, $password) ) return $this->error; + if ( ! current_user_can( 'edit_posts' ) ) + return new IXR_Error( 401, __( 'Sorry, you cannot edit posts on this site.' ) ); + do_action('xmlrpc_call', 'metaWeblog.getRecentPosts'); $posts_list = wp_get_recent_posts( $query ); @@ -4374,6 +4776,7 @@ class wp_xmlrpc_server extends IXR_Server { if ( !$posts_list ) return array(); + $struct = array(); foreach ($posts_list as $entry) { if ( !current_user_can( 'edit_post', $entry['ID'] ) ) continue; @@ -4517,8 +4920,8 @@ class wp_xmlrpc_server extends IXR_Server { global $wpdb; $blog_ID = (int) $args[0]; - $username = $wpdb->escape($args[1]); - $password = $wpdb->escape($args[2]); + $username = $this->escape($args[1]); + $password = $this->escape($args[2]); $data = $args[3]; $name = sanitize_file_name( $data['name'] ); @@ -4562,8 +4965,13 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error(500, $errorString); } // Construct the attachment array - // attach to post_id 0 $post_id = 0; + if ( ! empty( $data['post_id'] ) ) { + $post_id = (int) $data['post_id']; + + if ( ! current_user_can( 'edit_post', $post_id ) ) + return new IXR_Error( 401, __( 'Sorry, you cannot edit this post.' ) ); + } $attachment = array( 'post_title' => $name, 'post_content' => '', @@ -4761,6 +5169,7 @@ class wp_xmlrpc_server extends IXR_Server { if ( !current_user_can('edit_post', $post_ID) ) return new IXR_Error(401, __('Sorry, you cannot edit this post.')); + $catids = array(); foreach ( $categories as $cat ) { $catids[] = $cat['categoryId']; } @@ -4818,7 +5227,7 @@ class wp_xmlrpc_server extends IXR_Server { do_action('xmlrpc_call', 'mt.getTrackbackPings'); - $actual_post = wp_get_single_post($post_ID, ARRAY_A); + $actual_post = get_post($post_ID, ARRAY_A); if ( !$actual_post ) return new IXR_Error(404, __('Sorry, no such post.')); @@ -4865,7 +5274,7 @@ class wp_xmlrpc_server extends IXR_Server { do_action('xmlrpc_call', 'mt.publishPost'); - $postdata = wp_get_single_post($post_ID, ARRAY_A); + $postdata = get_post($post_ID, ARRAY_A); if ( ! $postdata ) return new IXR_Error( 404, __( 'Invalid post ID.' ) ); @@ -4912,10 +5321,14 @@ class wp_xmlrpc_server extends IXR_Server { $pagelinkedto = str_replace('&', '&', $pagelinkedto); $pagelinkedto = str_replace('&', '&', $pagelinkedto); + $pagelinkedfrom = apply_filters( 'pingback_ping_source_uri', $pagelinkedfrom, $pagelinkedto ); + if ( ! $pagelinkedfrom ) + return $this->pingback_error( 0, __( 'A valid URL was not provided.' ) ); + // Check if the page linked to is in our site $pos1 = strpos($pagelinkedto, str_replace(array('http://www.','http://','https://www.','https://'), '', get_option('home'))); if ( !$pos1 ) - return new IXR_Error(0, __('Is there no link to us?')); + return $this->pingback_error( 0, __( 'Is there no link to us?' ) ); // let's find which post is linked to // FIXME: does url_to_postid() cover all these cases already? @@ -4928,7 +5341,7 @@ class wp_xmlrpc_server extends IXR_Server { $blah = explode('/', $match[0]); $post_ID = (int) $blah[1]; $way = 'from the path'; - } elseif ( preg_match('#p=[0-9]{1,}#', $urltest['query'], $match) ) { + } elseif ( isset( $urltest['query'] ) && preg_match('#p=[0-9]{1,}#', $urltest['query'], $match) ) { // the querystring defines the post_ID (?p=XXXX) $blah = explode('=', $match[0]); $post_ID = (int) $blah[1]; @@ -4949,51 +5362,57 @@ class wp_xmlrpc_server extends IXR_Server { $sql = $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_title RLIKE %s", like_escape( $title ) ); if (! ($post_ID = $wpdb->get_var($sql)) ) { // returning unknown error '0' is better than die()ing - return new IXR_Error(0, ''); + return $this->pingback_error( 0, '' ); } $way = 'from the fragment (title)'; } } else { // TODO: Attempt to extract a post ID from the given URL - return new IXR_Error(33, __('The specified target URL cannot be used as a target. It either doesn’t exist, or it is not a pingback-enabled resource.')); + return $this->pingback_error( 33, __('The specified target URL cannot be used as a target. It either doesn’t exist, or it is not a pingback-enabled resource.' ) ); } $post_ID = (int) $post_ID; $post = get_post($post_ID); if ( !