class-wp-xmlrpc-server.php 205 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744374537463747374837493750375137523753375437553756375737583759376037613762376337643765376637673768376937703771377237733774377537763777377837793780378137823783378437853786378737883789379037913792379337943795379637973798379938003801380238033804380538063807380838093810381138123813381438153816381738183819382038213822382338243825382638273828382938303831383238333834383538363837383838393840384138423843384438453846384738483849385038513852385338543855385638573858385938603861386238633864386538663867386838693870387138723873387438753876387738783879388038813882388338843885388638873888388938903891389238933894389538963897389838993900390139023903390439053906390739083909391039113912391339143915391639173918391939203921392239233924392539263927392839293930393139323933393439353936393739383939394039413942394339443945394639473948394939503951395239533954395539563957395839593960396139623963396439653966396739683969397039713972397339743975397639773978397939803981398239833984398539863987398839893990399139923993399439953996399739983999400040014002400340044005400640074008400940104011401240134014401540164017401840194020402140224023402440254026402740284029403040314032403340344035403640374038403940404041404240434044404540464047404840494050405140524053405440554056405740584059406040614062406340644065406640674068406940704071407240734074407540764077407840794080408140824083408440854086408740884089409040914092409340944095409640974098409941004101410241034104410541064107410841094110411141124113411441154116411741184119412041214122412341244125412641274128412941304131413241334134413541364137413841394140414141424143414441454146414741484149415041514152415341544155415641574158415941604161416241634164416541664167416841694170417141724173417441754176417741784179418041814182418341844185418641874188418941904191419241934194419541964197419841994200420142024203420442054206420742084209421042114212421342144215421642174218421942204221422242234224422542264227422842294230423142324233423442354236423742384239424042414242424342444245424642474248424942504251425242534254425542564257425842594260426142624263426442654266426742684269427042714272427342744275427642774278427942804281428242834284428542864287428842894290429142924293429442954296429742984299430043014302430343044305430643074308430943104311431243134314431543164317431843194320432143224323432443254326432743284329433043314332433343344335433643374338433943404341434243434344434543464347434843494350435143524353435443554356435743584359436043614362436343644365436643674368436943704371437243734374437543764377437843794380438143824383438443854386438743884389439043914392439343944395439643974398439944004401440244034404440544064407440844094410441144124413441444154416441744184419442044214422442344244425442644274428442944304431443244334434443544364437443844394440444144424443444444454446444744484449445044514452445344544455445644574458445944604461446244634464446544664467446844694470447144724473447444754476447744784479448044814482448344844485448644874488448944904491449244934494449544964497449844994500450145024503450445054506450745084509451045114512451345144515451645174518451945204521452245234524452545264527452845294530453145324533453445354536453745384539454045414542454345444545454645474548454945504551455245534554455545564557455845594560456145624563456445654566456745684569457045714572457345744575457645774578457945804581458245834584458545864587458845894590459145924593459445954596459745984599460046014602460346044605460646074608460946104611461246134614461546164617461846194620462146224623462446254626462746284629463046314632463346344635463646374638463946404641464246434644464546464647464846494650465146524653465446554656465746584659466046614662466346644665466646674668466946704671467246734674467546764677467846794680468146824683468446854686468746884689469046914692469346944695469646974698469947004701470247034704470547064707470847094710471147124713471447154716471747184719472047214722472347244725472647274728472947304731473247334734473547364737473847394740474147424743474447454746474747484749475047514752475347544755475647574758475947604761476247634764476547664767476847694770477147724773477447754776477747784779478047814782478347844785478647874788478947904791479247934794479547964797479847994800480148024803480448054806480748084809481048114812481348144815481648174818481948204821482248234824482548264827482848294830483148324833483448354836483748384839484048414842484348444845484648474848484948504851485248534854485548564857485848594860486148624863486448654866486748684869487048714872487348744875487648774878487948804881488248834884488548864887488848894890489148924893489448954896489748984899490049014902490349044905490649074908490949104911491249134914491549164917491849194920492149224923492449254926492749284929493049314932493349344935493649374938493949404941494249434944494549464947494849494950495149524953495449554956495749584959496049614962496349644965496649674968496949704971497249734974497549764977497849794980498149824983498449854986498749884989499049914992499349944995499649974998499950005001500250035004500550065007500850095010501150125013501450155016501750185019502050215022502350245025502650275028502950305031503250335034503550365037503850395040504150425043504450455046504750485049505050515052505350545055505650575058505950605061506250635064506550665067506850695070507150725073507450755076507750785079508050815082508350845085508650875088508950905091509250935094509550965097509850995100510151025103510451055106510751085109511051115112511351145115511651175118511951205121512251235124512551265127512851295130513151325133513451355136513751385139514051415142514351445145514651475148514951505151515251535154515551565157515851595160516151625163516451655166516751685169517051715172517351745175517651775178517951805181518251835184518551865187518851895190519151925193519451955196519751985199520052015202520352045205520652075208520952105211521252135214521552165217521852195220522152225223522452255226522752285229523052315232523352345235523652375238523952405241524252435244524552465247524852495250525152525253525452555256525752585259526052615262526352645265526652675268526952705271527252735274527552765277527852795280528152825283528452855286528752885289529052915292529352945295529652975298529953005301530253035304530553065307530853095310531153125313531453155316531753185319532053215322532353245325532653275328532953305331533253335334533553365337533853395340534153425343534453455346534753485349535053515352535353545355535653575358535953605361536253635364536553665367536853695370537153725373537453755376537753785379538053815382538353845385538653875388538953905391539253935394539553965397539853995400540154025403540454055406540754085409541054115412541354145415541654175418541954205421542254235424542554265427542854295430543154325433543454355436543754385439544054415442544354445445544654475448544954505451545254535454545554565457545854595460546154625463546454655466546754685469547054715472547354745475547654775478547954805481548254835484548554865487548854895490549154925493549454955496549754985499550055015502550355045505550655075508550955105511551255135514551555165517551855195520552155225523552455255526552755285529553055315532553355345535553655375538553955405541554255435544554555465547554855495550555155525553555455555556555755585559556055615562556355645565556655675568556955705571557255735574557555765577557855795580558155825583558455855586558755885589559055915592559355945595559655975598559956005601560256035604560556065607560856095610561156125613561456155616561756185619562056215622562356245625562656275628562956305631563256335634563556365637563856395640564156425643564456455646564756485649565056515652565356545655565656575658565956605661566256635664566556665667566856695670567156725673567456755676567756785679568056815682568356845685568656875688568956905691569256935694569556965697569856995700570157025703570457055706570757085709571057115712571357145715571657175718571957205721572257235724572557265727572857295730573157325733573457355736573757385739574057415742574357445745574657475748574957505751575257535754575557565757575857595760576157625763576457655766576757685769577057715772577357745775577657775778577957805781578257835784578557865787578857895790579157925793579457955796579757985799580058015802580358045805580658075808580958105811581258135814581558165817581858195820582158225823582458255826582758285829583058315832583358345835583658375838583958405841584258435844584558465847584858495850585158525853585458555856585758585859586058615862586358645865586658675868586958705871587258735874587558765877587858795880588158825883588458855886588758885889589058915892589358945895589658975898589959005901590259035904590559065907590859095910591159125913591459155916591759185919592059215922592359245925592659275928592959305931593259335934593559365937593859395940594159425943594459455946594759485949595059515952595359545955595659575958595959605961596259635964596559665967596859695970597159725973597459755976597759785979598059815982598359845985598659875988598959905991599259935994599559965997599859996000600160026003600460056006600760086009601060116012601360146015601660176018601960206021602260236024602560266027602860296030603160326033603460356036603760386039604060416042604360446045604660476048604960506051605260536054605560566057605860596060606160626063606460656066606760686069607060716072607360746075607660776078607960806081608260836084608560866087608860896090609160926093609460956096609760986099610061016102610361046105610661076108610961106111611261136114611561166117611861196120612161226123612461256126612761286129613061316132613361346135613661376138613961406141614261436144614561466147614861496150615161526153615461556156615761586159616061616162616361646165616661676168616961706171617261736174617561766177617861796180618161826183618461856186618761886189619061916192619361946195619661976198619962006201620262036204620562066207620862096210621162126213621462156216621762186219622062216222622362246225622662276228622962306231623262336234623562366237623862396240624162426243624462456246624762486249625062516252625362546255625662576258625962606261626262636264626562666267626862696270627162726273627462756276627762786279628062816282628362846285628662876288628962906291629262936294629562966297629862996300630163026303630463056306630763086309631063116312631363146315631663176318631963206321632263236324632563266327632863296330633163326333633463356336633763386339634063416342634363446345634663476348634963506351635263536354635563566357635863596360636163626363636463656366636763686369637063716372637363746375637663776378637963806381638263836384638563866387638863896390639163926393639463956396639763986399640064016402640364046405640664076408640964106411641264136414641564166417641864196420642164226423642464256426642764286429643064316432643364346435643664376438643964406441644264436444644564466447644864496450645164526453645464556456645764586459646064616462646364646465646664676468646964706471647264736474647564766477647864796480648164826483648464856486648764886489649064916492649364946495649664976498649965006501650265036504650565066507650865096510651165126513651465156516651765186519652065216522652365246525652665276528652965306531653265336534653565366537653865396540654165426543654465456546654765486549655065516552655365546555655665576558655965606561656265636564656565666567656865696570657165726573657465756576657765786579658065816582658365846585658665876588658965906591659265936594659565966597659865996600660166026603660466056606660766086609661066116612661366146615661666176618661966206621662266236624662566266627662866296630663166326633663466356636663766386639664066416642664366446645664666476648664966506651665266536654665566566657665866596660666166626663666466656666666766686669667066716672667366746675667666776678667966806681668266836684668566866687668866896690669166926693669466956696669766986699670067016702670367046705670667076708670967106711671267136714671567166717671867196720672167226723672467256726672767286729673067316732673367346735673667376738673967406741674267436744674567466747674867496750675167526753675467556756675767586759676067616762676367646765676667676768676967706771677267736774677567766777677867796780678167826783678467856786678767886789679067916792679367946795679667976798679968006801680268036804680568066807680868096810681168126813681468156816681768186819682068216822682368246825682668276828682968306831683268336834683568366837683868396840684168426843684468456846684768486849685068516852685368546855685668576858685968606861686268636864686568666867686868696870687168726873687468756876687768786879688068816882688368846885688668876888688968906891689268936894689568966897689868996900690169026903690469056906690769086909691069116912691369146915691669176918691969206921692269236924692569266927692869296930693169326933693469356936693769386939694069416942694369446945694669476948694969506951695269536954695569566957695869596960696169626963696469656966696769686969697069716972697369746975697669776978697969806981698269836984698569866987698869896990699169926993699469956996699769986999700070017002700370047005700670077008700970107011701270137014701570167017701870197020702170227023702470257026702770287029703070317032703370347035703670377038703970407041704270437044704570467047
  1. <?php
  2. /**
  3. * XML-RPC protocol support for WordPress
  4. *
  5. * @package WordPress
  6. * @subpackage Publishing
  7. */
  8. /**
  9. * WordPress XMLRPC server implementation.
  10. *
  11. * Implements compatibility for Blogger API, MetaWeblog API, MovableType, and
  12. * pingback. Additional WordPress API for managing comments, pages, posts,
  13. * options, etc.
  14. *
  15. * As of WordPress 3.5.0, XML-RPC is enabled by default. It can be disabled
  16. * via the {@see 'xmlrpc_enabled'} filter found in wp_xmlrpc_server::login().
  17. *
  18. * @since 1.5.0
  19. *
  20. * @see IXR_Server
  21. */
  22. class wp_xmlrpc_server extends IXR_Server {
  23. /**
  24. * Methods.
  25. *
  26. * @var array
  27. */
  28. public $methods;
  29. /**
  30. * Blog options.
  31. *
  32. * @var array
  33. */
  34. public $blog_options;
  35. /**
  36. * IXR_Error instance.
  37. *
  38. * @var IXR_Error
  39. */
  40. public $error;
  41. /**
  42. * Flags that the user authentication has failed in this instance of wp_xmlrpc_server.
  43. *
  44. * @var bool
  45. */
  46. protected $auth_failed = false;
  47. /**
  48. * Registers all of the XMLRPC methods that XMLRPC server understands.
  49. *
  50. * Sets up server and method property. Passes XMLRPC
  51. * methods through the {@see 'xmlrpc_methods'} filter to allow plugins to extend
  52. * or replace XML-RPC methods.
  53. *
  54. * @since 1.5.0
  55. */
  56. public function __construct() {
  57. $this->methods = array(
  58. // WordPress API
  59. 'wp.getUsersBlogs' => 'this:wp_getUsersBlogs',
  60. 'wp.newPost' => 'this:wp_newPost',
  61. 'wp.editPost' => 'this:wp_editPost',
  62. 'wp.deletePost' => 'this:wp_deletePost',
  63. 'wp.getPost' => 'this:wp_getPost',
  64. 'wp.getPosts' => 'this:wp_getPosts',
  65. 'wp.newTerm' => 'this:wp_newTerm',
  66. 'wp.editTerm' => 'this:wp_editTerm',
  67. 'wp.deleteTerm' => 'this:wp_deleteTerm',
  68. 'wp.getTerm' => 'this:wp_getTerm',
  69. 'wp.getTerms' => 'this:wp_getTerms',
  70. 'wp.getTaxonomy' => 'this:wp_getTaxonomy',
  71. 'wp.getTaxonomies' => 'this:wp_getTaxonomies',
  72. 'wp.getUser' => 'this:wp_getUser',
  73. 'wp.getUsers' => 'this:wp_getUsers',
  74. 'wp.getProfile' => 'this:wp_getProfile',
  75. 'wp.editProfile' => 'this:wp_editProfile',
  76. 'wp.getPage' => 'this:wp_getPage',
  77. 'wp.getPages' => 'this:wp_getPages',
  78. 'wp.newPage' => 'this:wp_newPage',
  79. 'wp.deletePage' => 'this:wp_deletePage',
  80. 'wp.editPage' => 'this:wp_editPage',
  81. 'wp.getPageList' => 'this:wp_getPageList',
  82. 'wp.getAuthors' => 'this:wp_getAuthors',
  83. 'wp.getCategories' => 'this:mw_getCategories', // Alias
  84. 'wp.getTags' => 'this:wp_getTags',
  85. 'wp.newCategory' => 'this:wp_newCategory',
  86. 'wp.deleteCategory' => 'this:wp_deleteCategory',
  87. 'wp.suggestCategories' => 'this:wp_suggestCategories',
  88. 'wp.uploadFile' => 'this:mw_newMediaObject', // Alias
  89. 'wp.deleteFile' => 'this:wp_deletePost', // Alias
  90. 'wp.getCommentCount' => 'this:wp_getCommentCount',
  91. 'wp.getPostStatusList' => 'this:wp_getPostStatusList',
  92. 'wp.getPageStatusList' => 'this:wp_getPageStatusList',
  93. 'wp.getPageTemplates' => 'this:wp_getPageTemplates',
  94. 'wp.getOptions' => 'this:wp_getOptions',
  95. 'wp.setOptions' => 'this:wp_setOptions',
  96. 'wp.getComment' => 'this:wp_getComment',
  97. 'wp.getComments' => 'this:wp_getComments',
  98. 'wp.deleteComment' => 'this:wp_deleteComment',
  99. 'wp.editComment' => 'this:wp_editComment',
  100. 'wp.newComment' => 'this:wp_newComment',
  101. 'wp.getCommentStatusList' => 'this:wp_getCommentStatusList',
  102. 'wp.getMediaItem' => 'this:wp_getMediaItem',
  103. 'wp.getMediaLibrary' => 'this:wp_getMediaLibrary',
  104. 'wp.getPostFormats' => 'this:wp_getPostFormats',
  105. 'wp.getPostType' => 'this:wp_getPostType',
  106. 'wp.getPostTypes' => 'this:wp_getPostTypes',
  107. 'wp.getRevisions' => 'this:wp_getRevisions',
  108. 'wp.restoreRevision' => 'this:wp_restoreRevision',
  109. // Blogger API
  110. 'blogger.getUsersBlogs' => 'this:blogger_getUsersBlogs',
  111. 'blogger.getUserInfo' => 'this:blogger_getUserInfo',
  112. 'blogger.getPost' => 'this:blogger_getPost',
  113. 'blogger.getRecentPosts' => 'this:blogger_getRecentPosts',
  114. 'blogger.newPost' => 'this:blogger_newPost',
  115. 'blogger.editPost' => 'this:blogger_editPost',
  116. 'blogger.deletePost' => 'this:blogger_deletePost',
  117. // MetaWeblog API (with MT extensions to structs)
  118. 'metaWeblog.newPost' => 'this:mw_newPost',
  119. 'metaWeblog.editPost' => 'this:mw_editPost',
  120. 'metaWeblog.getPost' => 'this:mw_getPost',
  121. 'metaWeblog.getRecentPosts' => 'this:mw_getRecentPosts',
  122. 'metaWeblog.getCategories' => 'this:mw_getCategories',
  123. 'metaWeblog.newMediaObject' => 'this:mw_newMediaObject',
  124. // MetaWeblog API aliases for Blogger API
  125. // see http://www.xmlrpc.com/stories/storyReader$2460
  126. 'metaWeblog.deletePost' => 'this:blogger_deletePost',
  127. 'metaWeblog.getUsersBlogs' => 'this:blogger_getUsersBlogs',
  128. // MovableType API
  129. 'mt.getCategoryList' => 'this:mt_getCategoryList',
  130. 'mt.getRecentPostTitles' => 'this:mt_getRecentPostTitles',
  131. 'mt.getPostCategories' => 'this:mt_getPostCategories',
  132. 'mt.setPostCategories' => 'this:mt_setPostCategories',
  133. 'mt.supportedMethods' => 'this:mt_supportedMethods',
  134. 'mt.supportedTextFilters' => 'this:mt_supportedTextFilters',
  135. 'mt.getTrackbackPings' => 'this:mt_getTrackbackPings',
  136. 'mt.publishPost' => 'this:mt_publishPost',
  137. // PingBack
  138. 'pingback.ping' => 'this:pingback_ping',
  139. 'pingback.extensions.getPingbacks' => 'this:pingback_extensions_getPingbacks',
  140. 'demo.sayHello' => 'this:sayHello',
  141. 'demo.addTwoNumbers' => 'this:addTwoNumbers',
  142. );
  143. $this->initialise_blog_option_info();
  144. /**
  145. * Filters the methods exposed by the XML-RPC server.
  146. *
  147. * This filter can be used to add new methods, and remove built-in methods.
  148. *
  149. * @since 1.5.0
  150. *
  151. * @param array $methods An array of XML-RPC methods.
  152. */
  153. $this->methods = apply_filters( 'xmlrpc_methods', $this->methods );
  154. }
  155. /**
  156. * Make private/protected methods readable for backward compatibility.
  157. *
  158. * @since 4.0.0
  159. *
  160. * @param string $name Method to call.
  161. * @param array $arguments Arguments to pass when calling.
  162. * @return array|IXR_Error|false Return value of the callback, false otherwise.
  163. */
  164. public function __call( $name, $arguments ) {
  165. if ( '_multisite_getUsersBlogs' === $name ) {
  166. return $this->_multisite_getUsersBlogs( ...$arguments );
  167. }
  168. return false;
  169. }
  170. /**
  171. * Serves the XML-RPC request.
  172. *
  173. * @since 2.9.0
  174. */
  175. public function serve_request() {
  176. $this->IXR_Server( $this->methods );
  177. }
  178. /**
  179. * Test XMLRPC API by saying, "Hello!" to client.
  180. *
  181. * @since 1.5.0
  182. *
  183. * @return string Hello string response.
  184. */
  185. public function sayHello() {
  186. return 'Hello!';
  187. }
  188. /**
  189. * Test XMLRPC API by adding two numbers for client.
  190. *
  191. * @since 1.5.0
  192. *
  193. * @param array $args {
  194. * Method arguments. Note: arguments must be ordered as documented.
  195. *
  196. * @type int $number1 A number to add.
  197. * @type int $number2 A second number to add.
  198. * }
  199. * @return int Sum of the two given numbers.
  200. */
  201. public function addTwoNumbers( $args ) {
  202. $number1 = $args[0];
  203. $number2 = $args[1];
  204. return $number1 + $number2;
  205. }
  206. /**
  207. * Log user in.
  208. *
  209. * @since 2.8.0
  210. *
  211. * @param string $username User's username.
  212. * @param string $password User's password.
  213. * @return WP_User|bool WP_User object if authentication passed, false otherwise
  214. */
  215. public function login( $username, $password ) {
  216. /*
  217. * Respect old get_option() filters left for back-compat when the 'enable_xmlrpc'
  218. * option was deprecated in 3.5.0. Use the 'xmlrpc_enabled' hook instead.
  219. */
  220. $enabled = apply_filters( 'pre_option_enable_xmlrpc', false );
  221. if ( false === $enabled ) {
  222. $enabled = apply_filters( 'option_enable_xmlrpc', true );
  223. }
  224. /**
  225. * Filters whether XML-RPC methods requiring authentication are enabled.
  226. *
  227. * Contrary to the way it's named, this filter does not control whether XML-RPC is *fully*
  228. * enabled, rather, it only controls whether XML-RPC methods requiring authentication - such
  229. * as for publishing purposes - are enabled.
  230. *
  231. * Further, the filter does not control whether pingbacks or other custom endpoints that don't
  232. * require authentication are enabled. This behavior is expected, and due to how parity was matched
  233. * with the `enable_xmlrpc` UI option the filter replaced when it was introduced in 3.5.
  234. *
  235. * To disable XML-RPC methods that require authentication, use:
  236. *
  237. * add_filter( 'xmlrpc_enabled', '__return_false' );
  238. *
  239. * For more granular control over all XML-RPC methods and requests, see the {@see 'xmlrpc_methods'}
  240. * and {@see 'xmlrpc_element_limit'} hooks.
  241. *
  242. * @since 3.5.0
  243. *
  244. * @param bool $enabled Whether XML-RPC is enabled. Default true.
  245. */
  246. $enabled = apply_filters( 'xmlrpc_enabled', $enabled );
  247. if ( ! $enabled ) {
  248. $this->error = new IXR_Error( 405, sprintf( __( 'XML-RPC services are disabled on this site.' ) ) );
  249. return false;
  250. }
  251. if ( $this->auth_failed ) {
  252. $user = new WP_Error( 'login_prevented' );
  253. } else {
  254. $user = wp_authenticate( $username, $password );
  255. }
  256. if ( is_wp_error( $user ) ) {
  257. $this->error = new IXR_Error( 403, __( 'Incorrect username or password.' ) );
  258. // Flag that authentication has failed once on this wp_xmlrpc_server instance
  259. $this->auth_failed = true;
  260. /**
  261. * Filters the XML-RPC user login error message.
  262. *
  263. * @since 3.5.0
  264. *
  265. * @param string $error The XML-RPC error message.
  266. * @param WP_Error $user WP_Error object.
  267. */
  268. $this->error = apply_filters( 'xmlrpc_login_error', $this->error, $user );
  269. return false;
  270. }
  271. wp_set_current_user( $user->ID );
  272. return $user;
  273. }
  274. /**
  275. * Check user's credentials. Deprecated.
  276. *
  277. * @since 1.5.0
  278. * @deprecated 2.8.0 Use wp_xmlrpc_server::login()
  279. * @see wp_xmlrpc_server::login()
  280. *
  281. * @param string $username User's username.
  282. * @param string $password User's password.
  283. * @return bool Whether authentication passed.
  284. */
  285. public function login_pass_ok( $username, $password ) {
  286. return (bool) $this->login( $username, $password );
  287. }
  288. /**
  289. * Escape string or array of strings for database.
  290. *
  291. * @since 1.5.2
  292. *
  293. * @param string|array $data Escape single string or array of strings.
  294. * @return string|void Returns with string is passed, alters by-reference
  295. * when array is passed.
  296. */
  297. public function escape( &$data ) {
  298. if ( ! is_array( $data ) ) {
  299. return wp_slash( $data );
  300. }
  301. foreach ( $data as &$v ) {
  302. if ( is_array( $v ) ) {
  303. $this->escape( $v );
  304. } elseif ( ! is_object( $v ) ) {
  305. $v = wp_slash( $v );
  306. }
  307. }
  308. }
  309. /**
  310. * Retrieve custom fields for post.
  311. *
  312. * @since 2.5.0
  313. *
  314. * @param int $post_id Post ID.
  315. * @return array Custom fields, if exist.
  316. */
  317. public function get_custom_fields( $post_id ) {
  318. $post_id = (int) $post_id;
  319. $custom_fields = array();
  320. foreach ( (array) has_meta( $post_id ) as $meta ) {
  321. // Don't expose protected fields.
  322. if ( ! current_user_can( 'edit_post_meta', $post_id, $meta['meta_key'] ) ) {
  323. continue;
  324. }
  325. $custom_fields[] = array(
  326. 'id' => $meta['meta_id'],
  327. 'key' => $meta['meta_key'],
  328. 'value' => $meta['meta_value'],
  329. );
  330. }
  331. return $custom_fields;
  332. }
  333. /**
  334. * Set custom fields for post.
  335. *
  336. * @since 2.5.0
  337. *
  338. * @param int $post_id Post ID.
  339. * @param array $fields Custom fields.
  340. */
  341. public function set_custom_fields( $post_id, $fields ) {
  342. $post_id = (int) $post_id;
  343. foreach ( (array) $fields as $meta ) {
  344. if ( isset( $meta['id'] ) ) {
  345. $meta['id'] = (int) $meta['id'];
  346. $pmeta = get_metadata_by_mid( 'post', $meta['id'] );
  347. if ( ! $pmeta || $pmeta->post_id != $post_id ) {
  348. continue;
  349. }
  350. if ( isset( $meta['key'] ) ) {
  351. $meta['key'] = wp_unslash( $meta['key'] );
  352. if ( $meta['key'] !== $pmeta->meta_key ) {
  353. continue;
  354. }
  355. $meta['value'] = wp_unslash( $meta['value'] );
  356. if ( current_user_can( 'edit_post_meta', $post_id, $meta['key'] ) ) {
  357. update_metadata_by_mid( 'post', $meta['id'], $meta['value'] );
  358. }
  359. } elseif ( current_user_can( 'delete_post_meta', $post_id, $pmeta->meta_key ) ) {
  360. delete_metadata_by_mid( 'post', $meta['id'] );
  361. }
  362. } elseif ( current_user_can( 'add_post_meta', $post_id, wp_unslash( $meta['key'] ) ) ) {
  363. add_post_meta( $post_id, $meta['key'], $meta['value'] );
  364. }
  365. }
  366. }
  367. /**
  368. * Retrieve custom fields for a term.
  369. *
  370. * @since 4.9.0
  371. *
  372. * @param int $term_id Term ID.
  373. * @return array Array of custom fields, if they exist.
  374. */
  375. public function get_term_custom_fields( $term_id ) {
  376. $term_id = (int) $term_id;
  377. $custom_fields = array();
  378. foreach ( (array) has_term_meta( $term_id ) as $meta ) {
  379. if ( ! current_user_can( 'edit_term_meta', $term_id ) ) {
  380. continue;
  381. }
  382. $custom_fields[] = array(
  383. 'id' => $meta['meta_id'],
  384. 'key' => $meta['meta_key'],
  385. 'value' => $meta['meta_value'],
  386. );
  387. }
  388. return $custom_fields;
  389. }
  390. /**
  391. * Set custom fields for a term.
  392. *
  393. * @since 4.9.0
  394. *
  395. * @param int $term_id Term ID.
  396. * @param array $fields Custom fields.
  397. */
  398. public function set_term_custom_fields( $term_id, $fields ) {
  399. $term_id = (int) $term_id;
  400. foreach ( (array) $fields as $meta ) {
  401. if ( isset( $meta['id'] ) ) {
  402. $meta['id'] = (int) $meta['id'];
  403. $pmeta = get_metadata_by_mid( 'term', $meta['id'] );
  404. if ( isset( $meta['key'] ) ) {
  405. $meta['key'] = wp_unslash( $meta['key'] );
  406. if ( $meta['key'] !== $pmeta->meta_key ) {
  407. continue;
  408. }
  409. $meta['value'] = wp_unslash( $meta['value'] );
  410. if ( current_user_can( 'edit_term_meta', $term_id ) ) {
  411. update_metadata_by_mid( 'term', $meta['id'], $meta['value'] );
  412. }
  413. } elseif ( current_user_can( 'delete_term_meta', $term_id ) ) {
  414. delete_metadata_by_mid( 'term', $meta['id'] );
  415. }
  416. } elseif ( current_user_can( 'add_term_meta', $term_id ) ) {
  417. add_term_meta( $term_id, $meta['key'], $meta['value'] );
  418. }
  419. }
  420. }
  421. /**
  422. * Set up blog options property.
  423. *
  424. * Passes property through {@see 'xmlrpc_blog_options'} filter.
  425. *
  426. * @since 2.6.0
  427. */
  428. public function initialise_blog_option_info() {
  429. $this->blog_options = array(
  430. // Read only options
  431. 'software_name' => array(
  432. 'desc' => __( 'Software Name' ),
  433. 'readonly' => true,
  434. 'value' => 'WordPress',
  435. ),
  436. 'software_version' => array(
  437. 'desc' => __( 'Software Version' ),
  438. 'readonly' => true,
  439. 'value' => get_bloginfo( 'version' ),
  440. ),
  441. 'blog_url' => array(
  442. 'desc' => __( 'WordPress Address (URL)' ),
  443. 'readonly' => true,
  444. 'option' => 'siteurl',
  445. ),
  446. 'home_url' => array(
  447. 'desc' => __( 'Site Address (URL)' ),
  448. 'readonly' => true,
  449. 'option' => 'home',
  450. ),
  451. 'login_url' => array(
  452. 'desc' => __( 'Login Address (URL)' ),
  453. 'readonly' => true,
  454. 'value' => wp_login_url(),
  455. ),
  456. 'admin_url' => array(
  457. 'desc' => __( 'The URL to the admin area' ),
  458. 'readonly' => true,
  459. 'value' => get_admin_url(),
  460. ),
  461. 'image_default_link_type' => array(
  462. 'desc' => __( 'Image default link type' ),
  463. 'readonly' => true,
  464. 'option' => 'image_default_link_type',
  465. ),
  466. 'image_default_size' => array(
  467. 'desc' => __( 'Image default size' ),
  468. 'readonly' => true,
  469. 'option' => 'image_default_size',
  470. ),
  471. 'image_default_align' => array(
  472. 'desc' => __( 'Image default align' ),
  473. 'readonly' => true,
  474. 'option' => 'image_default_align',
  475. ),
  476. 'template' => array(
  477. 'desc' => __( 'Template' ),
  478. 'readonly' => true,
  479. 'option' => 'template',
  480. ),
  481. 'stylesheet' => array(
  482. 'desc' => __( 'Stylesheet' ),
  483. 'readonly' => true,
  484. 'option' => 'stylesheet',
  485. ),
  486. 'post_thumbnail' => array(
  487. 'desc' => __( 'Post Thumbnail' ),
  488. 'readonly' => true,
  489. 'value' => current_theme_supports( 'post-thumbnails' ),
  490. ),
  491. // Updatable options
  492. 'time_zone' => array(
  493. 'desc' => __( 'Time Zone' ),
  494. 'readonly' => false,
  495. 'option' => 'gmt_offset',
  496. ),
  497. 'blog_title' => array(
  498. 'desc' => __( 'Site Title' ),
  499. 'readonly' => false,
  500. 'option' => 'blogname',
  501. ),
  502. 'blog_tagline' => array(
  503. 'desc' => __( 'Site Tagline' ),
  504. 'readonly' => false,
  505. 'option' => 'blogdescription',
  506. ),
  507. 'date_format' => array(
  508. 'desc' => __( 'Date Format' ),
  509. 'readonly' => false,
  510. 'option' => 'date_format',
  511. ),
  512. 'time_format' => array(
  513. 'desc' => __( 'Time Format' ),
  514. 'readonly' => false,
  515. 'option' => 'time_format',
  516. ),
  517. 'users_can_register' => array(
  518. 'desc' => __( 'Allow new users to sign up' ),
  519. 'readonly' => false,
  520. 'option' => 'users_can_register',
  521. ),
  522. 'thumbnail_size_w' => array(
  523. 'desc' => __( 'Thumbnail Width' ),
  524. 'readonly' => false,
  525. 'option' => 'thumbnail_size_w',
  526. ),
  527. 'thumbnail_size_h' => array(
  528. 'desc' => __( 'Thumbnail Height' ),
  529. 'readonly' => false,
  530. 'option' => 'thumbnail_size_h',
  531. ),
  532. 'thumbnail_crop' => array(
  533. 'desc' => __( 'Crop thumbnail to exact dimensions' ),
  534. 'readonly' => false,
  535. 'option' => 'thumbnail_crop',
  536. ),
  537. 'medium_size_w' => array(
  538. 'desc' => __( 'Medium size image width' ),
  539. 'readonly' => false,
  540. 'option' => 'medium_size_w',
  541. ),
  542. 'medium_size_h' => array(
  543. 'desc' => __( 'Medium size image height' ),
  544. 'readonly' => false,
  545. 'option' => 'medium_size_h',
  546. ),
  547. 'medium_large_size_w' => array(
  548. 'desc' => __( 'Medium-Large size image width' ),
  549. 'readonly' => false,
  550. 'option' => 'medium_large_size_w',
  551. ),
  552. 'medium_large_size_h' => array(
  553. 'desc' => __( 'Medium-Large size image height' ),
  554. 'readonly' => false,
  555. 'option' => 'medium_large_size_h',
  556. ),
  557. 'large_size_w' => array(
  558. 'desc' => __( 'Large size image width' ),
  559. 'readonly' => false,
  560. 'option' => 'large_size_w',
  561. ),
  562. 'large_size_h' => array(
  563. 'desc' => __( 'Large size image height' ),
  564. 'readonly' => false,
  565. 'option' => 'large_size_h',
  566. ),
  567. 'default_comment_status' => array(
  568. 'desc' => __( 'Allow people to submit comments on new posts.' ),
  569. 'readonly' => false,
  570. 'option' => 'default_comment_status',
  571. ),
  572. 'default_ping_status' => array(
  573. 'desc' => __( 'Allow link notifications from other blogs (pingbacks and trackbacks) on new posts.' ),
  574. 'readonly' => false,
  575. 'option' => 'default_ping_status',
  576. ),
  577. );
  578. /**
  579. * Filters the XML-RPC blog options property.
  580. *
  581. * @since 2.6.0
  582. *
  583. * @param array $blog_options An array of XML-RPC blog options.
  584. */
  585. $this->blog_options = apply_filters( 'xmlrpc_blog_options', $this->blog_options );
  586. }
  587. /**
  588. * Retrieve the blogs of the user.
  589. *
  590. * @since 2.6.0
  591. *
  592. * @param array $args {
  593. * Method arguments. Note: arguments must be ordered as documented.
  594. *
  595. * @type string $username Username.
  596. * @type string $password Password.
  597. * }
  598. * @return array|IXR_Error Array contains:
  599. * - 'isAdmin'
  600. * - 'isPrimary' - whether the blog is the user's primary blog
  601. * - 'url'
  602. * - 'blogid'
  603. * - 'blogName'
  604. * - 'xmlrpc' - url of xmlrpc endpoint
  605. */
  606. public function wp_getUsersBlogs( $args ) {
  607. if ( ! $this->minimum_args( $args, 2 ) ) {
  608. return $this->error;
  609. }
  610. // If this isn't on WPMU then just use blogger_getUsersBlogs
  611. if ( ! is_multisite() ) {
  612. array_unshift( $args, 1 );
  613. return $this->blogger_getUsersBlogs( $args );
  614. }
  615. $this->escape( $args );
  616. $username = $args[0];
  617. $password = $args[1];
  618. $user = $this->login( $username, $password );
  619. if ( ! $user ) {
  620. return $this->error;
  621. }
  622. /**
  623. * Fires after the XML-RPC user has been authenticated but before the rest of
  624. * the method logic begins.
  625. *
  626. * All built-in XML-RPC methods use the action xmlrpc_call, with a parameter
  627. * equal to the method's name, e.g., wp.getUsersBlogs, wp.newPost, etc.
  628. *
  629. * @since 2.5.0
  630. *
  631. * @param string $name The method name.
  632. */
  633. do_action( 'xmlrpc_call', 'wp.getUsersBlogs' );
  634. $blogs = (array) get_blogs_of_user( $user->ID );
  635. $struct = array();
  636. $primary_blog_id = 0;
  637. $active_blog = get_active_blog_for_user( $user->ID );
  638. if ( $active_blog ) {
  639. $primary_blog_id = (int) $active_blog->blog_id;
  640. }
  641. foreach ( $blogs as $blog ) {
  642. // Don't include blogs that aren't hosted at this site.
  643. if ( $blog->site_id != get_current_network_id() ) {
  644. continue;
  645. }
  646. $blog_id = $blog->userblog_id;
  647. switch_to_blog( $blog_id );
  648. $is_admin = current_user_can( 'manage_options' );
  649. $is_primary = ( (int) $blog_id === $primary_blog_id );
  650. $struct[] = array(
  651. 'isAdmin' => $is_admin,
  652. 'isPrimary' => $is_primary,
  653. 'url' => home_url( '/' ),
  654. 'blogid' => (string) $blog_id,
  655. 'blogName' => get_option( 'blogname' ),
  656. 'xmlrpc' => site_url( 'xmlrpc.php', 'rpc' ),
  657. );
  658. restore_current_blog();
  659. }
  660. return $struct;
  661. }
  662. /**
  663. * Checks if the method received at least the minimum number of arguments.
  664. *
  665. * @since 3.4.0
  666. *
  667. * @param array $args An array of arguments to check.
  668. * @param int $count Minimum number of arguments.
  669. * @return bool True if `$args` contains at least `$count` arguments, false otherwise.
  670. */
  671. protected function minimum_args( $args, $count ) {
  672. if ( ! is_array( $args ) || count( $args ) < $count ) {
  673. $this->error = new IXR_Error( 400, __( 'Insufficient arguments passed to this XML-RPC method.' ) );
  674. return false;
  675. }
  676. return true;
  677. }
  678. /**
  679. * Prepares taxonomy data for return in an XML-RPC object.
  680. *
  681. * @param object $taxonomy The unprepared taxonomy data.
  682. * @param array $fields The subset of taxonomy fields to return.
  683. * @return array The prepared taxonomy data.
  684. */
  685. protected function _prepare_taxonomy( $taxonomy, $fields ) {
  686. $_taxonomy = array(
  687. 'name' => $taxonomy->name,
  688. 'label' => $taxonomy->label,
  689. 'hierarchical' => (bool) $taxonomy->hierarchical,
  690. 'public' => (bool) $taxonomy->public,
  691. 'show_ui' => (bool) $taxonomy->show_ui,
  692. '_builtin' => (bool) $taxonomy->_builtin,
  693. );
  694. if ( in_array( 'labels', $fields ) ) {
  695. $_taxonomy['labels'] = (array) $taxonomy->labels;
  696. }
  697. if ( in_array( 'cap', $fields ) ) {
  698. $_taxonomy['cap'] = (array) $taxonomy->cap;
  699. }
  700. if ( in_array( 'menu', $fields ) ) {
  701. $_taxonomy['show_in_menu'] = (bool) $_taxonomy->show_in_menu;
  702. }
  703. if ( in_array( 'object_type', $fields ) ) {
  704. $_taxonomy['object_type'] = array_unique( (array) $taxonomy->object_type );
  705. }
  706. /**
  707. * Filters XML-RPC-prepared data for the given taxonomy.
  708. *
  709. * @since 3.4.0
  710. *
  711. * @param array $_taxonomy An array of taxonomy data.
  712. * @param WP_Taxonomy $taxonomy Taxonomy object.
  713. * @param array $fields The subset of taxonomy fields to return.
  714. */
  715. return apply_filters( 'xmlrpc_prepare_taxonomy', $_taxonomy, $taxonomy, $fields );
  716. }
  717. /**
  718. * Prepares term data for return in an XML-RPC object.
  719. *
  720. * @param array|object $term The unprepared term data.
  721. * @return array The prepared term data.
  722. */
  723. protected function _prepare_term( $term ) {
  724. $_term = $term;
  725. if ( ! is_array( $_term ) ) {
  726. $_term = get_object_vars( $_term );
  727. }
  728. // For integers which may be larger than XML-RPC supports ensure we return strings.
  729. $_term['term_id'] = strval( $_term['term_id'] );
  730. $_term['term_group'] = strval( $_term['term_group'] );
  731. $_term['term_taxonomy_id'] = strval( $_term['term_taxonomy_id'] );
  732. $_term['parent'] = strval( $_term['parent'] );
  733. // Count we are happy to return as an integer because people really shouldn't use terms that much.
  734. $_term['count'] = intval( $_term['count'] );
  735. // Get term meta.
  736. $_term['custom_fields'] = $this->get_term_custom_fields( $_term['term_id'] );
  737. /**
  738. * Filters XML-RPC-prepared data for the given term.
  739. *
  740. * @since 3.4.0
  741. *
  742. * @param array $_term An array of term data.
  743. * @param array|object $term Term object or array.
  744. */
  745. return apply_filters( 'xmlrpc_prepare_term', $_term, $term );
  746. }
  747. /**
  748. * Convert a WordPress date string to an IXR_Date object.
  749. *
  750. * @param string $date Date string to convert.
  751. * @return IXR_Date IXR_Date object.
  752. */
  753. protected function _convert_date( $date ) {
  754. if ( $date === '0000-00-00 00:00:00' ) {
  755. return new IXR_Date( '00000000T00:00:00Z' );
  756. }
  757. return new IXR_Date( mysql2date( 'Ymd\TH:i:s', $date, false ) );
  758. }
  759. /**
  760. * Convert a WordPress GMT date string to an IXR_Date object.
  761. *
  762. * @param string $date_gmt WordPress GMT date string.
  763. * @param string $date Date string.
  764. * @return IXR_Date IXR_Date object.
  765. */
  766. protected function _convert_date_gmt( $date_gmt, $date ) {
  767. if ( $date !== '0000-00-00 00:00:00' && $date_gmt === '0000-00-00 00:00:00' ) {
  768. return new IXR_Date( get_gmt_from_date( mysql2date( 'Y-m-d H:i:s', $date, false ), 'Ymd\TH:i:s' ) );
  769. }
  770. return $this->_convert_date( $date_gmt );
  771. }
  772. /**
  773. * Prepares post data for return in an XML-RPC object.
  774. *
  775. * @param array $post The unprepared post data.
  776. * @param array $fields The subset of post type fields to return.
  777. * @return array The prepared post data.
  778. */
  779. protected function _prepare_post( $post, $fields ) {
  780. // Holds the data for this post. built up based on $fields.
  781. $_post = array( 'post_id' => strval( $post['ID'] ) );
  782. // Prepare common post fields.
  783. $post_fields = array(
  784. 'post_title' => $post['post_title'],
  785. 'post_date' => $this->_convert_date( $post['post_date'] ),
  786. 'post_date_gmt' => $this->_convert_date_gmt( $post['post_date_gmt'], $post['post_date'] ),
  787. 'post_modified' => $this->_convert_date( $post['post_modified'] ),
  788. 'post_modified_gmt' => $this->_convert_date_gmt( $post['post_modified_gmt'], $post['post_modified'] ),
  789. 'post_status' => $post['post_status'],
  790. 'post_type' => $post['post_type'],
  791. 'post_name' => $post['post_name'],
  792. 'post_author' => $post['post_author'],
  793. 'post_password' => $post['post_password'],
  794. 'post_excerpt' => $post['post_excerpt'],
  795. 'post_content' => $post['post_content'],
  796. 'post_parent' => strval( $post['post_parent'] ),
  797. 'post_mime_type' => $post['post_mime_type'],
  798. 'link' => get_permalink( $post['ID'] ),
  799. 'guid' => $post['guid'],
  800. 'menu_order' => intval( $post['menu_order'] ),
  801. 'comment_status' => $post['comment_status'],
  802. 'ping_status' => $post['ping_status'],
  803. 'sticky' => ( $post['post_type'] === 'post' && is_sticky( $post['ID'] ) ),
  804. );
  805. // Thumbnail.
  806. $post_fields['post_thumbnail'] = array();
  807. $thumbnail_id = get_post_thumbnail_id( $post['ID'] );
  808. if ( $thumbnail_id ) {
  809. $thumbnail_size = current_theme_supports( 'post-thumbnail' ) ? 'post-thumbnail' : 'thumbnail';
  810. $post_fields['post_thumbnail'] = $this->_prepare_media_item( get_post( $thumbnail_id ), $thumbnail_size );
  811. }
  812. // Consider future posts as published.
  813. if ( $post_fields['post_status'] === 'future' ) {
  814. $post_fields['post_status'] = 'publish';
  815. }
  816. // Fill in blank post format.
  817. $post_fields['post_format'] = get_post_format( $post['ID'] );
  818. if ( empty( $post_fields['post_format'] ) ) {
  819. $post_fields['post_format'] = 'standard';
  820. }
  821. // Merge requested $post_fields fields into $_post.
  822. if ( in_array( 'post', $fields ) ) {
  823. $_post = array_merge( $_post, $post_fields );
  824. } else {
  825. $requested_fields = array_intersect_key( $post_fields, array_flip( $fields ) );
  826. $_post = array_merge( $_post, $requested_fields );
  827. }
  828. $all_taxonomy_fields = in_array( 'taxonomies', $fields );
  829. if ( $all_taxonomy_fields || in_array( 'terms', $fields ) ) {
  830. $post_type_taxonomies = get_object_taxonomies( $post['post_type'], 'names' );
  831. $terms = wp_get_object_terms( $post['ID'], $post_type_taxonomies );
  832. $_post['terms'] = array();
  833. foreach ( $terms as $term ) {
  834. $_post['terms'][] = $this->_prepare_term( $term );
  835. }
  836. }
  837. if ( in_array( 'custom_fields', $fields ) ) {
  838. $_post['custom_fields'] = $this->get_custom_fields( $post['ID'] );
  839. }
  840. if ( in_array( 'enclosure', $fields ) ) {
  841. $_post['enclosure'] = array();
  842. $enclosures = (array) get_post_meta( $post['ID'], 'enclosure' );
  843. if ( ! empty( $enclosures ) ) {
  844. $encdata = explode( "\n", $enclosures[0] );
  845. $_post['enclosure']['url'] = trim( htmlspecialchars( $encdata[0] ) );
  846. $_post['enclosure']['length'] = (int) trim( $encdata[1] );
  847. $_post['enclosure']['type'] = trim( $encdata[2] );
  848. }
  849. }
  850. /**
  851. * Filters XML-RPC-prepared date for the given post.
  852. *
  853. * @since 3.4.0
  854. *
  855. * @param array $_post An array of modified post data.
  856. * @param array $post An array of post data.
  857. * @param array $fields An array of post fields.
  858. */
  859. return apply_filters( 'xmlrpc_prepare_post', $_post, $post, $fields );
  860. }
  861. /**
  862. * Prepares post data for return in an XML-RPC object.
  863. *
  864. * @since 3.4.0
  865. * @since 4.6.0 Converted the `$post_type` parameter to accept a WP_Post_Type object.
  866. *
  867. * @param WP_Post_Type $post_type Post type object.
  868. * @param array $fields The subset of post fields to return.
  869. * @return array The prepared post type data.
  870. */
  871. protected function _prepare_post_type( $post_type, $fields ) {
  872. $_post_type = array(
  873. 'name' => $post_type->name,
  874. 'label' => $post_type->label,
  875. 'hierarchical' => (bool) $post_type->hierarchical,
  876. 'public' => (bool) $post_type->public,
  877. 'show_ui' => (bool) $post_type->show_ui,
  878. '_builtin' => (bool) $post_type->_builtin,
  879. 'has_archive' => (bool) $post_type->has_archive,
  880. 'supports' => get_all_post_type_supports( $post_type->name ),
  881. );
  882. if ( in_array( 'labels', $fields ) ) {
  883. $_post_type['labels'] = (array) $post_type->labels;
  884. }
  885. if ( in_array( 'cap', $fields ) ) {
  886. $_post_type['cap'] = (array) $post_type->cap;
  887. $_post_type['map_meta_cap'] = (bool) $post_type->map_meta_cap;
  888. }
  889. if ( in_array( 'menu', $fields ) ) {
  890. $_post_type['menu_position'] = (int) $post_type->menu_position;
  891. $_post_type['menu_icon'] = $post_type->menu_icon;
  892. $_post_type['show_in_menu'] = (bool) $post_type->show_in_menu;
  893. }
  894. if ( in_array( 'taxonomies', $fields ) ) {
  895. $_post_type['taxonomies'] = get_object_taxonomies( $post_type->name, 'names' );
  896. }
  897. /**
  898. * Filters XML-RPC-prepared date for the given post type.
  899. *
  900. * @since 3.4.0
  901. * @since 4.6.0 Converted the `$post_type` parameter to accept a WP_Post_Type object.
  902. *
  903. * @param array $_post_type An array of post type data.
  904. * @param WP_Post_Type $post_type Post type object.
  905. */
  906. return apply_filters( 'xmlrpc_prepare_post_type', $_post_type, $post_type );
  907. }
  908. /**
  909. * Prepares media item data for return in an XML-RPC object.
  910. *
  911. * @param object $media_item The unprepared media item data.
  912. * @param string $thumbnail_size The image size to use for the thumbnail URL.
  913. * @return array The prepared media item data.
  914. */
  915. protected function _prepare_media_item( $media_item, $thumbnail_size = 'thumbnail' ) {
  916. $_media_item = array(
  917. 'attachment_id' => strval( $media_item->ID ),
  918. 'date_created_gmt' => $this->_convert_date_gmt( $media_item->post_date_gmt, $media_item->post_date ),
  919. 'parent' => $media_item->post_parent,
  920. 'link' => wp_get_attachment_url( $media_item->ID ),
  921. 'title' => $media_item->post_title,
  922. 'caption' => $media_item->post_excerpt,
  923. 'description' => $media_item->post_content,
  924. 'metadata' => wp_get_attachment_metadata( $media_item->ID ),
  925. 'type' => $media_item->post_mime_type,
  926. );
  927. $thumbnail_src = image_downsize( $media_item->ID, $thumbnail_size );
  928. if ( $thumbnail_src ) {
  929. $_media_item['thumbnail'] = $thumbnail_src[0];
  930. } else {
  931. $_media_item['thumbnail'] = $_media_item['link'];
  932. }
  933. /**
  934. * Filters XML-RPC-prepared data for the given media item.
  935. *
  936. * @since 3.4.0
  937. *
  938. * @param array $_media_item An array of media item data.
  939. * @param object $media_item Media item object.
  940. * @param string $thumbnail_size Image size.
  941. */
  942. return apply_filters( 'xmlrpc_prepare_media_item', $_media_item, $media_item, $thumbnail_size );
  943. }
  944. /**
  945. * Prepares page data for return in an XML-RPC object.
  946. *
  947. * @param object $page The unprepared page data.
  948. * @return array The prepared page data.
  949. */
  950. protected function _prepare_page( $page ) {
  951. // Get all of the page content and link.
  952. $full_page = get_extended( $page->post_content );
  953. $link = get_permalink( $page->ID );
  954. // Get info the page parent if there is one.
  955. $parent_title = '';
  956. if ( ! empty( $page->post_parent ) ) {
  957. $parent = get_post( $page->post_parent );
  958. $parent_title = $parent->post_title;
  959. }
  960. // Determine comment and ping settings.
  961. $allow_comments = comments_open( $page->ID ) ? 1 : 0;
  962. $allow_pings = pings_open( $page->ID ) ? 1 : 0;
  963. // Format page date.
  964. $page_date = $this->_convert_date( $page->post_date );
  965. $page_date_gmt = $this->_convert_date_gmt( $page->post_date_gmt, $page->post_date );
  966. // Pull the categories info together.
  967. $categories = array();
  968. if ( is_object_in_taxonomy( 'page', 'category' ) ) {
  969. foreach ( wp_get_post_categories( $page->ID ) as $cat_id ) {
  970. $categories[] = get_cat_name( $cat_id );
  971. }
  972. }
  973. // Get the author info.
  974. $author = get_userdata( $page->post_author );
  975. $page_template = get_page_template_slug( $page->ID );
  976. if ( empty( $page_template ) ) {
  977. $page_template = 'default';
  978. }
  979. $_page = array(
  980. 'dateCreated' => $page_date,
  981. 'userid' => $page->post_author,
  982. 'page_id' => $page->ID,
  983. 'page_status' => $page->post_status,
  984. 'description' => $full_page['main'],
  985. 'title' => $page->post_title,
  986. 'link' => $link,
  987. 'permaLink' => $link,
  988. 'categories' => $categories,
  989. 'excerpt' => $page->post_excerpt,
  990. 'text_more' => $full_page['extended'],
  991. 'mt_allow_comments' => $allow_comments,
  992. 'mt_allow_pings' => $allow_pings,
  993. 'wp_slug' => $page->post_name,
  994. 'wp_password' => $page->post_password,
  995. 'wp_author' => $author->display_name,
  996. 'wp_page_parent_id' => $page->post_parent,
  997. 'wp_page_parent_title' => $parent_title,
  998. 'wp_page_order' => $page->menu_order,
  999. 'wp_author_id' => (string) $author->ID,
  1000. 'wp_author_display_name' => $author->display_name,
  1001. 'date_created_gmt' => $page_date_gmt,
  1002. 'custom_fields' => $this->get_custom_fields( $page->ID ),
  1003. 'wp_page_template' => $page_template,
  1004. );
  1005. /**
  1006. * Filters XML-RPC-prepared data for the given page.
  1007. *
  1008. * @since 3.4.0
  1009. *
  1010. * @param array $_page An array of page data.
  1011. * @param WP_Post $page Page object.
  1012. */
  1013. return apply_filters( 'xmlrpc_prepare_page', $_page, $page );
  1014. }
  1015. /**
  1016. * Prepares comment data for return in an XML-RPC object.
  1017. *
  1018. * @param object $comment The unprepared comment data.
  1019. * @return array The prepared comment data.
  1020. */
  1021. protected function _prepare_comment( $comment ) {
  1022. // Format page date.
  1023. $comment_date_gmt = $this->_convert_date_gmt( $comment->comment_date_gmt, $comment->comment_date );
  1024. if ( '0' == $comment->comment_approved ) {
  1025. $comment_status = 'hold';
  1026. } elseif ( 'spam' == $comment->comment_approved ) {
  1027. $comment_status = 'spam';
  1028. } elseif ( '1' == $comment->comment_approved ) {
  1029. $comment_status = 'approve';
  1030. } else {
  1031. $comment_status = $comment->comment_approved;
  1032. }
  1033. $_comment = array(
  1034. 'date_created_gmt' => $comment_date_gmt,
  1035. 'user_id' => $comment->user_id,
  1036. 'comment_id' => $comment->comment_ID,
  1037. 'parent' => $comment->comment_parent,
  1038. 'status' => $comment_status,
  1039. 'content' => $comment->comment_content,
  1040. 'link' => get_comment_link( $comment ),
  1041. 'post_id' => $comment->comment_post_ID,
  1042. 'post_title' => get_the_title( $comment->comment_post_ID ),
  1043. 'author' => $comment->comment_author,
  1044. 'author_url' => $comment->comment_author_url,
  1045. 'author_email' => $comment->comment_author_email,
  1046. 'author_ip' => $comment->comment_author_IP,
  1047. 'type' => $comment->comment_type,
  1048. );
  1049. /**
  1050. * Filters XML-RPC-prepared data for the given comment.
  1051. *
  1052. * @since 3.4.0
  1053. *
  1054. * @param array $_comment An array of prepared comment data.
  1055. * @param WP_Comment $comment Comment object.
  1056. */
  1057. return apply_filters( 'xmlrpc_prepare_comment', $_comment, $comment );
  1058. }
  1059. /**
  1060. * Prepares user data for return in an XML-RPC object.
  1061. *
  1062. * @param WP_User $user The unprepared user object.
  1063. * @param array $fields The subset of user fields to return.
  1064. * @return array The prepared user data.