$post ) // Post_ID not found - return new IXR_Error(33, __('The specified target URL cannot be used as a target. It either doesn’t exist, or it is not a pingback-enabled resource.')); + return $this->pingback_error( 33, __( 'The specified target URL cannot be used as a target. It either doesn’t exist, or it is not a pingback-enabled resource.' ) ); if ( $post_ID == url_to_postid($pagelinkedfrom) ) - return new IXR_Error(0, __('The source URL and the target URL cannot both point to the same resource.')); + return $this->pingback_error( 0, __( 'The source URL and the target URL cannot both point to the same resource.' ) ); // Check if pings are on if ( !pings_open($post) ) - return new IXR_Error(33, __('The specified target URL cannot be used as a target. It either doesn’t exist, or it is not a pingback-enabled resource.')); + return $this->pingback_error( 33, __( 'The specified target URL cannot be used as a target. It either doesn’t exist, or it is not a pingback-enabled resource.' ) ); // Let's check that the remote site didn't already pingback this entry if ( $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_author_url = %s", $post_ID, $pagelinkedfrom) ) ) - return new IXR_Error( 48, __( 'The pingback has already been registered.' ) ); + return $this->pingback_error( 48, __( 'The pingback has already been registered.' ) ); // very stupid, but gives time to the 'from' server to publish ! sleep(1); // Let's check the remote site - $linea = wp_remote_fopen( $pagelinkedfrom ); + $http_api_args = array( + 'timeout' => 10, + 'redirection' => 0, + 'limit_response_size' => 153600, // 150 KB + ); + $linea = wp_remote_retrieve_body( wp_safe_remote_get( $pagelinkedfrom, $http_api_args ) ); + if ( !$linea ) - return new IXR_Error(16, __('The source URL does not exist.')); + return $this->pingback_error( 16, __( 'The source URL does not exist.' ) ); $linea = apply_filters('pre_remote_source', $linea, $pagelinkedto); // Work around bug in strip_tags(): $linea = str_replace(']*>/", "\n\n", $linea ); + $linea = preg_replace( '/[\r\n\t ]+/', ' ', $linea ); // normalize spaces + $linea = preg_replace( "/<\/*(h1|h2|h3|h4|h5|h6|p|th|td|li|dt|dd|pre|caption|input|textarea|button|body)[^>]*>/", "\n\n", $linea ); preg_match('|([^<]*?)|is', $linea, $matchtitle); $title = $matchtitle[1]; if ( empty( $title ) ) - return new IXR_Error(32, __('We cannot find a title on that page.')); + return $this->pingback_error( 32, __('We cannot find a title on that page.' ) ); $linea = strip_tags( $linea, '' ); // just keep the tag we need @@ -5015,7 +5434,7 @@ class wp_xmlrpc_server extends IXR_Server { // prevent really long link text if ( strlen($context[1]) > 100 ) - $context[1] = substr($context[1], 0, 100) . '...'; + $context[1] = substr($context[1], 0, 100) . '…'; $marker = ''.$context[1].''; // set up our marker $excerpt= str_replace($context[0], $marker, $excerpt); // swap out the link for our marker @@ -5029,12 +5448,12 @@ class wp_xmlrpc_server extends IXR_Server { } if ( empty($context) ) // Link to target not found - return new IXR_Error(17, __('The source URL does not contain a link to the target URL, and so cannot be used as a source.')); + return $this->pingback_error( 17, __( 'The source URL does not contain a link to the target URL, and so cannot be used as a source.' ) ); $pagelinkedfrom = str_replace('&', '&', $pagelinkedfrom); - $context = '[...] ' . esc_html( $excerpt ) . ' [...]'; - $pagelinkedfrom = $wpdb->escape( $pagelinkedfrom ); + $context = '[…] ' . esc_html( $excerpt ) . ' […]'; + $pagelinkedfrom = $this->escape( $pagelinkedfrom ); $comment_post_ID = (int) $post_ID; $comment_author = $title; @@ -5076,14 +5495,14 @@ class wp_xmlrpc_server extends IXR_Server { $post_ID = url_to_postid($url); if ( !$post_ID ) { // We aren't sure that the resource is available and/or pingback enabled - return new IXR_Error(33, __('The specified target URL cannot be used as a target. It either doesn’t exist, or it is not a pingback-enabled resource.')); + return $this->pingback_error( 33, __( 'The specified target URL cannot be used as a target. It either doesn’t exist, or it is not a pingback-enabled resource.' ) ); } - $actual_post = wp_get_single_post($post_ID, ARRAY_A); + $actual_post = get_post($post_ID, ARRAY_A); if ( !$actual_post ) { // No such post = resource not found - return new IXR_Error(32, __('The specified target URL does not exist.')); + return $this->pingback_error( 32, __('The specified target URL does not exist.' ) ); } $comments = $wpdb->get_results( $wpdb->prepare("SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID) ); @@ -5099,4 +5518,8 @@ class wp_xmlrpc_server extends IXR_Server { return $pingbacks; } + + protected function pingback_error( $code, $message ) { + return apply_filters( 'xmlrpc_pingback_error', new IXR_Error( $code, $message ) ); + } }