  1065. */
  1066. protected function _prepare_user( $user, $fields ) {
  1067. $_user = array( 'user_id' => strval( $user->ID ) );
  1068. $user_fields = array(
  1069. 'username' => $user->user_login,
  1070. 'first_name' => $user->user_firstname,
  1071. 'last_name' => $user->user_lastname,
  1072. 'registered' => $this->_convert_date( $user->user_registered ),
  1073. 'bio' => $user->user_description,
  1074. 'email' => $user->user_email,
  1075. 'nickname' => $user->nickname,
  1076. 'nicename' => $user->user_nicename,
  1077. 'url' => $user->user_url,
  1078. 'display_name' => $user->display_name,
  1079. 'roles' => $user->roles,
  1080. );
  1081. if ( in_array( 'all', $fields ) ) {
  1082. $_user = array_merge( $_user, $user_fields );
  1083. } else {
  1084. if ( in_array( 'basic', $fields ) ) {
  1085. $basic_fields = array( 'username', 'email', 'registered', 'display_name', 'nicename' );
  1086. $fields = array_merge( $fields, $basic_fields );
  1087. }
  1088. $requested_fields = array_intersect_key( $user_fields, array_flip( $fields ) );
  1089. $_user = array_merge( $_user, $requested_fields );
  1090. }
  1091. /**
  1092. * Filters XML-RPC-prepared data for the given user.
  1093. *
  1094. * @since 3.5.0
  1095. *
  1096. * @param array $_user An array of user data.
  1097. * @param WP_User $user User object.
  1098. * @param array $fields An array of user fields.
  1099. */
  1100. return apply_filters( 'xmlrpc_prepare_user', $_user, $user, $fields );
  1101. }
  1102. /**
  1103. * Create a new post for any registered post type.
  1104. *
  1105. * @since 3.4.0
  1106. *
  1107. * @link https://en.wikipedia.org/wiki/RSS_enclosure for information on RSS enclosures.
  1108. *
  1109. * @param array $args {
  1110. * Method arguments. Note: top-level arguments must be ordered as documented.
  1111. *
  1112. * @type int $blog_id Blog ID (unused).
  1113. * @type string $username Username.
  1114. * @type string $password Password.
  1115. * @type array $content_struct {
  1116. * Content struct for adding a new post. See wp_insert_post() for information on
  1117. * additional post fields
  1118. *
  1119. * @type string $post_type Post type. Default 'post'.
  1120. * @type string $post_status Post status. Default 'draft'
  1121. * @type string $post_title Post title.
  1122. * @type int $post_author Post author ID.
  1123. * @type string $post_excerpt Post excerpt.
  1124. * @type string $post_content Post content.
  1125. * @type string $post_date_gmt Post date in GMT.
  1126. * @type string $post_date Post date.
  1127. * @type string $post_password Post password (20-character limit).
  1128. * @type string $comment_status Post comment enabled status. Accepts 'open' or 'closed'.
  1129. * @type string $ping_status Post ping status. Accepts 'open' or 'closed'.
  1130. * @type bool $sticky Whether the post should be sticky. Automatically false if
  1131. * `$post_status` is 'private'.
  1132. * @type int $post_thumbnail ID of an image to use as the post thumbnail/featured image.
  1133. * @type array $custom_fields Array of meta key/value pairs to add to the post.
  1134. * @type array $terms Associative array with taxonomy names as keys and arrays
  1135. * of term IDs as values.
  1136. * @type array $terms_names Associative array with taxonomy names as keys and arrays
  1137. * of term names as values.
  1138. * @type array $enclosure {
  1139. * Array of feed enclosure data to add to post meta.
  1140. *
  1141. * @type string $url URL for the feed enclosure.
  1142. * @type int $length Size in bytes of the enclosure.
  1143. * @type string $type Mime-type for the enclosure.
  1144. * }
  1145. * }
  1146. * }
  1147. * @return int|IXR_Error Post ID on success, IXR_Error instance otherwise.
  1148. */
  1149. public function wp_newPost( $args ) {
  1150. if ( ! $this->minimum_args( $args, 4 ) ) {
  1151. return $this->error;
  1152. }
  1153. $this->escape( $args );
  1154. $username = $args[1];
  1155. $password = $args[2];
  1156. $content_struct = $args[3];
  1157. $user = $this->login( $username, $password );
  1158. if ( ! $user ) {
  1159. return $this->error;
  1160. }
  1161. // convert the date field back to IXR form
  1162. if ( isset( $content_struct['post_date'] ) && ! ( $content_struct['post_date'] instanceof IXR_Date ) ) {
  1163. $content_struct['post_date'] = $this->_convert_date( $content_struct['post_date'] );
  1164. }
  1165. // ignore the existing GMT date if it is empty or a non-GMT date was supplied in $content_struct,
  1166. // since _insert_post will ignore the non-GMT date if the GMT date is set
  1167. if ( isset( $content_struct['post_date_gmt'] ) && ! ( $content_struct['post_date_gmt'] instanceof IXR_Date ) ) {
  1168. if ( $content_struct['post_date_gmt'] == '0000-00-00 00:00:00' || isset( $content_struct['post_date'] ) ) {
  1169. unset( $content_struct['post_date_gmt'] );
  1170. } else {
  1171. $content_struct['post_date_gmt'] = $this->_convert_date( $content_struct['post_date_gmt'] );
  1172. }
  1173. }
  1174. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1175. do_action( 'xmlrpc_call', 'wp.newPost' );
  1176. unset( $content_struct['ID'] );
  1177. return $this->_insert_post( $user, $content_struct );
  1178. }
  1179. /**
  1180. * Helper method for filtering out elements from an array.
  1181. *
  1182. * @since 3.4.0
  1183. *
  1184. * @param int $count Number to compare to one.
  1185. */
  1186. private function _is_greater_than_one( $count ) {
  1187. return $count > 1;
  1188. }
  1189. /**
  1190. * Encapsulate the logic for sticking a post
  1191. * and determining if the user has permission to do so
  1192. *
  1193. * @since 4.3.0
  1194. *
  1195. * @param array $post_data
  1196. * @param bool $update
  1197. * @return void|IXR_Error
  1198. */
  1199. private function _toggle_sticky( $post_data, $update = false ) {
  1200. $post_type = get_post_type_object( $post_data['post_type'] );
  1201. // Private and password-protected posts cannot be stickied.
  1202. if ( 'private' === $post_data['post_status'] || ! empty( $post_data['post_password'] ) ) {
  1203. // Error if the client tried to stick the post, otherwise, silently unstick.
  1204. if ( ! empty( $post_data['sticky'] ) ) {
  1205. return new IXR_Error( 401, __( 'Sorry, you cannot stick a private post.' ) );
  1206. }
  1207. if ( $update ) {
  1208. unstick_post( $post_data['ID'] );
  1209. }
  1210. } elseif ( isset( $post_data['sticky'] ) ) {
  1211. if ( ! current_user_can( $post_type->cap->edit_others_posts ) ) {
  1212. return new IXR_Error( 401, __( 'Sorry, you are not allowed to make posts sticky.' ) );
  1213. }
  1214. $sticky = wp_validate_boolean( $post_data['sticky'] );
  1215. if ( $sticky ) {
  1216. stick_post( $post_data['ID'] );
  1217. } else {
  1218. unstick_post( $post_data['ID'] );
  1219. }
  1220. }
  1221. }
  1222. /**
  1223. * Helper method for wp_newPost() and wp_editPost(), containing shared logic.
  1224. *
  1225. * @since 3.4.0
  1226. *
  1227. * @see wp_insert_post()
  1228. *
  1229. * @param WP_User $user The post author if post_author isn't set in $content_struct.
  1230. * @param array|IXR_Error $content_struct Post data to insert.
  1231. * @return IXR_Error|string
  1232. */
  1233. protected function _insert_post( $user, $content_struct ) {
  1234. $defaults = array(
  1235. 'post_status' => 'draft',
  1236. 'post_type' => 'post',
  1237. 'post_author' => null,
  1238. 'post_password' => null,
  1239. 'post_excerpt' => null,
  1240. 'post_content' => null,
  1241. 'post_title' => null,
  1242. 'post_date' => null,
  1243. 'post_date_gmt' => null,
  1244. 'post_format' => null,
  1245. 'post_name' => null,
  1246. 'post_thumbnail' => null,
  1247. 'post_parent' => null,
  1248. 'ping_status' => null,
  1249. 'comment_status' => null,
  1250. 'custom_fields' => null,
  1251. 'terms_names' => null,
  1252. 'terms' => null,
  1253. 'sticky' => null,
  1254. 'enclosure' => null,
  1255. 'ID' => null,
  1256. );
  1257. $post_data = wp_parse_args( array_intersect_key( $content_struct, $defaults ), $defaults );
  1258. $post_type = get_post_type_object( $post_data['post_type'] );
  1259. if ( ! $post_type ) {
  1260. return new IXR_Error( 403, __( 'Invalid post type.' ) );
  1261. }
  1262. $update = ! empty( $post_data['ID'] );
  1263. if ( $update ) {
  1264. if ( ! get_post( $post_data['ID'] ) ) {
  1265. return new IXR_Error( 401, __( 'Invalid post ID.' ) );
  1266. }
  1267. if ( ! current_user_can( 'edit_post', $post_data['ID'] ) ) {
  1268. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  1269. }
  1270. if ( $post_data['post_type'] != get_post_type( $post_data['ID'] ) ) {
  1271. return new IXR_Error( 401, __( 'The post type may not be changed.' ) );
  1272. }
  1273. } else {
  1274. if ( ! current_user_can( $post_type->cap->create_posts ) || ! current_user_can( $post_type->cap->edit_posts ) ) {
  1275. return new IXR_Error( 401, __( 'Sorry, you are not allowed to post on this site.' ) );
  1276. }
  1277. }
  1278. switch ( $post_data['post_status'] ) {
  1279. case 'draft':
  1280. case 'pending':
  1281. break;
  1282. case 'private':
  1283. if ( ! current_user_can( $post_type->cap->publish_posts ) ) {
  1284. return new IXR_Error( 401, __( 'Sorry, you are not allowed to create private posts in this post type.' ) );
  1285. }
  1286. break;
  1287. case 'publish':
  1288. case 'future':
  1289. if ( ! current_user_can( $post_type->cap->publish_posts ) ) {
  1290. return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish posts in this post type.' ) );
  1291. }
  1292. break;
  1293. default:
  1294. if ( ! get_post_status_object( $post_data['post_status'] ) ) {
  1295. $post_data['post_status'] = 'draft';
  1296. }
  1297. break;
  1298. }
  1299. if ( ! empty( $post_data['post_password'] ) && ! current_user_can( $post_type->cap->publish_posts ) ) {
  1300. return new IXR_Error( 401, __( 'Sorry, you are not allowed to create password protected posts in this post type.' ) );
  1301. }
  1302. $post_data['post_author'] = absint( $post_data['post_author'] );
  1303. if ( ! empty( $post_data['post_author'] ) && $post_data['post_author'] != $user->ID ) {
  1304. if ( ! current_user_can( $post_type->cap->edit_others_posts ) ) {
  1305. return new IXR_Error( 401, __( 'Sorry, you are not allowed to create posts as this user.' ) );
  1306. }
  1307. $author = get_userdata( $post_data['post_author'] );
  1308. if ( ! $author ) {
  1309. return new IXR_Error( 404, __( 'Invalid author ID.' ) );
  1310. }
  1311. } else {
  1312. $post_data['post_author'] = $user->ID;
  1313. }
  1314. if ( isset( $post_data['comment_status'] ) && $post_data['comment_status'] != 'open' && $post_data['comment_status'] != 'closed' ) {
  1315. unset( $post_data['comment_status'] );
  1316. }
  1317. if ( isset( $post_data['ping_status'] ) && $post_data['ping_status'] != 'open' && $post_data['ping_status'] != 'closed' ) {
  1318. unset( $post_data['ping_status'] );
  1319. }
  1320. // Do some timestamp voodoo.
  1321. if ( ! empty( $post_data['post_date_gmt'] ) ) {
  1322. // We know this is supposed to be GMT, so we're going to slap that Z on there by force.
  1323. $dateCreated = rtrim( $post_data['post_date_gmt']->getIso(), 'Z' ) . 'Z';
  1324. } elseif ( ! empty( $post_data['post_date'] ) ) {
  1325. $dateCreated = $post_data['post_date']->getIso();
  1326. }
  1327. // Default to not flagging the post date to be edited unless it's intentional.
  1328. $post_data['edit_date'] = false;
  1329. if ( ! empty( $dateCreated ) ) {
  1330. $post_data['post_date'] = get_date_from_gmt( iso8601_to_datetime( $dateCreated ) );
  1331. $post_data['post_date_gmt'] = iso8601_to_datetime( $dateCreated, 'GMT' );
  1332. // Flag the post date to be edited.
  1333. $post_data['edit_date'] = true;
  1334. }
  1335. if ( ! isset( $post_data['ID'] ) ) {
  1336. $post_data['ID'] = get_default_post_to_edit( $post_data['post_type'], true )->ID;
  1337. }
  1338. $post_ID = $post_data['ID'];
  1339. if ( $post_data['post_type'] == 'post' ) {
  1340. $error = $this->_toggle_sticky( $post_data, $update );
  1341. if ( $error ) {
  1342. return $error;
  1343. }
  1344. }
  1345. if ( isset( $post_data['post_thumbnail'] ) ) {
  1346. // empty value deletes, non-empty value adds/updates.
  1347. if ( ! $post_data['post_thumbnail'] ) {
  1348. delete_post_thumbnail( $post_ID );
  1349. } elseif ( ! get_post( absint( $post_data['post_thumbnail'] ) ) ) {
  1350. return new IXR_Error( 404, __( 'Invalid attachment ID.' ) );
  1351. }
  1352. set_post_thumbnail( $post_ID, $post_data['post_thumbnail'] );
  1353. unset( $content_struct['post_thumbnail'] );
  1354. }
  1355. if ( isset( $post_data['custom_fields'] ) ) {
  1356. $this->set_custom_fields( $post_ID, $post_data['custom_fields'] );
  1357. }
  1358. if ( isset( $post_data['terms'] ) || isset( $post_data['terms_names'] ) ) {
  1359. $post_type_taxonomies = get_object_taxonomies( $post_data['post_type'], 'objects' );
  1360. // Accumulate term IDs from terms and terms_names.
  1361. $terms = array();
  1362. // First validate the terms specified by ID.
  1363. if ( isset( $post_data['terms'] ) && is_array( $post_data['terms'] ) ) {
  1364. $taxonomies = array_keys( $post_data['terms'] );
  1365. // Validating term ids.
  1366. foreach ( $taxonomies as $taxonomy ) {
  1367. if ( ! array_key_exists( $taxonomy, $post_type_taxonomies ) ) {
  1368. return new IXR_Error( 401, __( 'Sorry, one of the given taxonomies is not supported by the post type.' ) );
  1369. }
  1370. if ( ! current_user_can( $post_type_taxonomies[ $taxonomy ]->cap->assign_terms ) ) {
  1371. return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign a term to one of the given taxonomies.' ) );
  1372. }
  1373. $term_ids = $post_data['terms'][ $taxonomy ];
  1374. $terms[ $taxonomy ] = array();
  1375. foreach ( $term_ids as $term_id ) {
  1376. $term = get_term_by( 'id', $term_id, $taxonomy );
  1377. if ( ! $term ) {
  1378. return new IXR_Error( 403, __( 'Invalid term ID.' ) );
  1379. }
  1380. $terms[ $taxonomy ][] = (int) $term_id;
  1381. }
  1382. }
  1383. }
  1384. // Now validate terms specified by name.
  1385. if ( isset( $post_data['terms_names'] ) && is_array( $post_data['terms_names'] ) ) {
  1386. $taxonomies = array_keys( $post_data['terms_names'] );
  1387. foreach ( $taxonomies as $taxonomy ) {
  1388. if ( ! array_key_exists( $taxonomy, $post_type_taxonomies ) ) {
  1389. return new IXR_Error( 401, __( 'Sorry, one of the given taxonomies is not supported by the post type.' ) );
  1390. }
  1391. if ( ! current_user_can( $post_type_taxonomies[ $taxonomy ]->cap->assign_terms ) ) {
  1392. return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign a term to one of the given taxonomies.' ) );
  1393. }
  1394. /*
  1395. * For hierarchical taxonomies, we can't assign a term when multiple terms
  1396. * in the hierarchy share the same name.
  1397. */
  1398. $ambiguous_terms = array();
  1399. if ( is_taxonomy_hierarchical( $taxonomy ) ) {
  1400. $tax_term_names = get_terms(
  1401. array(
  1402. 'taxonomy' => $taxonomy,
  1403. 'fields' => 'names',
  1404. 'hide_empty' => false,
  1405. )
  1406. );
  1407. // Count the number of terms with the same name.
  1408. $tax_term_names_count = array_count_values( $tax_term_names );
  1409. // Filter out non-ambiguous term names.
  1410. $ambiguous_tax_term_counts = array_filter( $tax_term_names_count, array( $this, '_is_greater_than_one' ) );
  1411. $ambiguous_terms = array_keys( $ambiguous_tax_term_counts );
  1412. }
  1413. $term_names = $post_data['terms_names'][ $taxonomy ];
  1414. foreach ( $term_names as $term_name ) {
  1415. if ( in_array( $term_name, $ambiguous_terms ) ) {
  1416. return new IXR_Error( 401, __( 'Ambiguous term name used in a hierarchical taxonomy. Please use term ID instead.' ) );
  1417. }
  1418. $term = get_term_by( 'name', $term_name, $taxonomy );
  1419. if ( ! $term ) {
  1420. // Term doesn't exist, so check that the user is allowed to create new terms.
  1421. if ( ! current_user_can( $post_type_taxonomies[ $taxonomy ]->cap->edit_terms ) ) {
  1422. return new IXR_Error( 401, __( 'Sorry, you are not allowed to add a term to one of the given taxonomies.' ) );
  1423. }
  1424. // Create the new term.
  1425. $term_info = wp_insert_term( $term_name, $taxonomy );
  1426. if ( is_wp_error( $term_info ) ) {
  1427. return new IXR_Error( 500, $term_info->get_error_message() );
  1428. }
  1429. $terms[ $taxonomy ][] = (int) $term_info['term_id'];
  1430. } else {
  1431. $terms[ $taxonomy ][] = (int) $term->term_id;
  1432. }
  1433. }
  1434. }
  1435. }
  1436. $post_data['tax_input'] = $terms;
  1437. unset( $post_data['terms'], $post_data['terms_names'] );
  1438. }
  1439. if ( isset( $post_data['post_format'] ) ) {
  1440. $format = set_post_format( $post_ID, $post_data['post_format'] );
  1441. if ( is_wp_error( $format ) ) {
  1442. return new IXR_Error( 500, $format->get_error_message() );
  1443. }
  1444. unset( $post_data['post_format'] );
  1445. }
  1446. // Handle enclosures.
  1447. $enclosure = isset( $post_data['enclosure'] ) ? $post_data['enclosure'] : null;
  1448. $this->add_enclosure_if_new( $post_ID, $enclosure );
  1449. $this->attach_uploads( $post_ID, $post_data['post_content'] );
  1450. /**
  1451. * Filters post data array to be inserted via XML-RPC.
  1452. *
  1453. * @since 3.4.0
  1454. *
  1455. * @param array $post_data Parsed array of post data.
  1456. * @param array $content_struct Post data array.
  1457. */
  1458. $post_data = apply_filters( 'xmlrpc_wp_insert_post_data', $post_data, $content_struct );
  1459. $post_ID = $update ? wp_update_post( $post_data, true ) : wp_insert_post( $post_data, true );
  1460. if ( is_wp_error( $post_ID ) ) {
  1461. return new IXR_Error( 500, $post_ID->get_error_message() );
  1462. }
  1463. if ( ! $post_ID ) {
  1464. return new IXR_Error( 401, __( 'Sorry, your entry could not be posted.' ) );
  1465. }
  1466. return strval( $post_ID );
  1467. }
  1468. /**
  1469. * Edit a post for any registered post type.
  1470. *
  1471. * The $content_struct parameter only needs to contain fields that
  1472. * should be changed. All other fields will retain their existing values.
  1473. *
  1474. * @since 3.4.0
  1475. *
  1476. * @param array $args {
  1477. * Method arguments. Note: arguments must be ordered as documented.
  1478. *
  1479. * @type int $blog_id Blog ID (unused).
  1480. * @type string $username Username.
  1481. * @type string $password Password.
  1482. * @type int $post_id Post ID.
  1483. * @type array $content_struct Extra content arguments.
  1484. * }
  1485. * @return true|IXR_Error True on success, IXR_Error on failure.
  1486. */
  1487. public function wp_editPost( $args ) {
  1488. if ( ! $this->minimum_args( $args, 5 ) ) {
  1489. return $this->error;
  1490. }
  1491. $this->escape( $args );
  1492. $username = $args[1];
  1493. $password = $args[2];
  1494. $post_id = (int) $args[3];
  1495. $content_struct = $args[4];
  1496. $user = $this->login( $username, $password );
  1497. if ( ! $user ) {
  1498. return $this->error;
  1499. }
  1500. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1501. do_action( 'xmlrpc_call', 'wp.editPost' );
  1502. $post = get_post( $post_id, ARRAY_A );
  1503. if ( empty( $post['ID'] ) ) {
  1504. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  1505. }
  1506. if ( isset( $content_struct['if_not_modified_since'] ) ) {
  1507. // If the post has been modified since the date provided, return an error.
  1508. if ( mysql2date( 'U', $post['post_modified_gmt'] ) > $content_struct['if_not_modified_since']->getTimestamp() ) {
  1509. return new IXR_Error( 409, __( 'There is a revision of this post that is more recent.' ) );
  1510. }
  1511. }
  1512. // Convert the date field back to IXR form.
  1513. $post['post_date'] = $this->_convert_date( $post['post_date'] );
  1514. /*
  1515. * Ignore the existing GMT date if it is empty or a non-GMT date was supplied in $content_struct,
  1516. * since _insert_post() will ignore the non-GMT date if the GMT date is set.
  1517. */
  1518. if ( $post['post_date_gmt'] == '0000-00-00 00:00:00' || isset( $content_struct['post_date'] ) ) {
  1519. unset( $post['post_date_gmt'] );
  1520. } else {
  1521. $post['post_date_gmt'] = $this->_convert_date( $post['post_date_gmt'] );
  1522. }
  1523. /*
  1524. * If the API client did not provide post_date, then we must not perpetuate the value that was
  1525. * stored in the database, or it will appear to be an intentional edit. Conveying it here as if
  1526. * it was coming from the API client will cause an otherwise zeroed out post_date_gmt to get set
  1527. * with the value that was originally stored in the database when the draft was created.
  1528. */
  1529. if ( ! isset( $content_struct['post_date'] ) ) {
  1530. unset( $post['post_date'] );
  1531. }
  1532. $this->escape( $post );
  1533. $merged_content_struct = array_merge( $post, $content_struct );
  1534. $retval = $this->_insert_post( $user, $merged_content_struct );
  1535. if ( $retval instanceof IXR_Error ) {
  1536. return $retval;
  1537. }
  1538. return true;
  1539. }
  1540. /**
  1541. * Delete a post for any registered post type.
  1542. *
  1543. * @since 3.4.0
  1544. *
  1545. * @see wp_delete_post()
  1546. *
  1547. * @param array $args {
  1548. * Method arguments. Note: arguments must be ordered as documented.
  1549. *
  1550. * @type int $blog_id Blog ID (unused).
  1551. * @type string $username Username.
  1552. * @type string $password Password.
  1553. * @type int $post_id Post ID.
  1554. * }
  1555. * @return true|IXR_Error True on success, IXR_Error instance on failure.
  1556. */
  1557. public function wp_deletePost( $args ) {
  1558. if ( ! $this->minimum_args( $args, 4 ) ) {
  1559. return $this->error;
  1560. }
  1561. $this->escape( $args );
  1562. $username = $args[1];
  1563. $password = $args[2];
  1564. $post_id = (int) $args[3];
  1565. $user = $this->login( $username, $password );
  1566. if ( ! $user ) {
  1567. return $this->error;
  1568. }
  1569. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1570. do_action( 'xmlrpc_call', 'wp.deletePost' );
  1571. $post = get_post( $post_id, ARRAY_A );
  1572. if ( empty( $post['ID'] ) ) {
  1573. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  1574. }
  1575. if ( ! current_user_can( 'delete_post', $post_id ) ) {
  1576. return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this post.' ) );
  1577. }
  1578. $result = wp_delete_post( $post_id );
  1579. if ( ! $result ) {
  1580. return new IXR_Error( 500, __( 'The post cannot be deleted.' ) );
  1581. }
  1582. return true;
  1583. }
  1584. /**
  1585. * Retrieve a post.
  1586. *
  1587. * @since 3.4.0
  1588. *
  1589. * The optional $fields parameter specifies what fields will be included
  1590. * in the response array. This should be a list of field names. 'post_id' will
  1591. * always be included in the response regardless of the value of $fields.
  1592. *
  1593. * Instead of, or in addition to, individual field names, conceptual group
  1594. * names can be used to specify multiple fields. The available conceptual
  1595. * groups are 'post' (all basic fields), 'taxonomies', 'custom_fields',
  1596. * and 'enclosure'.
  1597. *
  1598. * @see get_post()
  1599. *
  1600. * @param array $args {
  1601. * Method arguments. Note: arguments must be ordered as documented.
  1602. *
  1603. * @type int $blog_id Blog ID (unused).
  1604. * @type string $username Username.
  1605. * @type string $password Password.
  1606. * @type int $post_id Post ID.
  1607. * @type array $fields The subset of post type fields to return.
  1608. * }
  1609. * @return array|IXR_Error Array contains (based on $fields parameter):
  1610. * - 'post_id'
  1611. * - 'post_title'
  1612. * - 'post_date'
  1613. * - 'post_date_gmt'
  1614. * - 'post_modified'
  1615. * - 'post_modified_gmt'
  1616. * - 'post_status'
  1617. * - 'post_type'
  1618. * - 'post_name'
  1619. * - 'post_author'
  1620. * - 'post_password'
  1621. * - 'post_excerpt'
  1622. * - 'post_content'
  1623. * - 'link'
  1624. * - 'comment_status'
  1625. * - 'ping_status'
  1626. * - 'sticky'
  1627. * - 'custom_fields'
  1628. * - 'terms'
  1629. * - 'categories'
  1630. * - 'tags'
  1631. * - 'enclosure'
  1632. */
  1633. public function wp_getPost( $args ) {
  1634. if ( ! $this->minimum_args( $args, 4 ) ) {
  1635. return $this->error;
  1636. }
  1637. $this->escape( $args );
  1638. $username = $args[1];
  1639. $password = $args[2];
  1640. $post_id = (int) $args[3];
  1641. if ( isset( $args[4] ) ) {
  1642. $fields = $args[4];
  1643. } else {
  1644. /**
  1645. * Filters the list of post query fields used by the given XML-RPC method.
  1646. *
  1647. * @since 3.4.0
  1648. *
  1649. * @param array $fields Array of post fields. Default array contains 'post', 'terms', and 'custom_fields'.
  1650. * @param string $method Method name.
  1651. */
  1652. $fields = apply_filters( 'xmlrpc_default_post_fields', array( 'post', 'terms', 'custom_fields' ), 'wp.getPost' );
  1653. }
  1654. $user = $this->login( $username, $password );
  1655. if ( ! $user ) {
  1656. return $this->error;
  1657. }
  1658. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1659. do_action( 'xmlrpc_call', 'wp.getPost' );
  1660. $post = get_post( $post_id, ARRAY_A );
  1661. if ( empty( $post['ID'] ) ) {
  1662. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  1663. }
  1664. if ( ! current_user_can( 'edit_post', $post_id ) ) {
  1665. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  1666. }
  1667. return $this->_prepare_post( $post, $fields );
  1668. }
  1669. /**
  1670. * Retrieve posts.
  1671. *
  1672. * @since 3.4.0
  1673. *
  1674. * @see wp_get_recent_posts()
  1675. * @see wp_getPost() for more on `$fields`
  1676. * @see get_posts() for more on `$filter` values
  1677. *
  1678. * @param array $args {
  1679. * Method arguments. Note: arguments must be ordered as documented.
  1680. *
  1681. * @type int $blog_id Blog ID (unused).
  1682. * @type string $username Username.
  1683. * @type string $password Password.
  1684. * @type array $filter Optional. Modifies the query used to retrieve posts. Accepts 'post_type',
  1685. * 'post_status', 'number', 'offset', 'orderby', 's', and 'order'.
  1686. * Default empty array.
  1687. * @type array $fields Optional. The subset of post type fields to return in the response array.
  1688. * }
  1689. * @return array|IXR_Error Array contains a collection of posts.
  1690. */
  1691. public function wp_getPosts( $args ) {
  1692. if ( ! $this->minimum_args( $args, 3 ) ) {
  1693. return $this->error;
  1694. }
  1695. $this->escape( $args );
  1696. $username = $args[1];
  1697. $password = $args[2];
  1698. $filter = isset( $args[3] ) ? $args[3] : array();
  1699. if ( isset( $args[4] ) ) {
  1700. $fields = $args[4];
  1701. } else {
  1702. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1703. $fields = apply_filters( 'xmlrpc_default_post_fields', array( 'post', 'terms', 'custom_fields' ), 'wp.getPosts' );
  1704. }
  1705. $user = $this->login( $username, $password );
  1706. if ( ! $user ) {
  1707. return $this->error;
  1708. }
  1709. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1710. do_action( 'xmlrpc_call', 'wp.getPosts' );
  1711. $query = array();
  1712. if ( isset( $filter['post_type'] ) ) {
  1713. $post_type = get_post_type_object( $filter['post_type'] );
  1714. if ( ! ( (bool) $post_type ) ) {
  1715. return new IXR_Error( 403, __( 'Invalid post type.' ) );
  1716. }
  1717. } else {
  1718. $post_type = get_post_type_object( 'post' );
  1719. }
  1720. if ( ! current_user_can( $post_type->cap->edit_posts ) ) {
  1721. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts in this post type.' ) );
  1722. }
  1723. $query['post_type'] = $post_type->name;
  1724. if ( isset( $filter['post_status'] ) ) {
  1725. $query['post_status'] = $filter['post_status'];
  1726. }
  1727. if ( isset( $filter['number'] ) ) {
  1728. $query['numberposts'] = absint( $filter['number'] );
  1729. }
  1730. if ( isset( $filter['offset'] ) ) {
  1731. $query['offset'] = absint( $filter['offset'] );
  1732. }
  1733. if ( isset( $filter['orderby'] ) ) {
  1734. $query['orderby'] = $filter['orderby'];
  1735. if ( isset( $filter['order'] ) ) {
  1736. $query['order'] = $filter['order'];
  1737. }
  1738. }
  1739. if ( isset( $filter['s'] ) ) {
  1740. $query['s'] = $filter['s'];
  1741. }
  1742. $posts_list = wp_get_recent_posts( $query );
  1743. if ( ! $posts_list ) {
  1744. return array();
  1745. }
  1746. // Holds all the posts data.
  1747. $struct = array();
  1748. foreach ( $posts_list as $post ) {
  1749. if ( ! current_user_can( 'edit_post', $post['ID'] ) ) {
  1750. continue;
  1751. }
  1752. $struct[] = $this->_prepare_post( $post, $fields );
  1753. }
  1754. return $struct;
  1755. }
  1756. /**
  1757. * Create a new term.
  1758. *
  1759. * @since 3.4.0
  1760. *
  1761. * @see wp_insert_term()
  1762. *
  1763. * @param array $args {
  1764. * Method arguments. Note: arguments must be ordered as documented.
  1765. *
  1766. * @type int $blog_id Blog ID (unused).
  1767. * @type string $username Username.
  1768. * @type string $password Password.
  1769. * @type array $content_struct Content struct for adding a new term. The struct must contain
  1770. * the term 'name' and 'taxonomy'. Optional accepted values include
  1771. * 'parent', 'description', and 'slug'.
  1772. * }
  1773. * @return int|IXR_Error The term ID on success, or an IXR_Error object on failure.
  1774. */
  1775. public function wp_newTerm( $args ) {
  1776. if ( ! $this->minimum_args( $args, 4 ) ) {
  1777. return $this->error;
  1778. }
  1779. $this->escape( $args );
  1780. $username = $args[1];
  1781. $password = $args[2];
  1782. $content_struct = $args[3];
  1783. $user = $this->login( $username, $password );
  1784. if ( ! $user ) {
  1785. return $this->error;
  1786. }
  1787. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1788. do_action( 'xmlrpc_call', 'wp.newTerm' );
  1789. if ( ! taxonomy_exists( $content_struct['taxonomy'] ) ) {
  1790. return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
  1791. }
  1792. $taxonomy = get_taxonomy( $content_struct['taxonomy'] );
  1793. if ( ! current_user_can( $taxonomy->cap->edit_terms ) ) {
  1794. return new IXR_Error( 401, __( 'Sorry, you are not allowed to create terms in this taxonomy.' ) );
  1795. }
  1796. $taxonomy = (array) $taxonomy;
  1797. // hold the data of the term
  1798. $term_data = array();
  1799. $term_data['name'] = trim( $content_struct['name'] );
  1800. if ( empty( $term_data['name'] ) ) {
  1801. return new IXR_Error( 403, __( 'The term name cannot be empty.' ) );
  1802. }
  1803. if ( isset( $content_struct['parent'] ) ) {
  1804. if ( ! $taxonomy['hierarchical'] ) {
  1805. return new IXR_Error( 403, __( 'This taxonomy is not hierarchical.' ) );
  1806. }
  1807. $parent_term_id = (int) $content_struct['parent'];
  1808. $parent_term = get_term( $parent_term_id, $taxonomy['name'] );
  1809. if ( is_wp_error( $parent_term ) ) {
  1810. return new IXR_Error( 500, $parent_term->get_error_message() );
  1811. }
  1812. if ( ! $parent_term ) {
  1813. return new IXR_Error( 403, __( 'Parent term does not exist.' ) );
  1814. }
  1815. $term_data['parent'] = $content_struct['parent'];
  1816. }
  1817. if ( isset( $content_struct['description'] ) ) {
  1818. $term_data['description'] = $content_struct['description'];
  1819. }
  1820. if ( isset( $content_struct['slug'] ) ) {
  1821. $term_data['slug'] = $content_struct['slug'];
  1822. }
  1823. $term = wp_insert_term( $term_data['name'], $taxonomy['name'], $term_data );
  1824. if ( is_wp_error( $term ) ) {
  1825. return new IXR_Error( 500, $term->get_error_message() );
  1826. }
  1827. if ( ! $term ) {
  1828. return new IXR_Error( 500, __( 'Sorry, your term could not be created.' ) );
  1829. }
  1830. // Add term meta.
  1831. if ( isset( $content_struct['custom_fields'] ) ) {
  1832. $this->set_term_custom_fields( $term['term_id'], $content_struct['custom_fields'] );
  1833. }
  1834. return strval( $term['term_id'] );
  1835. }
  1836. /**
  1837. * Edit a term.
  1838. *
  1839. * @since 3.4.0
  1840. *
  1841. * @see wp_update_term()
  1842. *
  1843. * @param array $args {
  1844. * Method arguments. Note: arguments must be ordered as documented.
  1845. *
  1846. * @type int $blog_id Blog ID (unused).
  1847. * @type string $username Username.
  1848. * @type string $password Password.
  1849. * @type int $term_id Term ID.
  1850. * @type array $content_struct Content struct for editing a term. The struct must contain the
  1851. * term ''taxonomy'. Optional accepted values include 'name', 'parent',
  1852. * 'description', and 'slug'.
  1853. * }
  1854. * @return true|IXR_Error True on success, IXR_Error instance on failure.
  1855. */
  1856. public function wp_editTerm( $args ) {
  1857. if ( ! $this->minimum_args( $args, 5 ) ) {
  1858. return $this->error;
  1859. }
  1860. $this->escape( $args );
  1861. $username = $args[1];
  1862. $password = $args[2];
  1863. $term_id = (int) $args[3];
  1864. $content_struct = $args[4];
  1865. $user = $this->login( $username, $password );
  1866. if ( ! $user ) {
  1867. return $this->error;
  1868. }
  1869. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1870. do_action( 'xmlrpc_call', 'wp.editTerm' );
  1871. if ( ! taxonomy_exists( $content_struct['taxonomy'] ) ) {
  1872. return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
  1873. }
  1874. $taxonomy = get_taxonomy( $content_struct['taxonomy'] );
  1875. $taxonomy = (array) $taxonomy;
  1876. // hold the data of the term
  1877. $term_data = array();
  1878. $term = get_term( $term_id, $content_struct['taxonomy'] );
  1879. if ( is_wp_error( $term ) ) {
  1880. return new IXR_Error( 500, $term->get_error_message() );
  1881. }
  1882. if ( ! $term ) {
  1883. return new IXR_Error( 404, __( 'Invalid term ID.' ) );
  1884. }
  1885. if ( ! current_user_can( 'edit_term', $term_id ) ) {
  1886. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this term.' ) );
  1887. }
  1888. if ( isset( $content_struct['name'] ) ) {
  1889. $term_data['name'] = trim( $content_struct['name'] );
  1890. if ( empty( $term_data['name'] ) ) {
  1891. return new IXR_Error( 403, __( 'The term name cannot be empty.' ) );
  1892. }
  1893. }
  1894. if ( ! empty( $content_struct['parent'] ) ) {
  1895. if ( ! $taxonomy['hierarchical'] ) {
  1896. return new IXR_Error( 403, __( 'Cannot set parent term, taxonomy is not hierarchical.' ) );
  1897. }
  1898. $parent_term_id = (int) $content_struct['parent'];
  1899. $parent_term = get_term( $parent_term_id, $taxonomy['name'] );
  1900. if ( is_wp_error( $parent_term ) ) {
  1901. return new IXR_Error( 500, $parent_term->get_error_message() );
  1902. }
  1903. if ( ! $parent_term ) {
  1904. return new IXR_Error( 403, __( 'Parent term does not exist.' ) );
  1905. }
  1906. $term_data['parent'] = $content_struct['parent'];
  1907. }
  1908. if ( isset( $content_struct['description'] ) ) {
  1909. $term_data['description'] = $content_struct['description'];
  1910. }
  1911. if ( isset( $content_struct['slug'] ) ) {
  1912. $term_data['slug'] = $content_struct['slug'];
  1913. }
  1914. $term = wp_update_term( $term_id, $taxonomy['name'], $term_data );
  1915. if ( is_wp_error( $term ) ) {
  1916. return new IXR_Error( 500, $term->get_error_message() );
  1917. }
  1918. if ( ! $term ) {
  1919. return new IXR_Error( 500, __( 'Sorry, editing the term failed.' ) );
  1920. }
  1921. // Update term meta.
  1922. if ( isset( $content_struct['custom_fields'] ) ) {
  1923. $this->set_term_custom_fields( $term_id, $content_struct['custom_fields'] );
  1924. }
  1925. return true;
  1926. }
  1927. /**
  1928. * Delete a term.
  1929. *
  1930. * @since 3.4.0
  1931. *
  1932. * @see wp_delete_term()
  1933. *
  1934. * @param array $args {
  1935. * Method arguments. Note: arguments must be ordered as documented.
  1936. *
  1937. * @type int $blog_id Blog ID (unused).
  1938. * @type string $username Username.
  1939. * @type string $password Password.
  1940. * @type string $taxnomy_name Taxonomy name.
  1941. * @type int $term_id Term ID.
  1942. * }
  1943. * @return bool|IXR_Error True on success, IXR_Error instance on failure.
  1944. */
  1945. public function wp_deleteTerm( $args ) {
  1946. if ( ! $this->minimum_args( $args, 5 ) ) {
  1947. return $this->error;
  1948. }
  1949. $this->escape( $args );
  1950. $username = $args[1];
  1951. $password = $args[2];
  1952. $taxonomy = $args[3];
  1953. $term_id = (int) $args[4];
  1954. $user = $this->login( $username, $password );
  1955. if ( ! $user ) {
  1956. return $this->error;
  1957. }
  1958. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1959. do_action( 'xmlrpc_call', 'wp.deleteTerm' );
  1960. if ( ! taxonomy_exists( $taxonomy ) ) {
  1961. return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
  1962. }
  1963. $taxonomy = get_taxonomy( $taxonomy );
  1964. $term = get_term( $term_id, $taxonomy->name );
  1965. if ( is_wp_error( $term ) ) {
  1966. return new IXR_Error( 500, $term->get_error_message() );
  1967. }
  1968. if ( ! $term ) {
  1969. return new IXR_Error( 404, __( 'Invalid term ID.' ) );
  1970. }
  1971. if ( ! current_user_can( 'delete_term', $term_id ) ) {
  1972. return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this term.' ) );
  1973. }
  1974. $result = wp_delete_term( $term_id, $taxonomy->name );
  1975. if ( is_wp_error( $result ) ) {
  1976. return new IXR_Error( 500, $term->get_error_message() );
  1977. }
  1978. if ( ! $result ) {
  1979. return new IXR_Error( 500, __( 'Sorry, deleting the term failed.' ) );
  1980. }
  1981. return $result;
  1982. }
  1983. /**
  1984. * Retrieve a term.
  1985. *
  1986. * @since 3.4.0
  1987. *
  1988. * @see get_term()
  1989. *
  1990. * @param array $args {
  1991. * Method arguments. Note: arguments must be ordered as documented.
  1992. *
  1993. * @type int $blog_id Blog ID (unused).
  1994. * @type string $username Username.
  1995. * @type string $password Password.
  1996. * @type string $taxnomy Taxonomy name.
  1997. * @type string $term_id Term ID.
  1998. * }
  1999. * @return array|IXR_Error IXR_Error on failure, array on success, containing:
  2000. * - 'term_id'
  2001. * - 'name'
  2002. * - 'slug'
  2003. * - 'term_group'
  2004. * - 'term_taxonomy_id'
  2005. * - 'taxonomy'
  2006. * - 'description'
  2007. * - 'parent'
  2008. * - 'count'
  2009. */
  2010. public function wp_getTerm( $args ) {
  2011. if ( ! $this->minimum_args( $args, 5 ) ) {
  2012. return $this->error;
  2013. }
  2014. $this->escape( $args );
  2015. $username = $args[1];
  2016. $password = $args[2];
  2017. $taxonomy = $args[3];
  2018. $term_id = (int) $args[4];
  2019. $user = $this->login( $username, $password );
  2020. if ( ! $user ) {
  2021. return $this->error;
  2022. }
  2023. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2024. do_action( 'xmlrpc_call', 'wp.getTerm' );
  2025. if ( ! taxonomy_exists( $taxonomy ) ) {
  2026. return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
  2027. }
  2028. $taxonomy = get_taxonomy( $taxonomy );
  2029. $term = get_term( $term_id, $taxonomy->name, ARRAY_A );
  2030. if ( is_wp_error( $term ) ) {
  2031. return new IXR_Error( 500, $term->get_error_message() );
  2032. }
  2033. if ( ! $term ) {
  2034. return new IXR_Error( 404, __( 'Invalid term ID.' ) );
  2035. }
  2036. if ( ! current_user_can( 'assign_term', $term_id ) ) {
  2037. return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign this term.' ) );
  2038. }
  2039. return $this->_prepare_term( $term );
  2040. }
  2041. /**
  2042. * Retrieve all terms for a taxonomy.
  2043. *
  2044. * @since 3.4.0
  2045. *
  2046. * The optional $filter parameter modifies the query used to retrieve terms.
  2047. * Accepted keys are 'number', 'offset', 'orderby', 'order', 'hide_empty', and 'search'.
  2048. *
  2049. * @see get_terms()
  2050. *
  2051. * @param array $args {
  2052. * Method arguments. Note: arguments must be ordered as documented.
  2053. *
  2054. * @type int $blog_id Blog ID (unused).
  2055. * @type string $username Username.
  2056. * @type string $password Password.
  2057. * @type string $taxnomy Taxonomy name.
  2058. * @type array $filter Optional. Modifies the query used to retrieve posts. Accepts 'number',
  2059. * 'offset', 'orderby', 'order', 'hide_empty', and 'search'. Default empty array.
  2060. * }
  2061. * @return array|IXR_Error An associative array of terms data on success, IXR_Error instance otherwise.
  2062. */
  2063. public function wp_getTerms( $args ) {
  2064. if ( ! $this->minimum_args( $args, 4 ) ) {
  2065. return $this->error;
  2066. }
  2067. $this->escape( $args );
  2068. $username = $args[1];
  2069. $password = $args[2];
  2070. $taxonomy = $args[3];
  2071. $filter = isset( $args[4] ) ? $args[4] : array();
  2072. $user = $this->login( $username, $password );
  2073. if ( ! $user ) {
  2074. return $this->error;
  2075. }
  2076. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2077. do_action( 'xmlrpc_call', 'wp.getTerms' );
  2078. if ( ! taxonomy_exists( $taxonomy ) ) {
  2079. return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
  2080. }
  2081. $taxonomy = get_taxonomy( $taxonomy );
  2082. if ( ! current_user_can( $taxonomy->cap->assign_terms ) ) {
  2083. return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign terms in this taxonomy.' ) );
  2084. }
  2085. $query = array( 'taxonomy' => $taxonomy->name );
  2086. if ( isset( $filter['number'] ) ) {
  2087. $query['number'] = absint( $filter['number'] );
  2088. }
  2089. if ( isset( $filter['offset'] ) ) {
  2090. $query['offset'] = absint( $filter['offset'] );
  2091. }
  2092. if ( isset( $filter['orderby'] ) ) {
  2093. $query['orderby'] = $filter['orderby'];
  2094. if ( isset( $filter['order'] ) ) {
  2095. $query['order'] = $filter['order'];
  2096. }
  2097. }
  2098. if ( isset( $filter['hide_empty'] ) ) {
  2099. $query['hide_empty'] = $filter['hide_empty'];
  2100. } else {
  2101. $query['get'] = 'all';
  2102. }
  2103. if ( isset( $filter['search'] ) ) {
  2104. $query['search'] = $filter['search'];
  2105. }
  2106. $terms = get_terms( $query );
  2107. if ( is_wp_error( $terms ) ) {
  2108. return new IXR_Error( 500, $terms->get_error_message() );
  2109. }
  2110. $struct = array();
  2111. foreach ( $terms as $term ) {
  2112. $struct[] = $this->_prepare_term( $term );
  2113. }
  2114. return $struct;
  2115. }
  2116. /**
  2117. * Retrieve a taxonomy.
  2118. *
  2119. * @since 3.4.0
  2120. *
  2121. * @see get_taxonomy()
  2122. *
  2123. * @param array $args {
  2124. * Method arguments. Note: arguments must be ordered as documented.
  2125. *
  2126. * @type int $blog_id Blog ID (unused).
  2127. * @type string $username Username.
  2128. * @type string $password Password.
  2129. * @type string $taxnomy Taxonomy name.
  2130. * @type array $fields Optional. Array of taxonomy fields to limit to in the return.
  2131. * Accepts 'labels', 'cap', 'menu', and 'object_type'.
  2132. * Default empty array.
  2133. * }
  2134. * @return array|IXR_Error An array of taxonomy data on success, IXR_Error instance otherwise.
  2135. */
  2136. public function wp_getTaxonomy( $args ) {
  2137. if ( ! $this->minimum_args( $args, 4 ) ) {
  2138. return $this->error;
  2139. }
  2140. $this->escape( $args );
  2141. $username = $args[1];
  2142. $password = $args[2];
  2143. $taxonomy = $args[3];
  2144. if ( isset( $args[4] ) ) {
  2145. $fields = $args[4];
  2146. } else {
  2147. /**
  2148. * Filters the taxonomy query fields used by the given XML-RPC method.
  2149. *
  2150. * @since 3.4.0
  2151. *
  2152. * @param array $fields An array of taxonomy fields to retrieve.
  2153. * @param string $method The method name.
  2154. */
  2155. $fields = apply_filters( 'xmlrpc_default_taxonomy_fields', array( 'labels', 'cap', 'object_type' ), 'wp.getTaxonomy' );
  2156. }
  2157. $user = $this->login( $username, $password );
  2158. if ( ! $user ) {
  2159. return $this->error;
  2160. }
  2161. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2162. do_action( 'xmlrpc_call', 'wp.getTaxonomy' );
  2163. if ( ! taxonomy_exists( $taxonomy ) ) {
  2164. return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
  2165. }
  2166. $taxonomy = get_taxonomy( $taxonomy );
  2167. if ( ! current_user_can( $taxonomy->cap->assign_terms ) ) {
  2168. return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign terms in this taxonomy.' ) );
  2169. }
  2170. return $this->_prepare_taxonomy( $taxonomy, $fields );
  2171. }
  2172. /**
  2173. * Retrieve all taxonomies.
  2174. *
  2175. * @since 3.4.0
  2176. *
  2177. * @see get_taxonomies()
  2178. *
  2179. * @param array $args {
  2180. * Method arguments. Note: arguments must be ordered as documented.
  2181. *
  2182. * @type int $blog_id Blog ID (unused).
  2183. * @type string $username Username.
  2184. * @type string $password Password.
  2185. * @type array $filter Optional. An array of arguments for retrieving taxonomies.
  2186. * @type array $fields Optional. The subset of taxonomy fields to return.
  2187. * }
  2188. * @return array|IXR_Error An associative array of taxonomy data with returned fields determined
  2189. * by `$fields`, or an IXR_Error instance on failure.
  2190. */
  2191. public function wp_getTaxonomies( $args ) {
  2192. if ( ! $this->minimum_args( $args, 3 ) ) {
  2193. return $this->error;
  2194. }
  2195. $this->escape( $args );
  2196. $username = $args[1];
  2197. $password = $args[2];
  2198. $filter = isset( $args[3] ) ? $args[3] : array( 'public' => true );
  2199. if ( isset( $args[4] ) ) {
  2200. $fields = $args[4];
  2201. } else {
  2202. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2203. $fields = apply_filters( 'xmlrpc_default_taxonomy_fields', array( 'labels', 'cap', 'object_type' ), 'wp.getTaxonomies' );
  2204. }
  2205. $user = $this->login( $username, $password );
  2206. if ( ! $user ) {
  2207. return $this->error;
  2208. }
  2209. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2210. do_action( 'xmlrpc_call', 'wp.getTaxonomies' );
  2211. $taxonomies = get_taxonomies( $filter, 'objects' );
  2212. // holds all the taxonomy data
  2213. $struct = array();
  2214. foreach ( $taxonomies as $taxonomy ) {
  2215. // capability check for post_types
  2216. if ( ! current_user_can( $taxonomy->cap->assign_terms ) ) {
  2217. continue;
  2218. }
  2219. $struct[] = $this->_prepare_taxonomy( $taxonomy, $fields );
  2220. }
  2221. return $struct;
  2222. }
  2223. /**
  2224. * Retrieve a user.
  2225. *
  2226. * The optional $fields parameter specifies what fields will be included
  2227. * in the response array. This should be a list of field names. 'user_id' will
  2228. * always be included in the response regardless of the value of $fields.
  2229. *
  2230. * Instead of, or in addition to, individual field names, conceptual group
  2231. * names can be used to specify multiple fields. The available conceptual
  2232. * groups are 'basic' and 'all'.
  2233. *
  2234. * @uses get_userdata()
  2235. *
  2236. * @param array $args {
  2237. * Method arguments. Note: arguments must be ordered as documented.
  2238. *
  2239. * @type int $blog_id (unused)
  2240. * @type string $username
  2241. * @type string $password
  2242. * @type int $user_id
  2243. * @type array $fields (optional)
  2244. * }
  2245. * @return array|IXR_Error Array contains (based on $fields parameter):
  2246. * - 'user_id'
  2247. * - 'username'
  2248. * - 'first_name'
  2249. * - 'last_name'
  2250. * - 'registered'
  2251. * - 'bio'
  2252. * - 'email'
  2253. * - 'nickname'
  2254. * - 'nicename'
  2255. * - 'url'
  2256. * - 'display_name'
  2257. * - 'roles'
  2258. */
  2259. public function wp_getUser( $args ) {
  2260. if ( ! $this->minimum_args( $args, 4 ) ) {
  2261. return $this->error;
  2262. }
  2263. $this->escape( $args );
  2264. $username = $args[1];
  2265. $password = $args[2];
  2266. $user_id = (int) $args[3];
  2267. if ( isset( $args[4] ) ) {
  2268. $fields = $args[4];
  2269. } else {
  2270. /**
  2271. * Filters the default user query fields used by the given XML-RPC method.
  2272. *
  2273. * @since 3.5.0
  2274. *
  2275. * @param array $fields User query fields for given method. Default 'all'.
  2276. * @param string $method The method name.
  2277. */
  2278. $fields = apply_filters( 'xmlrpc_default_user_fields', array( 'all' ), 'wp.getUser' );
  2279. }
  2280. $user = $this->login( $username, $password );
  2281. if ( ! $user ) {
  2282. return $this->error;
  2283. }
  2284. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2285. do_action( 'xmlrpc_call', 'wp.getUser' );
  2286. if ( ! current_user_can( 'edit_user', $user_id ) ) {
  2287. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this user.' ) );
  2288. }
  2289. $user_data = get_userdata( $user_id );
  2290. if ( ! $user_data ) {
  2291. return new IXR_Error( 404, __( 'Invalid user ID.' ) );
  2292. }
  2293. return $this->_prepare_user( $user_data, $fields );
  2294. }
  2295. /**
  2296. * Retrieve users.
  2297. *
  2298. * The optional $filter parameter modifies the query used to retrieve users.
  2299. * Accepted keys are 'number' (default: 50), 'offset' (default: 0), 'role',
  2300. * 'who', 'orderby', and 'order'.
  2301. *
  2302. * The optional $fields parameter specifies what fields will be included
  2303. * in the response array.
  2304. *
  2305. * @uses get_users()
  2306. * @see wp_getUser() for more on $fields and return values
  2307. *
  2308. * @param array $args {
  2309. * Method arguments. Note: arguments must be ordered as documented.
  2310. *
  2311. * @type int $blog_id (unused)
  2312. * @type string $username
  2313. * @type string $password
  2314. * @type array $filter (optional)
  2315. * @type array $fields (optional)
  2316. * }
  2317. * @return array|IXR_Error users data
  2318. */
  2319. public function wp_getUsers( $args ) {
  2320. if ( ! $this->minimum_args( $args, 3 ) ) {
  2321. return $this->error;
  2322. }
  2323. $this->escape( $args );
  2324. $username = $args[1];
  2325. $password = $args[2];
  2326. $filter = isset( $args[3] ) ? $args[3] : array();
  2327. if ( isset( $args[4] ) ) {
  2328. $fields = $args[4];
  2329. } else {
  2330. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2331. $fields = apply_filters( 'xmlrpc_default_user_fields', array( 'all' ), 'wp.getUsers' );
  2332. }
  2333. $user = $this->login( $username, $password );
  2334. if ( ! $user ) {
  2335. return $this->error;
  2336. }
  2337. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2338. do_action( 'xmlrpc_call', 'wp.getUsers' );
  2339. if ( ! current_user_can( 'list_users' ) ) {
  2340. return new IXR_Error( 401, __( 'Sorry, you are not allowed to list users.' ) );
  2341. }
  2342. $query = array( 'fields' => 'all_with_meta' );
  2343. $query['number'] = ( isset( $filter['number'] ) ) ? absint( $filter['number'] ) : 50;
  2344. $query['offset'] = ( isset( $filter['offset'] ) ) ? absint( $filter['offset'] ) : 0;
  2345. if ( isset( $filter['orderby'] ) ) {
  2346. $query['orderby'] = $filter['orderby'];
  2347. if ( isset( $filter['order'] ) ) {
  2348. $query['order'] = $filter['order'];
  2349. }
  2350. }
  2351. if ( isset( $filter['role'] ) ) {
  2352. if ( get_role( $filter['role'] ) === null ) {
  2353. return new IXR_Error( 403, __( 'Invalid role.' ) );
  2354. }
  2355. $query['role'] = $filter['role'];
  2356. }
  2357. if ( isset( $filter['who'] ) ) {
  2358. $query['who'] = $filter['who'];
  2359. }
  2360. $users = get_users( $query );
  2361. $_users = array();
  2362. foreach ( $users as $user_data ) {
  2363. if ( current_user_can( 'edit_user', $user_data->ID ) ) {
  2364. $_users[] = $this->_prepare_user( $user_data, $fields );
  2365. }
  2366. }
  2367. return $_users;
  2368. }
  2369. /**
  2370. * Retrieve information about the requesting user.
  2371. *
  2372. * @uses get_userdata()
  2373. *
  2374. * @param array $args {
  2375. * Method arguments. Note: arguments must be ordered as documented.
  2376. *
  2377. * @type int $blog_id (unused)
  2378. * @type string $username
  2379. * @type string $password
  2380. * @type array $fields (optional)
  2381. * }
  2382. * @return array|IXR_Error (@see wp_getUser)
  2383. */
  2384. public function wp_getProfile( $args ) {
  2385. if ( ! $this->minimum_args( $args, 3 ) ) {
  2386. return $this->error;
  2387. }
  2388. $this->escape( $args );
  2389. $username = $args[1];
  2390. $password = $args[2];
  2391. if ( isset( $args[3] ) ) {
  2392. $fields = $args[3];
  2393. } else {
  2394. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2395. $fields = apply_filters( 'xmlrpc_default_user_fields', array( 'all' ), 'wp.getProfile' );
  2396. }
  2397. $user = $this->login( $username, $password );
  2398. if ( ! $user ) {
  2399. return $this->error;
  2400. }
  2401. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2402. do_action( 'xmlrpc_call', 'wp.getProfile' );
  2403. if ( ! current_user_can( 'edit_user', $user->ID ) ) {
  2404. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit your profile.' ) );
  2405. }
  2406. $user_data = get_userdata( $user->ID );
  2407. return $this->_prepare_user( $user_data, $fields );
  2408. }
  2409. /**
  2410. * Edit user's profile.
  2411. *
  2412. * @uses wp_update_user()
  2413. *
  2414. * @param array $args {
  2415. * Method arguments. Note: arguments must be ordered as documented.
  2416. *
  2417. * @type int $blog_id (unused)
  2418. * @type string $username
  2419. * @type string $password
  2420. * @type array $content_struct It can optionally contain:
  2421. * - 'first_name'
  2422. * - 'last_name'
  2423. * - 'website'
  2424. * - 'display_name'
  2425. * - 'nickname'
  2426. * - 'nicename'
  2427. * - 'bio'
  2428. * }
  2429. * @return true|IXR_Error True, on success.
  2430. */
  2431. public function wp_editProfile( $args ) {
  2432. if ( ! $this->minimum_args( $args, 4 ) ) {
  2433. return $this->error;
  2434. }
  2435. $this->escape( $args );
  2436. $username = $args[1];
  2437. $password = $args[2];
  2438. $content_struct = $args[3];
  2439. $user = $this->login( $username, $password );
  2440. if ( ! $user ) {
  2441. return $this->error;
  2442. }
  2443. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2444. do_action( 'xmlrpc_call', 'wp.editProfile' );
  2445. if ( ! current_user_can( 'edit_user', $user->ID ) ) {
  2446. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit your profile.' ) );
  2447. }
  2448. // holds data of the user
  2449. $user_data = array();
  2450. $user_data['ID'] = $user->ID;
  2451. // only set the user details if it was given
  2452. if ( isset( $content_struct['first_name'] ) ) {
  2453. $user_data['first_name'] = $content_struct['first_name'];
  2454. }
  2455. if ( isset( $content_struct['last_name'] ) ) {
  2456. $user_data['last_name'] = $content_struct['last_name'];
  2457. }
  2458. if ( isset( $content_struct['url'] ) ) {
  2459. $user_data['user_url'] = $content_struct['url'];
  2460. }
  2461. if ( isset( $content_struct['display_name'] ) ) {
  2462. $user_data['display_name'] = $content_struct['display_name'];
  2463. }
  2464. if ( isset( $content_struct['nickname'] ) ) {
  2465. $user_data['nickname'] = $content_struct['nickname'];
  2466. }
  2467. if ( isset( $content_struct['nicename'] ) ) {
  2468. $user_data['user_nicename'] = $content_struct['nicename'];
  2469. }
  2470. if ( isset( $content_struct['bio'] ) ) {
  2471. $user_data['description'] = $content_struct['bio'];
  2472. }
  2473. $result = wp_update_user( $user_data );
  2474. if ( is_wp_error( $result ) ) {
  2475. return new IXR_Error( 500, $result->get_error_message() );
  2476. }
  2477. if ( ! $result ) {
  2478. return new IXR_Error( 500, __( 'Sorry, the user cannot be updated.' ) );
  2479. }
  2480. return true;
  2481. }
  2482. /**
  2483. * Retrieve page.
  2484. *
  2485. * @since 2.2.0
  2486. *
  2487. * @param array $args {
  2488. * Method arguments. Note: arguments must be ordered as documented.
  2489. *
  2490. * @type int $blog_id (unused)
  2491. * @type int $page_id
  2492. * @type string $username
  2493. * @type string $password
  2494. * }
  2495. * @return array|IXR_Error
  2496. */
  2497. public function wp_getPage( $args ) {
  2498. $this->escape( $args );
  2499. $page_id = (int) $args[1];
  2500. $username = $args[2];
  2501. $password = $args[3];
  2502. $user = $this->login( $username, $password );
  2503. if ( ! $user ) {
  2504. return $this->error;
  2505. }
  2506. $page = get_post( $page_id );
  2507. if ( ! $page ) {
  2508. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  2509. }
  2510. if ( ! current_user_can( 'edit_page', $page_id ) ) {
  2511. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this page.' ) );
  2512. }
  2513. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2514. do_action( 'xmlrpc_call', 'wp.getPage' );
  2515. // If we found the page then format the data.
  2516. if ( $page->ID && ( $page->post_type == 'page' ) ) {
  2517. return $this->_prepare_page( $page );
  2518. } else {
  2519. // If the page doesn't exist indicate that.
  2520. return new IXR_Error( 404, __( 'Sorry, no such page.' ) );
  2521. }
  2522. }
  2523. /**
  2524. * Retrieve Pages.
  2525. *
  2526. * @since 2.2.0
  2527. *
  2528. * @param array $args {
  2529. * Method arguments. Note: arguments must be ordered as documented.
  2530. *
  2531. * @type int $blog_id (unused)
  2532. * @type string $username
  2533. * @type string $password
  2534. * @type int $num_pages
  2535. * }
  2536. * @return array|IXR_Error
  2537. */
  2538. public function wp_getPages( $args ) {
  2539. $this->escape( $args );
  2540. $username = $args[1];
  2541. $password = $args[2];
  2542. $num_pages = isset( $args[3] ) ? (int) $args[3] : 10;
  2543. $user = $this->login( $username, $password );
  2544. if ( ! $user ) {
  2545. return $this->error;
  2546. }
  2547. if ( ! current_user_can( 'edit_pages' ) ) {
  2548. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit pages.' ) );
  2549. }
  2550. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2551. do_action( 'xmlrpc_call', 'wp.getPages' );
  2552. $pages = get_posts(
  2553. array(
  2554. 'post_type' => 'page',
  2555. 'post_status' => 'any',
  2556. 'numberposts' => $num_pages,
  2557. )
  2558. );
  2559. $num_pages = count( $pages );
  2560. // If we have pages, put together their info.
  2561. if ( $num_pages >= 1 ) {
  2562. $pages_struct = array();
  2563. foreach ( $pages as $page ) {
  2564. if ( current_user_can( 'edit_page', $page->ID ) ) {
  2565. $pages_struct[] = $this->_prepare_page( $page );
  2566. }
  2567. }
  2568. return $pages_struct;
  2569. }
  2570. return array();
  2571. }
  2572. /**
  2573. * Create new page.
  2574. *
  2575. * @since 2.2.0
  2576. *
  2577. * @see wp_xmlrpc_server::mw_newPost()
  2578. *
  2579. * @param array $args {
  2580. * Method arguments. Note: arguments must be ordered as documented.
  2581. *
  2582. * @type int $blog_id (unused)
  2583. * @type string $username
  2584. * @type string $password
  2585. * @type array $content_struct
  2586. * }
  2587. * @return int|IXR_Error
  2588. */
  2589. public function wp_newPage( $args ) {
  2590. // Items not escaped here will be escaped in newPost.
  2591. $username = $this->escape( $args[1] );
  2592. $password = $this->escape( $args[2] );
  2593. $user = $this->login( $username, $password );
  2594. if ( ! $user ) {
  2595. return $this->error;
  2596. }
  2597. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2598. do_action( 'xmlrpc_call', 'wp.newPage' );
  2599. // Mark this as content for a page.
  2600. $args[3]['post_type'] = 'page';
  2601. // Let mw_newPost do all of the heavy lifting.
  2602. return $this->mw_newPost( $args );
  2603. }
  2604. /**
  2605. * Delete page.
  2606. *
  2607. * @since 2.2.0
  2608. *
  2609. * @param array $args {
  2610. * Method arguments. Note: arguments must be ordered as documented.
  2611. *
  2612. * @type int $blog_id (unused)
  2613. * @type string $username
  2614. * @type string $password
  2615. * @type int $page_id
  2616. * }
  2617. * @return true|IXR_Error True, if success.
  2618. */
  2619. public function wp_deletePage( $args ) {
  2620. $this->escape( $args );
  2621. $username = $args[1];
  2622. $password = $args[2];
  2623. $page_id = (int) $args[3];
  2624. $user = $this->login( $username, $password );
  2625. if ( ! $user ) {
  2626. return $this->error;
  2627. }
  2628. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2629. do_action( 'xmlrpc_call', 'wp.deletePage' );
  2630. // Get the current page based on the page_id and
  2631. // make sure it is a page and not a post.
  2632. $actual_page = get_post( $page_id, ARRAY_A );
  2633. if ( ! $actual_page || ( $actual_page['post_type'] != 'page' ) ) {
  2634. return new IXR_Error( 404, __( 'Sorry, no such page.' ) );
  2635. }
  2636. // Make sure the user can delete pages.
  2637. if ( ! current_user_can( 'delete_page', $page_id ) ) {
  2638. return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this page.' ) );
  2639. }
  2640. // Attempt to delete the page.
  2641. $result = wp_delete_post( $page_id );
  2642. if ( ! $result ) {
  2643. return new IXR_Error( 500, __( 'Failed to delete the page.' ) );
  2644. }
  2645. /**
  2646. * Fires after a page has been successfully deleted via XML-RPC.
  2647. *
  2648. * @since 3.4.0
  2649. *
  2650. * @param int $page_id ID of the deleted page.
  2651. * @param array $args An array of arguments to delete the page.
  2652. */
  2653. do_action( 'xmlrpc_call_success_wp_deletePage', $page_id, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  2654. return true;
  2655. }
  2656. /**
  2657. * Edit page.
  2658. *
  2659. * @since 2.2.0
  2660. *
  2661. * @param array $args {
  2662. * Method arguments. Note: arguments must be ordered as documented.
  2663. *
  2664. * @type int $blog_id (unused)
  2665. * @type int $page_id
  2666. * @type string $username
  2667. * @type string $password
  2668. * @type string $content
  2669. * @type string $publish
  2670. * }
  2671. * @return array|IXR_Error
  2672. */
  2673. public function wp_editPage( $args ) {
  2674. // Items will be escaped in mw_editPost.
  2675. $page_id = (int) $args[1];
  2676. $username = $args[2];
  2677. $password = $args[3];
  2678. $content = $args[4];
  2679. $publish = $args[5];
  2680. $escaped_username = $this->escape( $username );
  2681. $escaped_password = $this->escape( $password );
  2682. $user = $this->login( $escaped_username, $escaped_password );
  2683. if ( ! $user ) {
  2684. return $this->error;
  2685. }
  2686. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2687. do_action( 'xmlrpc_call', 'wp.editPage' );
  2688. // Get the page data and make sure it is a page.
  2689. $actual_page = get_post( $page_id, ARRAY_A );
  2690. if ( ! $actual_page || ( $actual_page['post_type'] != 'page' ) ) {
  2691. return new IXR_Error( 404, __( 'Sorry, no such page.' ) );
  2692. }
  2693. // Make sure the user is allowed to edit pages.
  2694. if ( ! current_user_can( 'edit_page', $page_id ) ) {
  2695. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this page.' ) );
  2696. }
  2697. // Mark this as content for a page.
  2698. $content['post_type'] = 'page';
  2699. // Arrange args in the way mw_editPost understands.
  2700. $args = array(
  2701. $page_id,
  2702. $username,
  2703. $password,
  2704. $content,
  2705. $publish,
  2706. );
  2707. // Let mw_editPost do all of the heavy lifting.
  2708. return $this->mw_editPost( $args );
  2709. }
  2710. /**
  2711. * Retrieve page list.
  2712. *
  2713. * @since 2.2.0
  2714. *
  2715. * @global wpdb $wpdb WordPress database abstraction object.
  2716. *
  2717. * @param array $args {
  2718. * Method arguments. Note: arguments must be ordered as documented.
  2719. *
  2720. * @type int $blog_id (unused)
  2721. * @type string $username
  2722. * @type string $password
  2723. * }
  2724. * @return array|IXR_Error
  2725. */
  2726. public function wp_getPageList( $args ) {
  2727. global $wpdb;
  2728. $this->escape( $args );
  2729. $username = $args[1];
  2730. $password = $args[2];
  2731. $user = $this->login( $username, $password );
  2732. if ( ! $user ) {
  2733. return $this->error;
  2734. }
  2735. if ( ! current_user_can( 'edit_pages' ) ) {
  2736. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit pages.' ) );
  2737. }
  2738. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2739. do_action( 'xmlrpc_call', 'wp.getPageList' );
  2740. // Get list of pages ids and titles
  2741. $page_list = $wpdb->get_results(
  2742. "
  2743. SELECT ID page_id,
  2744. post_title page_title,
  2745. post_parent page_parent_id,
  2746. post_date_gmt,
  2747. post_date,
  2748. post_status
  2749. FROM {$wpdb->posts}
  2750. WHERE post_type = 'page'
  2751. ORDER BY ID
  2752. "
  2753. );
  2754. // The date needs to be formatted properly.
  2755. $num_pages = count( $page_list );
  2756. for ( $i = 0; $i < $num_pages; $i++ ) {
  2757. $page_list[ $i ]->dateCreated = $this->_convert_date( $page_list[ $i ]->post_date );
  2758. $page_list[ $i ]->date_created_gmt = $this->_convert_date_gmt( $page_list[ $i ]->post_date_gmt, $page_list[ $i ]->post_date );
  2759. unset( $page_list[ $i ]->post_date_gmt );
  2760. unset( $page_list[ $i ]->post_date );
  2761. unset( $page_list[ $i ]->post_status );
  2762. }
  2763. return $page_list;
  2764. }
  2765. /**
  2766. * Retrieve authors list.
  2767. *
  2768. * @since 2.2.0
  2769. *
  2770. * @param array $args {
  2771. * Method arguments. Note: arguments must be ordered as documented.
  2772. *
  2773. * @type int $blog_id (unused)
  2774. * @type string $username
  2775. * @type string $password
  2776. * }
  2777. * @return array|IXR_Error
  2778. */
  2779. public function wp_getAuthors( $args ) {
  2780. $this->escape( $args );
  2781. $username = $args[1];
  2782. $password = $args[2];
  2783. $user = $this->login( $username, $password );
  2784. if ( ! $user ) {
  2785. return $this->error;
  2786. }
  2787. if ( ! current_user_can( 'edit_posts' ) ) {
  2788. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts.' ) );
  2789. }
  2790. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2791. do_action( 'xmlrpc_call', 'wp.getAuthors' );
  2792. $authors = array();
  2793. foreach ( get_users( array( 'fields' => array( 'ID', 'user_login', 'display_name' ) ) ) as $user ) {
  2794. $authors[] = array(
  2795. 'user_id' => $user->ID,
  2796. 'user_login' => $user->user_login,
  2797. 'display_name' => $user->display_name,
  2798. );
  2799. }
  2800. return $authors;
  2801. }
  2802. /**
  2803. * Get list of all tags
  2804. *
  2805. * @since 2.7.0
  2806. *
  2807. * @param array $args {
  2808. * Method arguments. Note: arguments must be ordered as documented.
  2809. *
  2810. * @type int $blog_id (unused)
  2811. * @type string $username
  2812. * @type string $password
  2813. * }
  2814. * @return array|IXR_Error
  2815. */
  2816. public function wp_getTags( $args ) {
  2817. $this->escape( $args );
  2818. $username = $args[1];
  2819. $password = $args[2];
  2820. $user = $this->login( $username, $password );
  2821. if ( ! $user ) {
  2822. return $this->error;
  2823. }
  2824. if ( ! current_user_can( 'edit_posts' ) ) {
  2825. return new IXR_Error( 401, __( 'Sorry, you must be able to edit posts on this site in order to view tags.' ) );
  2826. }
  2827. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2828. do_action( 'xmlrpc_call', 'wp.getKeywords' );
  2829. $tags = array();
  2830. $all_tags = get_tags();
  2831. if ( $all_tags ) {
  2832. foreach ( (array) $all_tags as $tag ) {
  2833. $struct = array();
  2834. $struct['tag_id'] = $tag->term_id;
  2835. $struct['name'] = $tag->name;
  2836. $struct['count'] = $tag->count;
  2837. $struct['slug'] = $tag->slug;
  2838. $struct['html_url'] = esc_html( get_tag_link( $tag->term_id ) );
  2839. $struct['rss_url'] = esc_html( get_tag_feed_link( $tag->term_id ) );
  2840. $tags[] = $struct;
  2841. }
  2842. }
  2843. return $tags;
  2844. }
  2845. /**
  2846. * Create new category.
  2847. *
  2848. * @since 2.2.0
  2849. *
  2850. * @param array $args {
  2851. * Method arguments. Note: arguments must be ordered as documented.
  2852. *
  2853. * @type int $blog_id (unused)
  2854. * @type string $username
  2855. * @type string $password
  2856. * @type array $category
  2857. * }
  2858. * @return int|IXR_Error Category ID.
  2859. */
  2860. public function wp_newCategory( $args ) {
  2861. $this->escape( $args );
  2862. $username = $args[1];
  2863. $password = $args[2];
  2864. $category = $args[3];
  2865. $user = $this->login( $username, $password );
  2866. if ( ! $user ) {
  2867. return $this->error;
  2868. }
  2869. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2870. do_action( 'xmlrpc_call', 'wp.newCategory' );
  2871. // Make sure the user is allowed to add a category.
  2872. if ( ! current_user_can( 'manage_categories' ) ) {
  2873. return new IXR_Error( 401, __( 'Sorry, you are not allowed to add a category.' ) );
  2874. }
  2875. // If no slug was provided make it empty so that
  2876. // WordPress will generate one.
  2877. if ( empty( $category['slug'] ) ) {
  2878. $category['slug'] = '';
  2879. }
  2880. // If no parent_id was provided make it empty
  2881. // so that it will be a top level page (no parent).
  2882. if ( ! isset( $category['parent_id'] ) ) {
  2883. $category['parent_id'] = '';
  2884. }
  2885. // If no description was provided make it empty.
  2886. if ( empty( $category['description'] ) ) {
  2887. $category['description'] = '';
  2888. }
  2889. $new_category = array(
  2890. 'cat_name' => $category['name'],
  2891. 'category_nicename' => $category['slug'],
  2892. 'category_parent' => $category['parent_id'],
  2893. 'category_description' => $category['description'],
  2894. );
  2895. $cat_id = wp_insert_category( $new_category, true );
  2896. if ( is_wp_error( $cat_id ) ) {
  2897. if ( 'term_exists' == $cat_id->get_error_code() ) {
  2898. return (int) $cat_id->get_error_data();
  2899. } else {
  2900. return new IXR_Error( 500, __( 'Sorry, the new category failed.' ) );
  2901. }
  2902. } elseif ( ! $cat_id ) {
  2903. return new IXR_Error( 500, __( 'Sorry, the new category failed.' ) );
  2904. }
  2905. /**
  2906. * Fires after a new category has been successfully created via XML-RPC.
  2907. *
  2908. * @since 3.4.0
  2909. *
  2910. * @param int $cat_id ID of the new category.
  2911. * @param array $args An array of new category arguments.
  2912. */
  2913. do_action( 'xmlrpc_call_success_wp_newCategory', $cat_id, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  2914. return $cat_id;
  2915. }
  2916. /**
  2917. * Remove category.
  2918. *
  2919. * @since 2.5.0
  2920. *
  2921. * @param array $args {
  2922. * Method arguments. Note: arguments must be ordered as documented.
  2923. *
  2924. * @type int $blog_id (unused)
  2925. * @type string $username
  2926. * @type string $password
  2927. * @type int $category_id
  2928. * }
  2929. * @return bool|IXR_Error See wp_delete_term() for return info.
  2930. */
  2931. public function wp_deleteCategory( $args ) {
  2932. $this->escape( $args );
  2933. $username = $args[1];
  2934. $password = $args[2];
  2935. $category_id = (int) $args[3];
  2936. $user = $this->login( $username, $password );
  2937. if ( ! $user ) {
  2938. return $this->error;
  2939. }
  2940. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2941. do_action( 'xmlrpc_call', 'wp.deleteCategory' );
  2942. if ( ! current_user_can( 'delete_term', $category_id ) ) {
  2943. return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this category.' ) );
  2944. }
  2945. $status = wp_delete_term( $category_id, 'category' );
  2946. if ( true == $status ) {
  2947. /**
  2948. * Fires after a category has been successfully deleted via XML-RPC.
  2949. *
  2950. * @since 3.4.0
  2951. *
  2952. * @param int $category_id ID of the deleted category.
  2953. * @param array $args An array of arguments to delete the category.
  2954. */
  2955. do_action( 'xmlrpc_call_success_wp_deleteCategory', $category_id, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  2956. }
  2957. return $status;
  2958. }
  2959. /**
  2960. * Retrieve category list.
  2961. *
  2962. * @since 2.2.0
  2963. *
  2964. * @param array $args {
  2965. * Method arguments. Note: arguments must be ordered as documented.
  2966. *
  2967. * @type int $blog_id (unused)
  2968. * @type string $username
  2969. * @type string $password
  2970. * @type array $category
  2971. * @type int $max_results
  2972. * }
  2973. * @return array|IXR_Error
  2974. */
  2975. public function wp_suggestCategories( $args ) {
  2976. $this->escape( $args );
  2977. $username = $args[1];
  2978. $password = $args[2];
  2979. $category = $args[3];
  2980. $max_results = (int) $args[4];
  2981. $user = $this->login( $username, $password );
  2982. if ( ! $user ) {
  2983. return $this->error;
  2984. }
  2985. if ( ! current_user_can( 'edit_posts' ) ) {
  2986. return new IXR_Error( 401, __( 'Sorry, you must be able to edit posts on this site in order to view categories.' ) );
  2987. }
  2988. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2989. do_action( 'xmlrpc_call', 'wp.suggestCategories' );
  2990. $category_suggestions = array();
  2991. $args = array(
  2992. 'get' => 'all',
  2993. 'number' => $max_results,
  2994. 'name__like' => $category,
  2995. );
  2996. foreach ( (array) get_categories( $args ) as $cat ) {
  2997. $category_suggestions[] = array(
  2998. 'category_id' => $cat->term_id,
  2999. 'category_name' => $cat->name,
  3000. );
  3001. }
  3002. return $category_suggestions;
  3003. }
  3004. /**
  3005. * Retrieve comment.
  3006. *
  3007. * @since 2.7.0
  3008. *
  3009. * @param array $args {
  3010. * Method arguments. Note: arguments must be ordered as documented.
  3011. *
  3012. * @type int $blog_id (unused)
  3013. * @type string $username
  3014. * @type string $password
  3015. * @type int $comment_id
  3016. * }
  3017. * @return array|IXR_Error
  3018. */
  3019. public function wp_getComment( $args ) {
  3020. $this->escape( $args );
  3021. $username = $args[1];
  3022. $password = $args[2];
  3023. $comment_id = (int) $args[3];
  3024. $user = $this->login( $username, $password );
  3025. if ( ! $user ) {
  3026. return $this->error;
  3027. }
  3028. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3029. do_action( 'xmlrpc_call', 'wp.getComment' );
  3030. $comment = get_comment( $comment_id );
  3031. if ( ! $comment ) {
  3032. return new IXR_Error( 404, __( 'Invalid comment ID.' ) );
  3033. }
  3034. if ( ! current_user_can( 'edit_comment', $comment_id ) ) {
  3035. return new IXR_Error( 403, __( 'Sorry, you are not allowed to moderate or edit this comment.' ) );
  3036. }
  3037. return $this->_prepare_comment( $comment );
  3038. }
  3039. /**
  3040. * Retrieve comments.
  3041. *
  3042. * Besides the common blog_id (unused), username, and password arguments, it takes a filter
  3043. * array as last argument.
  3044. *
  3045. * Accepted 'filter' keys are 'status', 'post_id', 'offset', and 'number'.
  3046. *
  3047. * The defaults are as follows:
  3048. * - 'status' - Default is ''. Filter by status (e.g., 'approve', 'hold')
  3049. * - 'post_id' - Default is ''. The post where the comment is posted. Empty string shows all comments.
  3050. * - 'number' - Default is 10. Total number of media items to retrieve.
  3051. * - 'offset' - Default is 0. See WP_Query::query() for more.
  3052. *
  3053. * @since 2.7.0
  3054. *
  3055. * @param array $args {
  3056. * Method arguments. Note: arguments must be ordered as documented.
  3057. *
  3058. * @type int $blog_id (unused)
  3059. * @type string $username
  3060. * @type string $password
  3061. * @type array $struct
  3062. * }
  3063. * @return array|IXR_Error Contains a collection of comments. See wp_xmlrpc_server::wp_getComment() for a description of each item contents
  3064. */
  3065. public function wp_getComments( $args ) {
  3066. $this->escape( $args );
  3067. $username = $args[1];
  3068. $password = $args[2];
  3069. $struct = isset( $args[3] ) ? $args[3] : array();
  3070. $user = $this->login( $username, $password );
  3071. if ( ! $user ) {
  3072. return $this->error;
  3073. }
  3074. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3075. do_action( 'xmlrpc_call', 'wp.getComments' );
  3076. if ( isset( $struct['status'] ) ) {
  3077. $status = $struct['status'];
  3078. } else {
  3079. $status = '';
  3080. }
  3081. if ( ! current_user_can( 'moderate_comments' ) && 'approve' !== $status ) {
  3082. return new IXR_Error( 401, __( 'Invalid comment status.' ) );
  3083. }
  3084. $post_id = '';
  3085. if ( isset( $struct['post_id'] ) ) {
  3086. $post_id = absint( $struct['post_id'] );
  3087. }
  3088. $post_type = '';
  3089. if ( isset( $struct['post_type'] ) ) {
  3090. $post_type_object = get_post_type_object( $struct['post_type'] );
  3091. if ( ! $post_type_object || ! post_type_supports( $post_type_object->name, 'comments' ) ) {
  3092. return new IXR_Error( 404, __( 'Invalid post type.' ) );
  3093. }
  3094. $post_type = $struct['post_type'];
  3095. }
  3096. $offset = 0;
  3097. if ( isset( $struct['offset'] ) ) {
  3098. $offset = absint( $struct['offset'] );
  3099. }
  3100. $number = 10;
  3101. if ( isset( $struct['number'] ) ) {
  3102. $number = absint( $struct['number'] );
  3103. }
  3104. $comments = get_comments(
  3105. array(
  3106. 'status' => $status,
  3107. 'post_id' => $post_id,
  3108. 'offset' => $offset,
  3109. 'number' => $number,
  3110. 'post_type' => $post_type,
  3111. )
  3112. );
  3113. $comments_struct = array();
  3114. if ( is_array( $comments ) ) {
  3115. foreach ( $comments as $comment ) {
  3116. $comments_struct[] = $this->_prepare_comment( $comment );
  3117. }
  3118. }
  3119. return $comments_struct;
  3120. }
  3121. /**
  3122. * Delete a comment.
  3123. *
  3124. * By default, the comment will be moved to the trash instead of deleted.
  3125. * See wp_delete_comment() for more information on this behavior.
  3126. *
  3127. * @since 2.7.0
  3128. *
  3129. * @param array $args {
  3130. * Method arguments. Note: arguments must be ordered as documented.
  3131. *
  3132. * @type int $blog_id (unused)
  3133. * @type string $username
  3134. * @type string $password
  3135. * @type int $comment_ID
  3136. * }
  3137. * @return bool|IXR_Error See wp_delete_comment().
  3138. */
  3139. public function wp_deleteComment( $args ) {
  3140. $this->escape( $args );
  3141. $username = $args[1];
  3142. $password = $args[2];
  3143. $comment_ID = (int) $args[3];
  3144. $user = $this->login( $username, $password );
  3145. if ( ! $user ) {
  3146. return $this->error;
  3147. }
  3148. if ( ! get_comment( $comment_ID ) ) {
  3149. return new IXR_Error( 404, __( 'Invalid comment ID.' ) );
  3150. }
  3151. if ( ! current_user_can( 'edit_comment', $comment_ID ) ) {
  3152. return new IXR_Error( 403, __( 'Sorry, you are not allowed to delete this comment.' ) );
  3153. }
  3154. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3155. do_action( 'xmlrpc_call', 'wp.deleteComment' );
  3156. $status = wp_delete_comment( $comment_ID );
  3157. if ( $status ) {
  3158. /**
  3159. * Fires after a comment has been successfully deleted via XML-RPC.
  3160. *
  3161. * @since 3.4.0
  3162. *
  3163. * @param int $comment_ID ID of the deleted comment.
  3164. * @param array $args An array of arguments to delete the comment.
  3165. */
  3166. do_action( 'xmlrpc_call_success_wp_deleteComment', $comment_ID, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  3167. }
  3168. return $status;
  3169. }
  3170. /**
  3171. * Edit comment.
  3172. *
  3173. * Besides the common blog_id (unused), username, and password arguments, it takes a
  3174. * comment_id integer and a content_struct array as last argument.
  3175. *
  3176. * The allowed keys in the content_struct array are:
  3177. * - 'author'
  3178. * - 'author_url'
  3179. * - 'author_email'
  3180. * - 'content'
  3181. * - 'date_created_gmt'
  3182. * - 'status'. Common statuses are 'approve', 'hold', 'spam'. See get_comment_statuses() for more details
  3183. *
  3184. * @since 2.7.0
  3185. *
  3186. * @param array $args {
  3187. * Method arguments. Note: arguments must be ordered as documented.
  3188. *
  3189. * @type int $blog_id (unused)
  3190. * @type string $username
  3191. * @type string $password
  3192. * @type int $comment_ID
  3193. * @type array $content_struct
  3194. * }
  3195. * @return true|IXR_Error True, on success.
  3196. */
  3197. public function wp_editComment( $args ) {
  3198. $this->escape( $args );
  3199. $username = $args[1];
  3200. $password = $args[2];
  3201. $comment_ID = (int) $args[3];
  3202. $content_struct = $args[4];
  3203. $user = $this->login( $username, $password );
  3204. if ( ! $user ) {
  3205. return $this->error;
  3206. }
  3207. if ( ! get_comment( $comment_ID ) ) {
  3208. return new IXR_Error( 404, __( 'Invalid comment ID.' ) );
  3209. }
  3210. if ( ! current_user_can( 'edit_comment', $comment_ID ) ) {
  3211. return new IXR_Error( 403, __( 'Sorry, you are not allowed to moderate or edit this comment.' ) );
  3212. }
  3213. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3214. do_action( 'xmlrpc_call', 'wp.editComment' );
  3215. $comment = array(
  3216. 'comment_ID' => $comment_ID,
  3217. );
  3218. if ( isset( $content_struct['status'] ) ) {
  3219. $statuses = get_comment_statuses();
  3220. $statuses = array_keys( $statuses );
  3221. if ( ! in_array( $content_struct['status'], $statuses ) ) {
  3222. return new IXR_Error( 401, __( 'Invalid comment status.' ) );
  3223. }
  3224. $comment['comment_approved'] = $content_struct['status'];
  3225. }
  3226. // Do some timestamp voodoo
  3227. if ( ! empty( $content_struct['date_created_gmt'] ) ) {
  3228. // We know this is supposed to be GMT, so we're going to slap that Z on there by force
  3229. $dateCreated = rtrim( $content_struct['date_created_gmt']->getIso(), 'Z' ) . 'Z';
  3230. $comment['comment_date'] = get_date_from_gmt( iso8601_to_datetime( $dateCreated ) );
  3231. $comment['comment_date_gmt'] = iso8601_to_datetime( $dateCreated, 'GMT' );
  3232. }
  3233. if ( isset( $content_struct['content'] ) ) {
  3234. $comment['comment_content'] = $content_struct['content'];
  3235. }
  3236. if ( isset( $content_struct['author'] ) ) {
  3237. $comment['comment_author'] = $content_struct['author'];
  3238. }
  3239. if ( isset( $content_struct['author_url'] ) ) {
  3240. $comment['comment_author_url'] = $content_struct['author_url'];
  3241. }
  3242. if ( isset( $content_struct['author_email'] ) ) {
  3243. $comment['comment_author_email'] = $content_struct['author_email'];
  3244. }
  3245. $result = wp_update_comment( $comment );
  3246. if ( is_wp_error( $result ) ) {
  3247. return new IXR_Error( 500, $result->get_error_message() );
  3248. }
  3249. if ( ! $result ) {
  3250. return new IXR_Error( 500, __( 'Sorry, the comment could not be edited.' ) );
  3251. }
  3252. /**
  3253. * Fires after a comment has been successfully updated via XML-RPC.
  3254. *
  3255. * @since 3.4.0
  3256. *
  3257. * @param int $comment_ID ID of the updated comment.
  3258. * @param array $args An array of arguments to update the comment.
  3259. */
  3260. do_action( 'xmlrpc_call_success_wp_editComment', $comment_ID, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  3261. return true;
  3262. }
  3263. /**
  3264. * Create new comment.
  3265. *
  3266. * @since 2.7.0
  3267. *
  3268. * @param array $args {
  3269. * Method arguments. Note: arguments must be ordered as documented.
  3270. *
  3271. * @type int $blog_id (unused)
  3272. * @type string $username
  3273. * @type string $password
  3274. * @type string|int $post
  3275. * @type array $content_struct
  3276. * }
  3277. * @return int|IXR_Error See wp_new_comment().
  3278. */
  3279. public function wp_newComment( $args ) {
  3280. $this->escape( $args );
  3281. $username = $args[1];
  3282. $password = $args[2];
  3283. $post = $args[3];
  3284. $content_struct = $args[4];
  3285. /**
  3286. * Filters whether to allow anonymous comments over XML-RPC.
  3287. *
  3288. * @since 2.7.0
  3289. *
  3290. * @param bool $allow Whether to allow anonymous commenting via XML-RPC.
  3291. * Default false.
  3292. */
  3293. $allow_anon = apply_filters( 'xmlrpc_allow_anonymous_comments', false );
  3294. $user = $this->login( $username, $password );
  3295. if ( ! $user ) {
  3296. $logged_in = false;
  3297. if ( $allow_anon && get_option( 'comment_registration' ) ) {
  3298. return new IXR_Error( 403, __( 'You must be registered to comment.' ) );
  3299. } elseif ( ! $allow_anon ) {
  3300. return $this->error;
  3301. }
  3302. } else {
  3303. $logged_in = true;
  3304. }
  3305. if ( is_numeric( $post ) ) {
  3306. $post_id = absint( $post );
  3307. } else {
  3308. $post_id = url_to_postid( $post );
  3309. }
  3310. if ( ! $post_id ) {
  3311. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  3312. }
  3313. if ( ! get_post( $post_id ) ) {
  3314. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  3315. }
  3316. if ( ! comments_open( $post_id ) ) {
  3317. return new IXR_Error( 403, __( 'Sorry, comments are closed for this item.' ) );
  3318. }
  3319. if ( empty( $content_struct['content'] ) ) {
  3320. return new IXR_Error( 403, __( 'Comment is required.' ) );
  3321. }
  3322. $comment = array(
  3323. 'comment_post_ID' => $post_id,
  3324. 'comment_content' => $content_struct['content'],
  3325. );
  3326. if ( $logged_in ) {
  3327. $display_name = $user->display_name;
  3328. $user_email = $user->user_email;
  3329. $user_url = $user->user_url;
  3330. $comment['comment_author'] = $this->escape( $display_name );
  3331. $comment['comment_author_email'] = $this->escape( $user_email );
  3332. $comment['comment_author_url'] = $this->escape( $user_url );
  3333. $comment['user_ID'] = $user->ID;
  3334. } else {
  3335. $comment['comment_author'] = '';
  3336. if ( isset( $content_struct['author'] ) ) {
  3337. $comment['comment_author'] = $content_struct['author'];
  3338. }
  3339. $comment['comment_author_email'] = '';
  3340. if ( isset( $content_struct['author_email'] ) ) {
  3341. $comment['comment_author_email'] = $content_struct['author_email'];
  3342. }
  3343. $comment['comment_author_url'] = '';
  3344. if ( isset( $content_struct['author_url'] ) ) {
  3345. $comment['comment_author_url'] = $content_struct['author_url'];
  3346. }
  3347. $comment['user_ID'] = 0;
  3348. if ( get_option( 'require_name_email' ) ) {
  3349. if ( 6 > strlen( $comment['comment_author_email'] ) || '' == $comment['comment_author'] ) {
  3350. return new IXR_Error( 403, __( 'Comment author name and email are required.' ) );
  3351. } elseif ( ! is_email( $comment['comment_author_email'] ) ) {
  3352. return new IXR_Error( 403, __( 'A valid email address is required.' ) );
  3353. }
  3354. }
  3355. }
  3356. $comment['comment_parent'] = isset( $content_struct['comment_parent'] ) ? absint( $content_struct['comment_parent'] ) : 0;
  3357. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3358. do_action( 'xmlrpc_call', 'wp.newComment' );
  3359. $comment_ID = wp_new_comment( $comment, true );
  3360. if ( is_wp_error( $comment_ID ) ) {
  3361. return new IXR_Error( 403, $comment_ID->get_error_message() );
  3362. }
  3363. if ( ! $comment_ID ) {
  3364. return new IXR_Error( 403, __( 'Something went wrong.' ) );
  3365. }
  3366. /**
  3367. * Fires after a new comment has been successfully created via XML-RPC.
  3368. *
  3369. * @since 3.4.0
  3370. *
  3371. * @param int $comment_ID ID of the new comment.
  3372. * @param array $args An array of new comment arguments.
  3373. */
  3374. do_action( 'xmlrpc_call_success_wp_newComment', $comment_ID, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  3375. return $comment_ID;
  3376. }
  3377. /**
  3378. * Retrieve all of the comment status.
  3379. *
  3380. * @since 2.7.0
  3381. *
  3382. * @param array $args {
  3383. * Method arguments. Note: arguments must be ordered as documented.
  3384. *
  3385. * @type int $blog_id (unused)
  3386. * @type string $username
  3387. * @type string $password
  3388. * }
  3389. * @return array|IXR_Error
  3390. */
  3391. public function wp_getCommentStatusList( $args ) {
  3392. $this->escape( $args );
  3393. $username = $args[1];
  3394. $password = $args[2];
  3395. $user = $this->login( $username, $password );
  3396. if ( ! $user ) {
  3397. return $this->error;
  3398. }
  3399. if ( ! current_user_can( 'publish_posts' ) ) {
  3400. return new IXR_Error( 403, __( 'Sorry, you are not allowed to access details about this site.' ) );
  3401. }
  3402. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3403. do_action( 'xmlrpc_call', 'wp.getCommentStatusList' );
  3404. return get_comment_statuses();
  3405. }
  3406. /**
  3407. * Retrieve comment count.
  3408. *
  3409. * @since 2.5.0
  3410. *
  3411. * @param array $args {
  3412. * Method arguments. Note: arguments must be ordered as documented.
  3413. *
  3414. * @type int $blog_id (unused)
  3415. * @type string $username
  3416. * @type string $password
  3417. * @type int $post_id
  3418. * }
  3419. * @return array|IXR_Error
  3420. */
  3421. public function wp_getCommentCount( $args ) {
  3422. $this->escape( $args );
  3423. $username = $args[1];
  3424. $password = $args[2];
  3425. $post_id = (int) $args[3];
  3426. $user = $this->login( $username, $password );
  3427. if ( ! $user ) {
  3428. return $this->error;
  3429. }
  3430. $post = get_post( $post_id, ARRAY_A );
  3431. if ( empty( $post['ID'] ) ) {
  3432. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  3433. }
  3434. if ( ! current_user_can( 'edit_post', $post_id ) ) {
  3435. return new IXR_Error( 403, __( 'Sorry, you are not allowed to access details of this post.' ) );
  3436. }
  3437. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3438. do_action( 'xmlrpc_call', 'wp.getCommentCount' );
  3439. $count = wp_count_comments( $post_id );
  3440. return array(
  3441. 'approved' => $count->approved,
  3442. 'awaiting_moderation' => $count->moderated,
  3443. 'spam' => $count->spam,
  3444. 'total_comments' => $count->total_comments,
  3445. );
  3446. }
  3447. /**
  3448. * Retrieve post statuses.
  3449. *
  3450. * @since 2.5.0
  3451. *
  3452. * @param array $args {
  3453. * Method arguments. Note: arguments must be ordered as documented.
  3454. *
  3455. * @type int $blog_id (unused)
  3456. * @type string $username
  3457. * @type string $password
  3458. * }
  3459. * @return array|IXR_Error
  3460. */
  3461. public function wp_getPostStatusList( $args ) {
  3462. $this->escape( $args );
  3463. $username = $args[1];
  3464. $password = $args[2];
  3465. $user = $this->login( $username, $password );
  3466. if ( ! $user ) {
  3467. return $this->error;
  3468. }
  3469. if ( ! current_user_can( 'edit_posts' ) ) {
  3470. return new IXR_Error( 403, __( 'Sorry, you are not allowed to access details about this site.' ) );
  3471. }
  3472. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3473. do_action( 'xmlrpc_call', 'wp.getPostStatusList' );
  3474. return get_post_statuses();
  3475. }
  3476. /**
  3477. * Retrieve page statuses.
  3478. *
  3479. * @since 2.5.0
  3480. *
  3481. * @param array $args {
  3482. * Method arguments. Note: arguments must be ordered as documented.
  3483. *
  3484. * @type int $blog_id (unused)
  3485. * @type string $username
  3486. * @type string $password
  3487. * }
  3488. * @return array|IXR_Error
  3489. */
  3490. public function wp_getPageStatusList( $args ) {
  3491. $this->escape( $args );
  3492. $username = $args[1];
  3493. $password = $args[2];
  3494. $user = $this->login( $username, $password );
  3495. if ( ! $user ) {
  3496. return $this->error;
  3497. }
  3498. if ( ! current_user_can( 'edit_pages' ) ) {
  3499. return new IXR_Error( 403, __( 'Sorry, you are not allowed to access details about this site.' ) );
  3500. }
  3501. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3502. do_action( 'xmlrpc_call', 'wp.getPageStatusList' );
  3503. return get_page_statuses();
  3504. }
  3505. /**
  3506. * Retrieve page templates.
  3507. *
  3508. * @since 2.6.0
  3509. *
  3510. * @param array $args {
  3511. * Method arguments. Note: arguments must be ordered as documented.
  3512. *
  3513. * @type int $blog_id (unused)
  3514. * @type string $username
  3515. * @type string $password
  3516. * }
  3517. * @return array|IXR_Error
  3518. */
  3519. public function wp_getPageTemplates( $args ) {
  3520. $this->escape( $args );
  3521. $username = $args[1];
  3522. $password = $args[2];
  3523. $user = $this->login( $username, $password );
  3524. if ( ! $user ) {
  3525. return $this->error;
  3526. }
  3527. if ( ! current_user_can( 'edit_pages' ) ) {
  3528. return new IXR_Error( 403, __( 'Sorry, you are not allowed to access details about this site.' ) );
  3529. }
  3530. $templates = get_page_templates();
  3531. $templates['Default'] = 'default';
  3532. return $templates;
  3533. }
  3534. /**
  3535. * Retrieve blog options.
  3536. *
  3537. * @since 2.6.0
  3538. *
  3539. * @param array $args {
  3540. * Method arguments. Note: arguments must be ordered as documented.
  3541. *
  3542. * @type int $blog_id (unused)
  3543. * @type string $username
  3544. * @type string $password
  3545. * @type array $options
  3546. * }
  3547. * @return array|IXR_Error
  3548. */
  3549. public function wp_getOptions( $args ) {
  3550. $this->escape( $args );
  3551. $username = $args[1];
  3552. $password = $args[2];
  3553. $options = isset( $args[3] ) ? (array) $args[3] : array();
  3554. $user = $this->login( $username, $password );
  3555. if ( ! $user ) {
  3556. return $this->error;
  3557. }
  3558. // If no specific options where asked for, return all of them
  3559. if ( count( $options ) == 0 ) {
  3560. $options = array_keys( $this->blog_options );
  3561. }
  3562. return $this->_getOptions( $options );
  3563. }
  3564. /**
  3565. * Retrieve blog options value from list.
  3566. *
  3567. * @since 2.6.0
  3568. *
  3569. * @param array $options Options to retrieve.
  3570. * @return array
  3571. */
  3572. public function _getOptions( $options ) {
  3573. $data = array();
  3574. $can_manage = current_user_can( 'manage_options' );
  3575. foreach ( $options as $option ) {
  3576. if ( array_key_exists( $option, $this->blog_options ) ) {
  3577. $data[ $option ] = $this->blog_options[ $option ];
  3578. //Is the value static or dynamic?
  3579. if ( isset( $data[ $option ]['option'] ) ) {
  3580. $data[ $option ]['value'] = get_option( $data[ $option ]['option'] );
  3581. unset( $data[ $option ]['option'] );
  3582. }
  3583. if ( ! $can_manage ) {
  3584. $data[ $option ]['readonly'] = true;
  3585. }
  3586. }
  3587. }
  3588. return $data;
  3589. }
  3590. /**
  3591. * Update blog options.
  3592. *
  3593. * @since 2.6.0
  3594. *
  3595. * @param array $args {
  3596. * Method arguments. Note: arguments must be ordered as documented.
  3597. *
  3598. * @type int $blog_id (unused)
  3599. * @type string $username
  3600. * @type string $password
  3601. * @type array $options
  3602. * }
  3603. * @return array|IXR_Error
  3604. */
  3605. public function wp_setOptions( $args ) {
  3606. $this->escape( $args );
  3607. $username = $args[1];
  3608. $password = $args[2];
  3609. $options = (array) $args[3];
  3610. $user = $this->login( $username, $password );
  3611. if ( ! $user ) {
  3612. return $this->error;
  3613. }
  3614. if ( ! current_user_can( 'manage_options' ) ) {
  3615. return new IXR_Error( 403, __( 'Sorry, you are not allowed to update options.' ) );
  3616. }
  3617. $option_names = array();
  3618. foreach ( $options as $o_name => $o_value ) {
  3619. $option_names[] = $o_name;
  3620. if ( ! array_key_exists( $o_name, $this->blog_options ) ) {
  3621. continue;
  3622. }
  3623. if ( $this->blog_options[ $o_name ]['readonly'] == true ) {
  3624. continue;
  3625. }
  3626. update_option( $this->blog_options[ $o_name ]['option'], wp_unslash( $o_value ) );
  3627. }
  3628. //Now return the updated values
  3629. return $this->_getOptions( $option_names );
  3630. }
  3631. /**
  3632. * Retrieve a media item by ID
  3633. *
  3634. * @since 3.1.0
  3635. *
  3636. * @param array $args {
  3637. * Method arguments. Note: arguments must be ordered as documented.
  3638. *
  3639. * @type int $blog_id (unused)
  3640. * @type string $username
  3641. * @type string $password
  3642. * @type int $attachment_id
  3643. * }
  3644. * @return array|IXR_Error Associative array contains:
  3645. * - 'date_created_gmt'
  3646. * - 'parent'
  3647. * - 'link'
  3648. * - 'thumbnail'
  3649. * - 'title'
  3650. * - 'caption'
  3651. * - 'description'
  3652. * - 'metadata'
  3653. */
  3654. public function wp_getMediaItem( $args ) {
  3655. $this->escape( $args );
  3656. $username = $args[1];
  3657. $password = $args[2];
  3658. $attachment_id = (int) $args[3];
  3659. $user = $this->login( $username, $password );
  3660. if ( ! $user ) {
  3661. return $this->error;
  3662. }
  3663. if ( ! current_user_can( 'upload_files' ) ) {
  3664. return new IXR_Error( 403, __( 'Sorry, you are not allowed to upload files.' ) );
  3665. }
  3666. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3667. do_action( 'xmlrpc_call', 'wp.getMediaItem' );
  3668. $attachment = get_post( $attachment_id );
  3669. if ( ! $attachment ) {
  3670. return new IXR_Error( 404, __( 'Invalid attachment ID.' ) );
  3671. }
  3672. return $this->_prepare_media_item( $attachment );
  3673. }
  3674. /**
  3675. * Retrieves a collection of media library items (or attachments)
  3676. *
  3677. * Besides the common blog_id (unused), username, and password arguments, it takes a filter
  3678. * array as last argument.
  3679. *
  3680. * Accepted 'filter' keys are 'parent_id', 'mime_type', 'offset', and 'number'.
  3681. *
  3682. * The defaults are as follows:
  3683. * - 'number' - Default is 5. Total number of media items to retrieve.
  3684. * - 'offset' - Default is 0. See WP_Query::query() for more.
  3685. * - 'parent_id' - Default is ''. The post where the media item is attached. Empty string shows all media items. 0 shows unattached media items.
  3686. * - 'mime_type' - Default is ''. Filter by mime type (e.g., 'image/jpeg', 'application/pdf')
  3687. *
  3688. * @since 3.1.0
  3689. *
  3690. * @param array $args {
  3691. * Method arguments. Note: arguments must be ordered as documented.
  3692. *
  3693. * @type int $blog_id (unused)
  3694. * @type string $username
  3695. * @type string $password
  3696. * @type array $struct
  3697. * }
  3698. * @return array|IXR_Error Contains a collection of media items. See wp_xmlrpc_server::wp_getMediaItem() for a description of each item contents
  3699. */
  3700. public function wp_getMediaLibrary( $args ) {
  3701. $this->escape( $args );
  3702. $username = $args[1];
  3703. $password = $args[2];
  3704. $struct = isset( $args[3] ) ? $args[3] : array();
  3705. $user = $this->login( $username, $password );
  3706. if ( ! $user ) {
  3707. return $this->error;
  3708. }
  3709. if ( ! current_user_can( 'upload_files' ) ) {
  3710. return new IXR_Error( 401, __( 'Sorry, you are not allowed to upload files.' ) );
  3711. }
  3712. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3713. do_action( 'xmlrpc_call', 'wp.getMediaLibrary' );
  3714. $parent_id = ( isset( $struct['parent_id'] ) ) ? absint( $struct['parent_id'] ) : '';
  3715. $mime_type = ( isset( $struct['mime_type'] ) ) ? $struct['mime_type'] : '';
  3716. $offset = ( isset( $struct['offset'] ) ) ? absint( $struct['offset'] ) : 0;
  3717. $number = ( isset( $struct['number'] ) ) ? absint( $struct['number'] ) : -1;
  3718. $attachments = get_posts(
  3719. array(
  3720. 'post_type' => 'attachment',
  3721. 'post_parent' => $parent_id,
  3722. 'offset' => $offset,
  3723. 'numberposts' => $number,
  3724. 'post_mime_type' => $mime_type,
  3725. )
  3726. );
  3727. $attachments_struct = array();
  3728. foreach ( $attachments as $attachment ) {
  3729. $attachments_struct[] = $this->_prepare_media_item( $attachment );
  3730. }
  3731. return $attachments_struct;
  3732. }
  3733. /**
  3734. * Retrieves a list of post formats used by the site.
  3735. *
  3736. * @since 3.1.0
  3737. *
  3738. * @param array $args {
  3739. * Method arguments. Note: arguments must be ordered as documented.
  3740. *
  3741. * @type int $blog_id (unused)
  3742. * @type string $username
  3743. * @type string $password
  3744. * }
  3745. * @return array|IXR_Error List of post formats, otherwise IXR_Error object.
  3746. */
  3747. public function wp_getPostFormats( $args ) {
  3748. $this->escape( $args );
  3749. $username = $args[1];
  3750. $password = $args[2];
  3751. $user = $this->login( $username, $password );
  3752. if ( ! $user ) {
  3753. return $this->error;
  3754. }
  3755. if ( ! current_user_can( 'edit_posts' ) ) {
  3756. return new IXR_Error( 403, __( 'Sorry, you are not allowed to access details about this site.' ) );
  3757. }
  3758. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3759. do_action( 'xmlrpc_call', 'wp.getPostFormats' );
  3760. $formats = get_post_format_strings();
  3761. // find out if they want a list of currently supports formats
  3762. if ( isset( $args[3] ) && is_array( $args[3] ) ) {
  3763. if ( $args[3]['show-supported'] ) {
  3764. if ( current_theme_supports( 'post-formats' ) ) {
  3765. $supported = get_theme_support( 'post-formats' );
  3766. $data = array();
  3767. $data['all'] = $formats;
  3768. $data['supported'] = $supported[0];
  3769. $formats = $data;
  3770. }
  3771. }
  3772. }
  3773. return $formats;
  3774. }
  3775. /**
  3776. * Retrieves a post type
  3777. *
  3778. * @since 3.4.0
  3779. *
  3780. * @see get_post_type_object()
  3781. *
  3782. * @param array $args {
  3783. * Method arguments. Note: arguments must be ordered as documented.
  3784. *
  3785. * @type int $blog_id (unused)
  3786. * @type string $username
  3787. * @type string $password
  3788. * @type string $post_type_name
  3789. * @type array $fields (optional)
  3790. * }
  3791. * @return array|IXR_Error Array contains:
  3792. * - 'labels'
  3793. * - 'description'
  3794. * - 'capability_type'
  3795. * - 'cap'
  3796. * - 'map_meta_cap'
  3797. * - 'hierarchical'
  3798. * - 'menu_position'
  3799. * - 'taxonomies'
  3800. * - 'supports'
  3801. */
  3802. public function wp_getPostType( $args ) {
  3803. if ( ! $this->minimum_args( $args, 4 ) ) {
  3804. return $this->error;
  3805. }
  3806. $this->escape( $args );
  3807. $username = $args[1];
  3808. $password = $args[2];
  3809. $post_type_name = $args[3];
  3810. if ( isset( $args[4] ) ) {
  3811. $fields = $args[4];
  3812. } else {
  3813. /**
  3814. * Filters the default query fields used by the given XML-RPC method.
  3815. *
  3816. * @since 3.4.0
  3817. *
  3818. * @param array $fields An array of post type query fields for the given method.
  3819. * @param string $method The method name.
  3820. */
  3821. $fields = apply_filters( 'xmlrpc_default_posttype_fields', array( 'labels', 'cap', 'taxonomies' ), 'wp.getPostType' );
  3822. }
  3823. $user = $this->login( $username, $password );
  3824. if ( ! $user ) {
  3825. return $this->error;
  3826. }
  3827. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3828. do_action( 'xmlrpc_call', 'wp.getPostType' );
  3829. if ( ! post_type_exists( $post_type_name ) ) {
  3830. return new IXR_Error( 403, __( 'Invalid post type.' ) );
  3831. }
  3832. $post_type = get_post_type_object( $post_type_name );
  3833. if ( ! current_user_can( $post_type->cap->edit_posts ) ) {
  3834. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts in this post type.' ) );
  3835. }
  3836. return $this->_prepare_post_type( $post_type, $fields );
  3837. }
  3838. /**
  3839. * Retrieves a post types
  3840. *
  3841. * @since 3.4.0
  3842. *
  3843. * @see get_post_types()
  3844. *
  3845. * @param array $args {
  3846. * Method arguments. Note: arguments must be ordered as documented.
  3847. *
  3848. * @type int $blog_id (unused)
  3849. * @type string $username
  3850. * @type string $password
  3851. * @type array $filter (optional)
  3852. * @type array $fields (optional)
  3853. * }
  3854. * @return array|IXR_Error
  3855. */
  3856. public function wp_getPostTypes( $args ) {
  3857. if ( ! $this->minimum_args( $args, 3 ) ) {
  3858. return $this->error;
  3859. }
  3860. $this->escape( $args );
  3861. $username = $args[1];
  3862. $password = $args[2];
  3863. $filter = isset( $args[3] ) ? $args[3] : array( 'public' => true );
  3864. if ( isset( $args[4] ) ) {
  3865. $fields = $args[4];
  3866. } else {
  3867. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3868. $fields = apply_filters( 'xmlrpc_default_posttype_fields', array( 'labels', 'cap', 'taxonomies' ), 'wp.getPostTypes' );
  3869. }
  3870. $user = $this->login( $username, $password );
  3871. if ( ! $user ) {
  3872. return $this->error;
  3873. }
  3874. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3875. do_action( 'xmlrpc_call', 'wp.getPostTypes' );
  3876. $post_types = get_post_types( $filter, 'objects' );
  3877. $struct = array();
  3878. foreach ( $post_types as $post_type ) {
  3879. if ( ! current_user_can( $post_type->cap->edit_posts ) ) {
  3880. continue;
  3881. }
  3882. $struct[ $post_type->name ] = $this->_prepare_post_type( $post_type, $fields );
  3883. }
  3884. return $struct;
  3885. }
  3886. /**
  3887. * Retrieve revisions for a specific post.
  3888. *
  3889. * @since 3.5.0
  3890. *
  3891. * The optional $fields parameter specifies what fields will be included
  3892. * in the response array.
  3893. *
  3894. * @uses wp_get_post_revisions()
  3895. * @see wp_getPost() for more on $fields
  3896. *
  3897. * @param array $args {
  3898. * Method arguments. Note: arguments must be ordered as documented.
  3899. *
  3900. * @type int $blog_id (unused)
  3901. * @type string $username
  3902. * @type string $password
  3903. * @type int $post_id
  3904. * @type array $fields (optional)
  3905. * }
  3906. * @return array|IXR_Error contains a collection of posts.
  3907. */
  3908. public function wp_getRevisions( $args ) {
  3909. if ( ! $this->minimum_args( $args, 4 ) ) {
  3910. return $this->error;
  3911. }
  3912. $this->escape( $args );
  3913. $username = $args[1];
  3914. $password = $args[2];
  3915. $post_id = (int) $args[3];
  3916. if ( isset( $args[4] ) ) {
  3917. $fields = $args[4];
  3918. } else {
  3919. /**
  3920. * Filters the default revision query fields used by the given XML-RPC method.
  3921. *
  3922. * @since 3.5.0
  3923. *
  3924. * @param array $field An array of revision query fields.
  3925. * @param string $method The method name.
  3926. */
  3927. $fields = apply_filters( 'xmlrpc_default_revision_fields', array( 'post_date', 'post_date_gmt' ), 'wp.getRevisions' );
  3928. }
  3929. $user = $this->login( $username, $password );
  3930. if ( ! $user ) {
  3931. return $this->error;
  3932. }
  3933. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3934. do_action( 'xmlrpc_call', 'wp.getRevisions' );
  3935. $post = get_post( $post_id );
  3936. if ( ! $post ) {
  3937. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  3938. }
  3939. if ( ! current_user_can( 'edit_post', $post_id ) ) {
  3940. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts.' ) );
  3941. }
  3942. // Check if revisions are enabled.
  3943. if ( ! wp_revisions_enabled( $post ) ) {
  3944. return new IXR_Error( 401, __( 'Sorry, revisions are disabled.' ) );
  3945. }
  3946. $revisions = wp_get_post_revisions( $post_id );
  3947. if ( ! $revisions ) {
  3948. return array();
  3949. }
  3950. $struct = array();
  3951. foreach ( $revisions as $revision ) {
  3952. if ( ! current_user_can( 'read_post', $revision->ID ) ) {
  3953. continue;
  3954. }
  3955. // Skip autosaves
  3956. if ( wp_is_post_autosave( $revision ) ) {
  3957. continue;
  3958. }
  3959. $struct[] = $this->_prepare_post( get_object_vars( $revision ), $fields );
  3960. }
  3961. return $struct;
  3962. }
  3963. /**
  3964. * Restore a post revision
  3965. *
  3966. * @since 3.5.0
  3967. *
  3968. * @uses wp_restore_post_revision()
  3969. *
  3970. * @param array $args {
  3971. * Method arguments. Note: arguments must be ordered as documented.
  3972. *
  3973. * @type int $blog_id (unused)
  3974. * @type string $username
  3975. * @type string $password
  3976. * @type int $revision_id
  3977. * }
  3978. * @return bool|IXR_Error false if there was an error restoring, true if success.
  3979. */
  3980. public function wp_restoreRevision( $args ) {
  3981. if ( ! $this->minimum_args( $args, 3 ) ) {
  3982. return $this->error;
  3983. }
  3984. $this->escape( $args );
  3985. $username = $args[1];
  3986. $password = $args[2];
  3987. $revision_id = (int) $args[3];
  3988. $user = $this->login( $username, $password );
  3989. if ( ! $user ) {
  3990. return $this->error;
  3991. }
  3992. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3993. do_action( 'xmlrpc_call', 'wp.restoreRevision' );
  3994. $revision = wp_get_post_revision( $revision_id );
  3995. if ( ! $revision ) {
  3996. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  3997. }
  3998. if ( wp_is_post_autosave( $revision ) ) {
  3999. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  4000. }
  4001. $post = get_post( $revision->post_parent );
  4002. if ( ! $post ) {
  4003. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  4004. }
  4005. if ( ! current_user_can( 'edit_post', $revision->post_parent ) ) {
  4006. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  4007. }
  4008. // Check if revisions are disabled.
  4009. if ( ! wp_revisions_enabled( $post ) ) {
  4010. return new IXR_Error( 401, __( 'Sorry, revisions are disabled.' ) );
  4011. }
  4012. $post = wp_restore_post_revision( $revision_id );
  4013. return (bool) $post;
  4014. }
  4015. /* Blogger API functions.
  4016. * specs on http://plant.blogger.com/api and https://groups.yahoo.com/group/bloggerDev/
  4017. */
  4018. /**
  4019. * Retrieve blogs that user owns.
  4020. *
  4021. * Will make more sense once we support multiple blogs.
  4022. *
  4023. * @since 1.5.0
  4024. *
  4025. * @param array $args {
  4026. * Method arguments. Note: arguments must be ordered as documented.
  4027. *
  4028. * @type int $blog_id (unused)
  4029. * @type string $username
  4030. * @type string $password
  4031. * }
  4032. * @return array|IXR_Error
  4033. */
  4034. public function blogger_getUsersBlogs( $args ) {
  4035. if ( ! $this->minimum_args( $args, 3 ) ) {
  4036. return $this->error;
  4037. }
  4038. if ( is_multisite() ) {
  4039. return $this->_multisite_getUsersBlogs( $args );
  4040. }
  4041. $this->escape( $args );
  4042. $username = $args[1];
  4043. $password = $args[2];
  4044. $user = $this->login( $username, $password );
  4045. if ( ! $user ) {
  4046. return $this->error;
  4047. }
  4048. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4049. do_action( 'xmlrpc_call', 'blogger.getUsersBlogs' );
  4050. $is_admin = current_user_can( 'manage_options' );
  4051. $struct = array(
  4052. 'isAdmin' => $is_admin,
  4053. 'url' => get_option( 'home' ) . '/',
  4054. 'blogid' => '1',
  4055. 'blogName' => get_option( 'blogname' ),
  4056. 'xmlrpc' => site_url( 'xmlrpc.php', 'rpc' ),
  4057. );
  4058. return array( $struct );
  4059. }
  4060. /**
  4061. * Private function for retrieving a users blogs for multisite setups
  4062. *
  4063. * @since 3.0.0
  4064. *
  4065. * @param array $args {
  4066. * Method arguments. Note: arguments must be ordered as documented.
  4067. *
  4068. * @type string $username Username.
  4069. * @type string $password Password.
  4070. * }
  4071. * @return array|IXR_Error
  4072. */
  4073. protected function _multisite_getUsersBlogs( $args ) {
  4074. $current_blog = get_site();
  4075. $domain = $current_blog->domain;
  4076. $path = $current_blog->path . 'xmlrpc.php';
  4077. $rpc = new IXR_Client( set_url_scheme( "http://{$domain}{$path}" ) );
  4078. $rpc->query( 'wp.getUsersBlogs', $args[1], $args[2] );
  4079. $blogs = $rpc->getResponse();
  4080. if ( isset( $blogs['faultCode'] ) ) {
  4081. return new IXR_Error( $blogs['faultCode'], $blogs['faultString'] );
  4082. }
  4083. if ( $_SERVER['HTTP_HOST'] == $domain && $_SERVER['REQUEST_URI'] == $path ) {
  4084. return $blogs;
  4085. } else {
  4086. foreach ( (array) $blogs as $blog ) {
  4087. if ( strpos( $blog['url'], $_SERVER['HTTP_HOST'] ) ) {
  4088. return array( $blog );
  4089. }
  4090. }
  4091. return array();
  4092. }
  4093. }
  4094. /**
  4095. * Retrieve user's data.
  4096. *
  4097. * Gives your client some info about you, so you don't have to.
  4098. *
  4099. * @since 1.5.0
  4100. *
  4101. * @param array $args {
  4102. * Method arguments. Note: arguments must be ordered as documented.
  4103. *
  4104. * @type int $blog_id (unused)
  4105. * @type string $username
  4106. * @type string $password
  4107. * }
  4108. * @return array|IXR_Error
  4109. */
  4110. public function blogger_getUserInfo( $args ) {
  4111. $this->escape( $args );
  4112. $username = $args[1];
  4113. $password = $args[2];
  4114. $user = $this->login( $username, $password );
  4115. if ( ! $user ) {
  4116. return $this->error;
  4117. }
  4118. if ( ! current_user_can( 'edit_posts' ) ) {
  4119. return new IXR_Error( 401, __( 'Sorry, you are not allowed to access user data on this site.' ) );
  4120. }
  4121. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4122. do_action( 'xmlrpc_call', 'blogger.getUserInfo' );
  4123. $struct = array(
  4124. 'nickname' => $user->nickname,
  4125. 'userid' => $user->ID,
  4126. 'url' => $user->user_url,
  4127. 'lastname' => $user->last_name,
  4128. 'firstname' => $user->first_name,
  4129. );
  4130. return $struct;
  4131. }
  4132. /**
  4133. * Retrieve post.
  4134. *
  4135. * @since 1.5.0
  4136. *
  4137. * @param array $args {
  4138. * Method arguments. Note: arguments must be ordered as documented.
  4139. *
  4140. * @type int $blog_id (unused)
  4141. * @type int $post_ID
  4142. * @type string $username
  4143. * @type string $password
  4144. * }
  4145. * @return array|IXR_Error
  4146. */
  4147. public function blogger_getPost( $args ) {
  4148. $this->escape( $args );
  4149. $post_ID = (int) $args[1];
  4150. $username = $args[2];
  4151. $password = $args[3];
  4152. $user = $this->login( $username, $password );
  4153. if ( ! $user ) {
  4154. return $this->error;
  4155. }
  4156. $post_data = get_post( $post_ID, ARRAY_A );
  4157. if ( ! $post_data ) {
  4158. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  4159. }
  4160. if ( ! current_user_can( 'edit_post', $post_ID ) ) {
  4161. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  4162. }
  4163. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4164. do_action( 'xmlrpc_call', 'blogger.getPost' );
  4165. $categories = implode( ',', wp_get_post_categories( $post_ID ) );
  4166. $content = '<title>' . wp_unslash( $post_data['post_title'] ) . '</title>';
  4167. $content .= '<category>' . $categories . '</category>';
  4168. $content .= wp_unslash( $post_data['post_content'] );
  4169. $struct = array(
  4170. 'userid' => $post_data['post_author'],
  4171. 'dateCreated' => $this->_convert_date( $post_data['post_date'] ),
  4172. 'content' => $content,
  4173. 'postid' => (string) $post_data['ID'],
  4174. );
  4175. return $struct;
  4176. }
  4177. /**
  4178. * Retrieve list of recent posts.
  4179. *
  4180. * @since 1.5.0
  4181. *
  4182. * @param array $args {
  4183. * Method arguments. Note: arguments must be ordered as documented.
  4184. *
  4185. * @type string $appkey (unused)
  4186. * @type int $blog_id (unused)
  4187. * @type string $username
  4188. * @type string $password
  4189. * @type int $numberposts (optional)
  4190. * }
  4191. * @return array|IXR_Error
  4192. */
  4193. public function blogger_getRecentPosts( $args ) {
  4194. $this->escape( $args );
  4195. // $args[0] = appkey - ignored
  4196. $username = $args[2];
  4197. $password = $args[3];
  4198. if ( isset( $args[4] ) ) {
  4199. $query = array( 'numberposts' => absint( $args[4] ) );
  4200. } else {
  4201. $query = array();
  4202. }
  4203. $user = $this->login( $username, $password );
  4204. if ( ! $user ) {
  4205. return $this->error;
  4206. }
  4207. if ( ! current_user_can( 'edit_posts' ) ) {
  4208. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts.' ) );
  4209. }
  4210. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4211. do_action( 'xmlrpc_call', 'blogger.getRecentPosts' );
  4212. $posts_list = wp_get_recent_posts( $query );
  4213. if ( ! $posts_list ) {
  4214. $this->error = new IXR_Error( 500, __( 'Either there are no posts, or something went wrong.' ) );
  4215. return $this->error;
  4216. }
  4217. $recent_posts = array();
  4218. foreach ( $posts_list as $entry ) {
  4219. if ( ! current_user_can( 'edit_post', $entry['ID'] ) ) {
  4220. continue;
  4221. }
  4222. $post_date = $this->_convert_date( $entry['post_date'] );
  4223. $categories = implode( ',', wp_get_post_categories( $entry['ID'] ) );
  4224. $content = '<title>' . wp_unslash( $entry['post_title'] ) . '</title>';
  4225. $content .= '<category>' . $categories . '</category>';
  4226. $content .= wp_unslash( $entry['post_content'] );
  4227. $recent_posts[] = array(
  4228. 'userid' => $entry['post_author'],
  4229. 'dateCreated' => $post_date,
  4230. 'content' => $content,
  4231. 'postid' => (string) $entry['ID'],
  4232. );
  4233. }
  4234. return $recent_posts;
  4235. }
  4236. /**
  4237. * Deprecated.
  4238. *
  4239. * @since 1.5.0
  4240. * @deprecated 3.5.0
  4241. *
  4242. * @param array $args Unused.
  4243. * @return IXR_Error Error object.
  4244. */
  4245. public function blogger_getTemplate( $args ) {
  4246. return new IXR_Error( 403, __( 'Sorry, that file cannot be edited.' ) );
  4247. }
  4248. /**
  4249. * Deprecated.
  4250. *
  4251. * @since 1.5.0
  4252. * @deprecated 3.5.0
  4253. *
  4254. * @param array $args Unused.
  4255. * @return IXR_Error Error object.
  4256. */
  4257. public function blogger_setTemplate( $args ) {
  4258. return new IXR_Error( 403, __( 'Sorry, that file cannot be edited.' ) );
  4259. }
  4260. /**
  4261. * Creates new post.
  4262. *
  4263. * @since 1.5.0
  4264. *
  4265. * @param array $args {
  4266. * Method arguments. Note: arguments must be ordered as documented.
  4267. *
  4268. * @type string $appkey (unused)
  4269. * @type int $blog_id (unused)
  4270. * @type string $username
  4271. * @type string $password
  4272. * @type string $content
  4273. * @type string $publish
  4274. * }
  4275. * @return int|IXR_Error
  4276. */
  4277. public function blogger_newPost( $args ) {
  4278. $this->escape( $args );
  4279. $username = $args[2];
  4280. $password = $args[3];
  4281. $content = $args[4];
  4282. $publish = $args[5];
  4283. $user = $this->login( $username, $password );
  4284. if ( ! $user ) {
  4285. return $this->error;
  4286. }
  4287. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4288. do_action( 'xmlrpc_call', 'blogger.newPost' );
  4289. $cap = ( $publish ) ? 'publish_posts' : 'edit_posts';
  4290. if ( ! current_user_can( get_post_type_object( 'post' )->cap->create_posts ) || ! current_user_can( $cap ) ) {
  4291. return new IXR_Error( 401, __( 'Sorry, you are not allowed to post on this site.' ) );
  4292. }
  4293. $post_status = ( $publish ) ? 'publish' : 'draft';
  4294. $post_author = $user->ID;
  4295. $post_title = xmlrpc_getposttitle( $content );
  4296. $post_category = xmlrpc_getpostcategory( $content );
  4297. $post_content = xmlrpc_removepostdata( $content );
  4298. $post_date = current_time( 'mysql' );
  4299. $post_date_gmt = current_time( 'mysql', 1 );
  4300. $post_data = compact( 'post_author', 'post_date', 'post_date_gmt', 'post_content', 'post_title', 'post_category', 'post_status' );
  4301. $post_ID = wp_insert_post( $post_data );
  4302. if ( is_wp_error( $post_ID ) ) {
  4303. return new IXR_Error( 500, $post_ID->get_error_message() );
  4304. }
  4305. if ( ! $post_ID ) {
  4306. return new IXR_Error( 500, __( 'Sorry, your entry could not be posted.' ) );
  4307. }
  4308. $this->attach_uploads( $post_ID, $post_content );
  4309. /**
  4310. * Fires after a new post has been successfully created via the XML-RPC Blogger API.
  4311. *
  4312. * @since 3.4.0
  4313. *
  4314. * @param int $post_ID ID of the new post.
  4315. * @param array $args An array of new post arguments.
  4316. */
  4317. do_action( 'xmlrpc_call_success_blogger_newPost', $post_ID, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  4318. return $post_ID;
  4319. }
  4320. /**
  4321. * Edit a post.
  4322. *
  4323. * @since 1.5.0
  4324. *
  4325. * @param array $args {
  4326. * Method arguments. Note: arguments must be ordered as documented.
  4327. *
  4328. * @type int $blog_id (unused)
  4329. * @type int $post_ID
  4330. * @type string $username
  4331. * @type string $password
  4332. * @type string $content
  4333. * @type bool $publish
  4334. * }
  4335. * @return true|IXR_Error true when done.
  4336. */
  4337. public function blogger_editPost( $args ) {
  4338. $this->escape( $args );
  4339. $post_ID = (int) $args[1];
  4340. $username = $args[2];
  4341. $password = $args[3];
  4342. $content = $args[4];
  4343. $publish = $args[5];
  4344. $user = $this->login( $username, $password );
  4345. if ( ! $user ) {
  4346. return $this->error;
  4347. }
  4348. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4349. do_action( 'xmlrpc_call', 'blogger.editPost' );
  4350. $actual_post = get_post( $post_ID, ARRAY_A );
  4351. if ( ! $actual_post || $actual_post['post_type'] != 'post' ) {
  4352. return new IXR_Error( 404, __( 'Sorry, no such post.' ) );
  4353. }
  4354. $this->escape( $actual_post );
  4355. if ( ! current_user_can( 'edit_post', $post_ID ) ) {
  4356. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  4357. }
  4358. if ( 'publish' == $actual_post['post_status'] && ! current_user_can( 'publish_posts' ) ) {
  4359. return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish this post.' ) );
  4360. }
  4361. $postdata = array();
  4362. $postdata['ID'] = $actual_post['ID'];
  4363. $postdata['post_content'] = xmlrpc_removepostdata( $content );
  4364. $postdata['post_title'] = xmlrpc_getposttitle( $content );
  4365. $postdata['post_category'] = xmlrpc_getpostcategory( $content );
  4366. $postdata['post_status'] = $actual_post['post_status'];
  4367. $postdata['post_excerpt'] = $actual_post['post_excerpt'];
  4368. $postdata['post_status'] = $publish ? 'publish' : 'draft';
  4369. $result = wp_update_post( $postdata );
  4370. if ( ! $result ) {
  4371. return new IXR_Error( 500, __( 'For some strange yet very annoying reason, this post could not be edited.' ) );
  4372. }
  4373. $this->attach_uploads( $actual_post['ID'], $postdata['post_content'] );
  4374. /**
  4375. * Fires after a post has been successfully updated via the XML-RPC Blogger API.
  4376. *
  4377. * @since 3.4.0
  4378. *
  4379. * @param int $post_ID ID of the updated post.
  4380. * @param array $args An array of arguments for the post to edit.
  4381. */
  4382. do_action( 'xmlrpc_call_success_blogger_editPost', $post_ID, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  4383. return true;
  4384. }
  4385. /**
  4386. * Remove a post.
  4387. *
  4388. * @since 1.5.0
  4389. *
  4390. * @param array $args {
  4391. * Method arguments. Note: arguments must be ordered as documented.
  4392. *
  4393. * @type int $blog_id (unused)
  4394. * @type int $post_ID
  4395. * @type string $username
  4396. * @type string $password
  4397. * }
  4398. * @return true|IXR_Error True when post is deleted.
  4399. */
  4400. public function blogger_deletePost( $args ) {
  4401. $this->escape( $args );
  4402. $post_ID = (int) $args[1];
  4403. $username = $args[2];
  4404. $password = $args[3];
  4405. $user = $this->login( $username, $password );
  4406. if ( ! $user ) {
  4407. return $this->error;
  4408. }
  4409. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4410. do_action( 'xmlrpc_call', 'blogger.deletePost' );
  4411. $actual_post = get_post( $post_ID, ARRAY_A );
  4412. if ( ! $actual_post || $actual_post['post_type'] != 'post' ) {
  4413. return new IXR_Error( 404, __( 'Sorry, no such post.' ) );
  4414. }
  4415. if ( ! current_user_can( 'delete_post', $post_ID ) ) {
  4416. return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this post.' ) );
  4417. }
  4418. $result = wp_delete_post( $post_ID );
  4419. if ( ! $result ) {
  4420. return new IXR_Error( 500, __( 'The post cannot be deleted.' ) );
  4421. }
  4422. /**
  4423. * Fires after a post has been successfully deleted via the XML-RPC Blogger API.
  4424. *
  4425. * @since 3.4.0
  4426. *
  4427. * @param int $post_ID ID of the deleted post.
  4428. * @param array $args An array of arguments to delete the post.
  4429. */
  4430. do_action( 'xmlrpc_call_success_blogger_deletePost', $post_ID, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  4431. return true;
  4432. }
  4433. /* MetaWeblog API functions
  4434. * specs on wherever Dave Winer wants them to be
  4435. */
  4436. /**
  4437. * Create a new post.
  4438. *
  4439. * The 'content_struct' argument must contain:
  4440. * - title
  4441. * - description
  4442. * - mt_excerpt
  4443. * - mt_text_more
  4444. * - mt_keywords
  4445. * - mt_tb_ping_urls
  4446. * - categories
  4447. *
  4448. * Also, it can optionally contain:
  4449. * - wp_slug
  4450. * - wp_password
  4451. * - wp_page_parent_id
  4452. * - wp_page_order
  4453. * - wp_author_id
  4454. * - post_status | page_status - can be 'draft', 'private', 'publish', or 'pending'
  4455. * - mt_allow_comments - can be 'open' or 'closed'
  4456. * - mt_allow_pings - can be 'open' or 'closed'
  4457. * - date_created_gmt
  4458. * - dateCreated
  4459. * - wp_post_thumbnail
  4460. *
  4461. * @since 1.5.0
  4462. *
  4463. * @param array $args {
  4464. * Method arguments. Note: arguments must be ordered as documented.
  4465. *
  4466. * @type int $blog_id (unused)
  4467. * @type string $username
  4468. * @type string $password
  4469. * @type array $content_struct
  4470. * @type int $publish
  4471. * }
  4472. * @return int|IXR_Error
  4473. */
  4474. public function mw_newPost( $args ) {
  4475. $this->escape( $args );
  4476. $username = $args[1];
  4477. $password = $args[2];
  4478. $content_struct = $args[3];
  4479. $publish = isset( $args[4] ) ? $args[4] : 0;
  4480. $user = $this->login( $username, $password );
  4481. if ( ! $user ) {
  4482. return $this->error;
  4483. }
  4484. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4485. do_action( 'xmlrpc_call', 'metaWeblog.newPost' );
  4486. $page_template = '';
  4487. if ( ! empty( $content_struct['post_type'] ) ) {
  4488. if ( $content_struct['post_type'] == 'page' ) {
  4489. if ( $publish ) {
  4490. $cap = 'publish_pages';
  4491. } elseif ( isset( $content_struct['page_status'] ) && 'publish' == $content_struct['page_status'] ) {
  4492. $cap = 'publish_pages';
  4493. } else {
  4494. $cap = 'edit_pages';
  4495. }
  4496. $error_message = __( 'Sorry, you are not allowed to publish pages on this site.' );
  4497. $post_type = 'page';
  4498. if ( ! empty( $content_struct['wp_page_template'] ) ) {
  4499. $page_template = $content_struct['wp_page_template'];
  4500. }
  4501. } elseif ( $content_struct['post_type'] == 'post' ) {
  4502. if ( $publish ) {
  4503. $cap = 'publish_posts';
  4504. } elseif ( isset( $content_struct['post_status'] ) && 'publish' == $content_struct['post_status'] ) {
  4505. $cap = 'publish_posts';
  4506. } else {
  4507. $cap = 'edit_posts';
  4508. }
  4509. $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
  4510. $post_type = 'post';
  4511. } else {
  4512. // No other post_type values are allowed here
  4513. return new IXR_Error( 401, __( 'Invalid post type.' ) );
  4514. }
  4515. } else {
  4516. if ( $publish ) {
  4517. $cap = 'publish_posts';
  4518. } elseif ( isset( $content_struct['post_status'] ) && 'publish' == $content_struct['post_status'] ) {
  4519. $cap = 'publish_posts';
  4520. } else {
  4521. $cap = 'edit_posts';
  4522. }
  4523. $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
  4524. $post_type = 'post';
  4525. }
  4526. if ( ! current_user_can( get_post_type_object( $post_type )->cap->create_posts ) ) {
  4527. return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish posts on this site.' ) );
  4528. }
  4529. if ( ! current_user_can( $cap ) ) {
  4530. return new IXR_Error( 401, $error_message );
  4531. }
  4532. // Check for a valid post format if one was given
  4533. if ( isset( $content_struct['wp_post_format'] ) ) {
  4534. $content_struct['wp_post_format'] = sanitize_key( $content_struct['wp_post_format'] );
  4535. if ( ! array_key_exists( $content_struct['wp_post_format'], get_post_format_strings() ) ) {
  4536. return new IXR_Error( 404, __( 'Invalid post format.' ) );
  4537. }
  4538. }
  4539. // Let WordPress generate the post_name (slug) unless
  4540. // one has been provided.
  4541. $post_name = '';
  4542. if ( isset( $content_struct['wp_slug'] ) ) {
  4543. $post_name = $content_struct['wp_slug'];
  4544. }
  4545. // Only use a password if one was given.
  4546. if ( isset( $content_struct['wp_password'] ) ) {
  4547. $post_password = $content_struct['wp_password'];
  4548. } else {
  4549. $post_password = '';
  4550. }
  4551. // Only set a post parent if one was provided.
  4552. if ( isset( $content_struct['wp_page_parent_id'] ) ) {
  4553. $post_parent = $content_struct['wp_page_parent_id'];
  4554. } else {
  4555. $post_parent = 0;
  4556. }
  4557. // Only set the menu_order if it was provided.
  4558. if ( isset( $content_struct['wp_page_order'] ) ) {
  4559. $menu_order = $content_struct['wp_page_order'];
  4560. } else {
  4561. $menu_order = 0;
  4562. }
  4563. $post_author = $user->ID;
  4564. // If an author id was provided then use it instead.
  4565. if ( isset( $content_struct['wp_author_id'] ) && ( $user->ID != $content_struct['wp_author_id'] ) ) {
  4566. switch ( $post_type ) {
  4567. case 'post':
  4568. if ( ! current_user_can( 'edit_others_posts' ) ) {
  4569. return new IXR_Error( 401, __( 'Sorry, you are not allowed to create posts as this user.' ) );
  4570. }
  4571. break;
  4572. case 'page':
  4573. if ( ! current_user_can( 'edit_others_pages' ) ) {
  4574. return new IXR_Error( 401, __( 'Sorry, you are not allowed to create pages as this user.' ) );
  4575. }
  4576. break;
  4577. default:
  4578. return new IXR_Error( 401, __( 'Invalid post type.' ) );
  4579. }
  4580. $author = get_userdata( $content_struct['wp_author_id'] );
  4581. if ( ! $author ) {
  4582. return new IXR_Error( 404, __( 'Invalid author ID.' ) );
  4583. }
  4584. $post_author = $content_struct['wp_author_id'];
  4585. }
  4586. $post_title = isset( $content_struct['title'] ) ? $content_struct['title'] : null;
  4587. $post_content = isset( $content_struct['description'] ) ? $content_struct['description'] : null;
  4588. $post_status = $publish ? 'publish' : 'draft';
  4589. if ( isset( $content_struct[ "{$post_type}_status" ] ) ) {
  4590. switch ( $content_struct[ "{$post_type}_status" ] ) {
  4591. case 'draft':
  4592. case 'pending':
  4593. case 'private':
  4594. case 'publish':
  4595. $post_status = $content_struct[ "{$post_type}_status" ];
  4596. break;
  4597. default:
  4598. $post_status = $publish ? 'publish' : 'draft';
  4599. break;
  4600. }
  4601. }
  4602. $post_excerpt = isset( $content_struct['mt_excerpt'] ) ? $content_struct['mt_excerpt'] : null;
  4603. $post_more = isset( $content_struct['mt_text_more'] ) ? $content_struct['mt_text_more'] : null;
  4604. $tags_input = isset( $content_struct['mt_keywords'] ) ? $content_struct['mt_keywords'] : null;
  4605. if ( isset( $content_struct['mt_allow_comments'] ) ) {
  4606. if ( ! is_numeric( $content_struct['mt_allow_comments'] ) ) {
  4607. switch ( $content_struct['mt_allow_comments'] ) {
  4608. case 'closed':
  4609. $comment_status = 'closed';
  4610. break;
  4611. case 'open':
  4612. $comment_status = 'open';
  4613. break;
  4614. default:
  4615. $comment_status = get_default_comment_status( $post_type );
  4616. break;
  4617. }
  4618. } else {
  4619. switch ( (int) $content_struct['mt_allow_comments'] ) {
  4620. case 0:
  4621. case 2:
  4622. $comment_status = 'closed';
  4623. break;
  4624. case 1:
  4625. $comment_status = 'open';
  4626. break;
  4627. default:
  4628. $comment_status = get_default_comment_status( $post_type );
  4629. break;
  4630. }
  4631. }
  4632. } else {
  4633. $comment_status = get_default_comment_status( $post_type );
  4634. }
  4635. if ( isset( $content_struct['mt_allow_pings'] ) ) {
  4636. if ( ! is_numeric( $content_struct['mt_allow_pings'] ) ) {
  4637. switch ( $content_struct['mt_allow_pings'] ) {
  4638. case 'closed':
  4639. $ping_status = 'closed';
  4640. break;
  4641. case 'open':
  4642. $ping_status = 'open';
  4643. break;
  4644. default:
  4645. $ping_status = get_default_comment_status( $post_type, 'pingback' );
  4646. break;
  4647. }
  4648. } else {
  4649. switch ( (int) $content_struct['mt_allow_pings'] ) {
  4650. case 0:
  4651. $ping_status = 'closed';
  4652. break;
  4653. case 1:
  4654. $ping_status = 'open';
  4655. break;
  4656. default:
  4657. $ping_status = get_default_comment_status( $post_type, 'pingback' );
  4658. break;
  4659. }
  4660. }
  4661. } else {
  4662. $ping_status = get_default_comment_status( $post_type, 'pingback' );
  4663. }
  4664. if ( $post_more ) {
  4665. $post_content = $post_content . '<!--more-->' . $post_more;
  4666. }
  4667. $to_ping = null;
  4668. if ( isset( $content_struct['mt_tb_ping_urls'] ) ) {
  4669. $to_ping = $content_struct['mt_tb_ping_urls'];
  4670. if ( is_array( $to_ping ) ) {
  4671. $to_ping = implode( ' ', $to_ping );
  4672. }
  4673. }
  4674. // Do some timestamp voodoo
  4675. if ( ! empty( $content_struct['date_created_gmt'] ) ) {
  4676. // We know this is supposed to be GMT, so we're going to slap that Z on there by force
  4677. $dateCreated = rtrim( $content_struct['date_created_gmt']->getIso(), 'Z' ) . 'Z';
  4678. } elseif ( ! empty( $content_struct['dateCreated'] ) ) {
  4679. $dateCreated = $content_struct['dateCreated']->getIso();
  4680. }
  4681. if ( ! empty( $dateCreated ) ) {
  4682. $post_date = get_date_from_gmt( iso8601_to_datetime( $dateCreated ) );
  4683. $post_date_gmt = iso8601_to_datetime( $dateCreated, 'GMT' );
  4684. } else {
  4685. $post_date = '';
  4686. $post_date_gmt = '';
  4687. }
  4688. $post_category = array();
  4689. if ( isset( $content_struct['categories'] ) ) {
  4690. $catnames = $content_struct['categories'];
  4691. if ( is_array( $catnames ) ) {
  4692. foreach ( $catnames as $cat ) {
  4693. $post_category[] = get_cat_ID( $cat );
  4694. }
  4695. }
  4696. }
  4697. $postdata = compact( 'post_author', 'post_date', 'post_date_gmt', 'post_content', 'post_title', 'post_category', 'post_status', 'post_excerpt', 'comment_status', 'ping_status', 'to_ping', 'post_type', 'post_name', 'post_password', 'post_parent', 'menu_order', 'tags_input', 'page_template' );
  4698. $post_ID = get_default_post_to_edit( $post_type, true )->ID;
  4699. $postdata['ID'] = $post_ID;
  4700. // Only posts can be sticky
  4701. if ( $post_type == 'post' && isset( $content_struct['sticky'] ) ) {
  4702. $data = $postdata;
  4703. $data['sticky'] = $content_struct['sticky'];
  4704. $error = $this->_toggle_sticky( $data );
  4705. if ( $error ) {
  4706. return $error;
  4707. }
  4708. }
  4709. if ( isset( $content_struct['custom_fields'] ) ) {
  4710. $this->set_custom_fields( $post_ID, $content_struct['custom_fields'] );
  4711. }
  4712. if ( isset( $content_struct['wp_post_thumbnail'] ) ) {
  4713. if ( set_post_thumbnail( $post_ID, $content_struct['wp_post_thumbnail'] ) === false ) {
  4714. return new IXR_Error( 404, __( 'Invalid attachment ID.' ) );
  4715. }
  4716. unset( $content_struct['wp_post_thumbnail'] );
  4717. }
  4718. // Handle enclosures
  4719. $thisEnclosure = isset( $content_struct['enclosure'] ) ? $content_struct['enclosure'] : null;
  4720. $this->add_enclosure_if_new( $post_ID, $thisEnclosure );
  4721. $this->attach_uploads( $post_ID, $post_content );
  4722. // Handle post formats if assigned, value is validated earlier
  4723. // in this function
  4724. if ( isset( $content_struct['wp_post_format'] ) ) {
  4725. set_post_format( $post_ID, $content_struct['wp_post_format'] );
  4726. }
  4727. $post_ID = wp_insert_post( $postdata, true );
  4728. if ( is_wp_error( $post_ID ) ) {
  4729. return new IXR_Error( 500, $post_ID->get_error_message() );
  4730. }
  4731. if ( ! $post_ID ) {
  4732. return new IXR_Error( 500, __( 'Sorry, your entry could not be posted.' ) );
  4733. }
  4734. /**
  4735. * Fires after a new post has been successfully created via the XML-RPC MovableType API.
  4736. *
  4737. * @since 3.4.0
  4738. *
  4739. * @param int $post_ID ID of the new post.
  4740. * @param array $args An array of arguments to create the new post.
  4741. */
  4742. do_action( 'xmlrpc_call_success_mw_newPost', $post_ID, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  4743. return strval( $post_ID );
  4744. }
  4745. /**
  4746. * Adds an enclosure to a post if it's new.
  4747. *
  4748. * @since 2.8.0
  4749. *
  4750. * @param integer $post_ID Post ID.
  4751. * @param array $enclosure Enclosure data.
  4752. */
  4753. public function add_enclosure_if_new( $post_ID, $enclosure ) {
  4754. if ( is_array( $enclosure ) && isset( $enclosure['url'] ) && isset( $enclosure['length'] ) && isset( $enclosure['type'] ) ) {
  4755. $encstring = $enclosure['url'] . "\n" . $enclosure['length'] . "\n" . $enclosure['type'] . "\n";
  4756. $found = false;
  4757. $enclosures = get_post_meta( $post_ID, 'enclosure' );
  4758. if ( $enclosures ) {
  4759. foreach ( $enclosures as $enc ) {
  4760. // This method used to omit the trailing new line. #23219
  4761. if ( rtrim( $enc, "\n" ) == rtrim( $encstring, "\n" ) ) {
  4762. $found = true;
  4763. break;
  4764. }
  4765. }
  4766. }
  4767. if ( ! $found ) {
  4768. add_post_meta( $post_ID, 'enclosure', $encstring );
  4769. }
  4770. }
  4771. }
  4772. /**
  4773. * Attach upload to a post.
  4774. *
  4775. * @since 2.1.0
  4776. *
  4777. * @global wpdb $wpdb WordPress database abstraction object.
  4778. *
  4779. * @param int $post_ID Post ID.
  4780. * @param string $post_content Post Content for attachment.
  4781. */
  4782. public function attach_uploads( $post_ID, $post_content ) {
  4783. global $wpdb;
  4784. // find any unattached files
  4785. $attachments = $wpdb->get_results( "SELECT ID, guid FROM {$wpdb->posts} WHERE post_parent = '0' AND post_type = 'attachment'" );
  4786. if ( is_array( $attachments ) ) {
  4787. foreach ( $attachments as $file ) {
  4788. if ( ! empty( $file->guid ) && strpos( $post_content, $file->guid ) !== false ) {
  4789. $wpdb->update( $wpdb->posts, array( 'post_parent' => $post_ID ), array( 'ID' => $file->ID ) );
  4790. }
  4791. }
  4792. }
  4793. }
  4794. /**
  4795. * Edit a post.
  4796. *
  4797. * @since 1.5.0
  4798. *
  4799. * @param array $args {
  4800. * Method arguments. Note: arguments must be ordered as documented.
  4801. *
  4802. * @type int $blog_id (unused)
  4803. * @type string $username
  4804. * @type string $password
  4805. * @type array $content_struct
  4806. * @type int $publish
  4807. * }
  4808. * @return bool|IXR_Error True on success.
  4809. */
  4810. public function mw_editPost( $args ) {
  4811. $this->escape( $args );
  4812. $post_ID = (int) $args[0];
  4813. $username = $args[1];
  4814. $password = $args[2];
  4815. $content_struct = $args[3];
  4816. $publish = isset( $args[4] ) ? $args[4] : 0;
  4817. $user = $this->login( $username, $password );
  4818. if ( ! $user ) {
  4819. return $this->error;
  4820. }
  4821. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4822. do_action( 'xmlrpc_call', 'metaWeblog.editPost' );
  4823. $postdata = get_post( $post_ID, ARRAY_A );
  4824. /*
  4825. * If there is no post data for the give post id, stop now and return an error.
  4826. * Otherwise a new post will be created (which was the old behavior).
  4827. */
  4828. if ( ! $postdata || empty( $postdata['ID'] ) ) {
  4829. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  4830. }
  4831. if ( ! current_user_can( 'edit_post', $post_ID ) ) {
  4832. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  4833. }
  4834. // Use wp.editPost to edit post types other than post and page.
  4835. if ( ! in_array( $postdata['post_type'], array( 'post', 'page' ) ) ) {
  4836. return new IXR_Error( 401, __( 'Invalid post type.' ) );
  4837. }
  4838. // Thwart attempt to change the post type.
  4839. if ( ! empty( $content_struct['post_type'] ) && ( $content_struct['post_type'] != $postdata['post_type'] ) ) {
  4840. return new IXR_Error( 401, __( 'The post type may not be changed.' ) );
  4841. }
  4842. // Check for a valid post format if one was given
  4843. if ( isset( $content_struct['wp_post_format'] ) ) {
  4844. $content_struct['wp_post_format'] = sanitize_key( $content_struct['wp_post_format'] );
  4845. if ( ! array_key_exists( $content_struct['wp_post_format'], get_post_format_strings() ) ) {
  4846. return new IXR_Error( 404, __( 'Invalid post format.' ) );
  4847. }
  4848. }
  4849. $this->escape( $postdata );
  4850. $ID = $postdata['ID'];
  4851. $post_content = $postdata['post_content'];
  4852. $post_title = $postdata['post_title'];
  4853. $post_excerpt = $postdata['post_excerpt'];
  4854. $post_password = $postdata['post_password'];
  4855. $post_parent = $postdata['post_parent'];
  4856. $post_type = $postdata['post_type'];
  4857. $menu_order = $postdata['menu_order'];
  4858. $ping_status = $postdata['ping_status'];
  4859. $comment_status = $postdata['comment_status'];
  4860. // Let WordPress manage slug if none was provided.
  4861. $post_name = $postdata['post_name'];
  4862. if ( isset( $content_struct['wp_slug'] ) ) {
  4863. $post_name = $content_struct['wp_slug'];
  4864. }
  4865. // Only use a password if one was given.
  4866. if ( isset( $content_struct['wp_password'] ) ) {
  4867. $post_password = $content_struct['wp_password'];
  4868. }
  4869. // Only set a post parent if one was given.
  4870. if ( isset( $content_struct['wp_page_parent_id'] ) ) {
  4871. $post_parent = $content_struct['wp_page_parent_id'];
  4872. }
  4873. // Only set the menu_order if it was given.
  4874. if ( isset( $content_struct['wp_page_order'] ) ) {
  4875. $menu_order = $content_struct['wp_page_order'];
  4876. }
  4877. $page_template = null;
  4878. if ( ! empty( $content_struct['wp_page_template'] ) && 'page' == $post_type ) {
  4879. $page_template = $content_struct['wp_page_template'];
  4880. }
  4881. $post_author = $postdata['post_author'];
  4882. // Only set the post_author if one is set.
  4883. if ( isset( $content_struct['wp_author_id'] ) ) {
  4884. // Check permissions if attempting to switch author to or from another user.
  4885. if ( $user->ID != $content_struct['wp_author_id'] || $user->ID != $post_author ) {
  4886. switch ( $post_type ) {
  4887. case 'post':
  4888. if ( ! current_user_can( 'edit_others_posts' ) ) {
  4889. return new IXR_Error( 401, __( 'Sorry, you are not allowed to change the post author as this user.' ) );
  4890. }
  4891. break;
  4892. case 'page':
  4893. if ( ! current_user_can( 'edit_others_pages' ) ) {
  4894. return new IXR_Error( 401, __( 'Sorry, you are not allowed to change the page author as this user.' ) );
  4895. }
  4896. break;
  4897. default:
  4898. return new IXR_Error( 401, __( 'Invalid post type.' ) );
  4899. }
  4900. $post_author = $content_struct['wp_author_id'];
  4901. }
  4902. }
  4903. if ( isset( $content_struct['mt_allow_comments'] ) ) {
  4904. if ( ! is_numeric( $content_struct['mt_allow_comments'] ) ) {
  4905. switch ( $content_struct['mt_allow_comments'] ) {
  4906. case 'closed':
  4907. $comment_status = 'closed';
  4908. break;
  4909. case 'open':
  4910. $comment_status = 'open';
  4911. break;
  4912. default:
  4913. $comment_status = get_default_comment_status( $post_type );
  4914. break;
  4915. }
  4916. } else {
  4917. switch ( (int) $content_struct['mt_allow_comments'] ) {
  4918. case 0:
  4919. case 2:
  4920. $comment_status = 'closed';
  4921. break;
  4922. case 1:
  4923. $comment_status = 'open';
  4924. break;
  4925. default:
  4926. $comment_status = get_default_comment_status( $post_type );
  4927. break;
  4928. }
  4929. }
  4930. }
  4931. if ( isset( $content_struct['mt_allow_pings'] ) ) {
  4932. if ( ! is_numeric( $content_struct['mt_allow_pings'] ) ) {
  4933. switch ( $content_struct['mt_allow_pings'] ) {
  4934. case 'closed':
  4935. $ping_status = 'closed';
  4936. break;
  4937. case 'open':
  4938. $ping_status = 'open';
  4939. break;
  4940. default:
  4941. $ping_status = get_default_comment_status( $post_type, 'pingback' );
  4942. break;
  4943. }
  4944. } else {
  4945. switch ( (int) $content_struct['mt_allow_pings'] ) {
  4946. case 0:
  4947. $ping_status = 'closed';
  4948. break;
  4949. case 1:
  4950. $ping_status = 'open';
  4951. break;
  4952. default:
  4953. $ping_status = get_default_comment_status( $post_type, 'pingback' );
  4954. break;
  4955. }
  4956. }
  4957. }
  4958. if ( isset( $content_struct['title'] ) ) {
  4959. $post_title = $content_struct['title'];
  4960. }
  4961. if ( isset( $content_struct['description'] ) ) {
  4962. $post_content = $content_struct['description'];
  4963. }
  4964. $post_category = array();
  4965. if ( isset( $content_struct['categories'] ) ) {
  4966. $catnames = $content_struct['categories'];
  4967. if ( is_array( $catnames ) ) {
  4968. foreach ( $catnames as $cat ) {
  4969. $post_category[] = get_cat_ID( $cat );
  4970. }
  4971. }
  4972. }
  4973. if ( isset( $content_struct['mt_excerpt'] ) ) {
  4974. $post_excerpt = $content_struct['mt_excerpt'];
  4975. }
  4976. $post_more = isset( $content_struct['mt_text_more'] ) ? $content_struct['mt_text_more'] : null;
  4977. $post_status = $publish ? 'publish' : 'draft';
  4978. if ( isset( $content_struct[ "{$post_type}_status" ] ) ) {
  4979. switch ( $content_struct[ "{$post_type}_status" ] ) {
  4980. case 'draft':
  4981. case 'pending':
  4982. case 'private':
  4983. case 'publish':
  4984. $post_status = $content_struct[ "{$post_type}_status" ];
  4985. break;
  4986. default:
  4987. $post_status = $publish ? 'publish' : 'draft';
  4988. break;
  4989. }
  4990. }
  4991. $tags_input = isset( $content_struct['mt_keywords'] ) ? $content_struct['mt_keywords'] : null;
  4992. if ( 'publish' == $post_status || 'private' == $post_status ) {
  4993. if ( 'page' == $post_type && ! current_user_can( 'publish_pages' ) ) {
  4994. return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish this page.' ) );
  4995. } elseif ( ! current_user_can( 'publish_posts' ) ) {
  4996. return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish this post.' ) );
  4997. }
  4998. }
  4999. if ( $post_more ) {
  5000. $post_content = $post_content . '<!--more-->' . $post_more;
  5001. }
  5002. $to_ping = null;
  5003. if ( isset( $content_struct['mt_tb_ping_urls'] ) ) {
  5004. $to_ping = $content_struct['mt_tb_ping_urls'];
  5005. if ( is_array( $to_ping ) ) {
  5006. $to_ping = implode( ' ', $to_ping );
  5007. }
  5008. }
  5009. // Do some timestamp voodoo.
  5010. if ( ! empty( $content_struct['date_created_gmt'] ) ) {
  5011. // We know this is supposed to be GMT, so we're going to slap that Z on there by force.
  5012. $dateCreated = rtrim( $content_struct['date_created_gmt']->getIso(), 'Z' ) . 'Z';
  5013. } elseif ( ! empty( $content_struct['dateCreated'] ) ) {
  5014. $dateCreated = $content_struct['dateCreated']->getIso();
  5015. }
  5016. // Default to not flagging the post date to be edited unless it's intentional.
  5017. $edit_date = false;
  5018. if ( ! empty( $dateCreated ) ) {
  5019. $post_date = get_date_from_gmt( iso8601_to_datetime( $dateCreated ) );
  5020. $post_date_gmt = iso8601_to_datetime( $dateCreated, 'GMT' );
  5021. // Flag the post date to be edited.
  5022. $edit_date = true;
  5023. } else {
  5024. $post_date = $postdata['post_date'];
  5025. $post_date_gmt = $postdata['post_date_gmt'];
  5026. }
  5027. // We've got all the data -- post it.
  5028. $newpost = compact( 'ID', 'post_content', 'post_title', 'post_category', 'post_status', 'post_excerpt', 'comment_status', 'ping_status', 'edit_date', 'post_date', 'post_date_gmt', 'to_ping', 'post_name', 'post_password', 'post_parent', 'menu_order', 'post_author', 'tags_input', 'page_template' );
  5029. $result = wp_update_post( $newpost, true );
  5030. if ( is_wp_error( $result ) ) {
  5031. return new IXR_Error( 500, $result->get_error_message() );
  5032. }
  5033. if ( ! $result ) {
  5034. return new IXR_Error( 500, __( 'Sorry, your entry could not be edited.' ) );
  5035. }
  5036. // Only posts can be sticky
  5037. if ( $post_type == 'post' && isset( $content_struct['sticky'] ) ) {
  5038. $data = $newpost;
  5039. $data['sticky'] = $content_struct['sticky'];
  5040. $data['post_type'] = 'post';
  5041. $error = $this->_toggle_sticky( $data, true );
  5042. if ( $error ) {
  5043. return $error;
  5044. }
  5045. }
  5046. if ( isset( $content_struct['custom_fields'] ) ) {
  5047. $this->set_custom_fields( $post_ID, $content_struct['custom_fields'] );
  5048. }
  5049. if ( isset( $content_struct['wp_post_thumbnail'] ) ) {
  5050. // Empty value deletes, non-empty value adds/updates.
  5051. if ( empty( $content_struct['wp_post_thumbnail'] ) ) {
  5052. delete_post_thumbnail( $post_ID );
  5053. } else {
  5054. if ( set_post_thumbnail( $post_ID, $content_struct['wp_post_thumbnail'] ) === false ) {
  5055. return new IXR_Error( 404, __( 'Invalid attachment ID.' ) );
  5056. }
  5057. }
  5058. unset( $content_struct['wp_post_thumbnail'] );
  5059. }
  5060. // Handle enclosures.
  5061. $thisEnclosure = isset( $content_struct['enclosure'] ) ? $content_struct['enclosure'] : null;
  5062. $this->add_enclosure_if_new( $post_ID, $thisEnclosure );
  5063. $this->attach_uploads( $ID, $post_content );
  5064. // Handle post formats if assigned, validation is handled earlier in this function.
  5065. if ( isset( $content_struct['wp_post_format'] ) ) {
  5066. set_post_format( $post_ID, $content_struct['wp_post_format'] );
  5067. }
  5068. /**
  5069. * Fires after a post has been successfully updated via the XML-RPC MovableType API.
  5070. *
  5071. * @since 3.4.0
  5072. *
  5073. * @param int $post_ID ID of the updated post.
  5074. * @param array $args An array of arguments to update the post.
  5075. */
  5076. do_action( 'xmlrpc_call_success_mw_editPost', $post_ID, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  5077. return true;
  5078. }
  5079. /**
  5080. * Retrieve post.
  5081. *
  5082. * @since 1.5.0
  5083. *
  5084. * @param array $args {
  5085. * Method arguments. Note: arguments must be ordered as documented.
  5086. *
  5087. * @type int $blog_id (unused)
  5088. * @type int $post_ID
  5089. * @type string $username
  5090. * @type string $password
  5091. * }
  5092. * @return array|IXR_Error
  5093. */
  5094. public function mw_getPost( $args ) {
  5095. $this->escape( $args );
  5096. $post_ID = (int) $args[0];
  5097. $username = $args[1];
  5098. $password = $args[2];
  5099. $user = $this->login( $username, $password );
  5100. if ( ! $user ) {
  5101. return $this->error;
  5102. }
  5103. $postdata = get_post( $post_ID, ARRAY_A );
  5104. if ( ! $postdata ) {
  5105. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  5106. }
  5107. if ( ! current_user_can( 'edit_post', $post_ID ) ) {
  5108. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  5109. }
  5110. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5111. do_action( 'xmlrpc_call', 'metaWeblog.getPost' );
  5112. if ( $postdata['post_date'] != '' ) {
  5113. $post_date = $this->_convert_date( $postdata['post_date'] );
  5114. $post_date_gmt = $this->_convert_date_gmt( $postdata['post_date_gmt'], $postdata['post_date'] );
  5115. $post_modified = $this->_convert_date( $postdata['post_modified'] );
  5116. $post_modified_gmt = $this->_convert_date_gmt( $postdata['post_modified_gmt'], $postdata['post_modified'] );
  5117. $categories = array();
  5118. $catids = wp_get_post_categories( $post_ID );
  5119. foreach ( $catids as $catid ) {
  5120. $categories[] = get_cat_name( $catid );
  5121. }
  5122. $tagnames = array();
  5123. $tags = wp_get_post_tags( $post_ID );
  5124. if ( ! empty( $tags ) ) {
  5125. foreach ( $tags as $tag ) {
  5126. $tagnames[] = $tag->name;
  5127. }
  5128. $tagnames = implode( ', ', $tagnames );
  5129. } else {
  5130. $tagnames = '';
  5131. }
  5132. $post = get_extended( $postdata['post_content'] );
  5133. $link = get_permalink( $postdata['ID'] );
  5134. // Get the author info.
  5135. $author = get_userdata( $postdata['post_author'] );
  5136. $allow_comments = ( 'open' == $postdata['comment_status'] ) ? 1 : 0;
  5137. $allow_pings = ( 'open' == $postdata['ping_status'] ) ? 1 : 0;
  5138. // Consider future posts as published
  5139. if ( $postdata['post_status'] === 'future' ) {
  5140. $postdata['post_status'] = 'publish';
  5141. }
  5142. // Get post format
  5143. $post_format = get_post_format( $post_ID );
  5144. if ( empty( $post_format ) ) {
  5145. $post_format = 'standard';
  5146. }
  5147. $sticky = false;
  5148. if ( is_sticky( $post_ID ) ) {
  5149. $sticky = true;
  5150. }
  5151. $enclosure = array();
  5152. foreach ( (array) get_post_custom( $post_ID ) as $key => $val ) {
  5153. if ( $key == 'enclosure' ) {
  5154. foreach ( (array) $val as $enc ) {
  5155. $encdata = explode( "\n", $enc );
  5156. $enclosure['url'] = trim( htmlspecialchars( $encdata[0] ) );
  5157. $enclosure['length'] = (int) trim( $encdata[1] );
  5158. $enclosure['type'] = trim( $encdata[2] );
  5159. break 2;
  5160. }
  5161. }
  5162. }
  5163. $resp = array(
  5164. 'dateCreated' => $post_date,
  5165. 'userid' => $postdata['post_author'],
  5166. 'postid' => $postdata['ID'],
  5167. 'description' => $post['main'],
  5168. 'title' => $postdata['post_title'],
  5169. 'link' => $link,
  5170. 'permaLink' => $link,
  5171. // commented out because no other tool seems to use this
  5172. // 'content' => $entry['post_content'],
  5173. 'categories' => $categories,
  5174. 'mt_excerpt' => $postdata['post_excerpt'],
  5175. 'mt_text_more' => $post['extended'],
  5176. 'wp_more_text' => $post['more_text'],
  5177. 'mt_allow_comments' => $allow_comments,
  5178. 'mt_allow_pings' => $allow_pings,
  5179. 'mt_keywords' => $tagnames,
  5180. 'wp_slug' => $postdata['post_name'],
  5181. 'wp_password' => $postdata['post_password'],
  5182. 'wp_author_id' => (string) $author->ID,
  5183. 'wp_author_display_name' => $author->display_name,
  5184. 'date_created_gmt' => $post_date_gmt,
  5185. 'post_status' => $postdata['post_status'],
  5186. 'custom_fields' => $this->get_custom_fields( $post_ID ),
  5187. 'wp_post_format' => $post_format,
  5188. 'sticky' => $sticky,
  5189. 'date_modified' => $post_modified,
  5190. 'date_modified_gmt' => $post_modified_gmt,
  5191. );
  5192. if ( ! empty( $enclosure ) ) {
  5193. $resp['enclosure'] = $enclosure;
  5194. }
  5195. $resp['wp_post_thumbnail'] = get_post_thumbnail_id( $postdata['ID'] );
  5196. return $resp;
  5197. } else {
  5198. return new IXR_Error( 404, __( 'Sorry, no such post.' ) );
  5199. }
  5200. }
  5201. /**
  5202. * Retrieve list of recent posts.
  5203. *
  5204. * @since 1.5.0
  5205. *
  5206. * @param array $args {
  5207. * Method arguments. Note: arguments must be ordered as documented.
  5208. *
  5209. * @type int $blog_id (unused)
  5210. * @type string $username
  5211. * @type string $password
  5212. * @type int $numberposts
  5213. * }
  5214. * @return array|IXR_Error
  5215. */
  5216. public function mw_getRecentPosts( $args ) {
  5217. $this->escape( $args );
  5218. $username = $args[1];
  5219. $password = $args[2];
  5220. if ( isset( $args[3] ) ) {
  5221. $query = array( 'numberposts' => absint( $args[3] ) );
  5222. } else {
  5223. $query = array();
  5224. }
  5225. $user = $this->login( $username, $password );
  5226. if ( ! $user ) {
  5227. return $this->error;
  5228. }
  5229. if ( ! current_user_can( 'edit_posts' ) ) {
  5230. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts.' ) );
  5231. }
  5232. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5233. do_action( 'xmlrpc_call', 'metaWeblog.getRecentPosts' );
  5234. $posts_list = wp_get_recent_posts( $query );
  5235. if ( ! $posts_list ) {
  5236. return array();
  5237. }
  5238. $recent_posts = array();
  5239. foreach ( $posts_list as $entry ) {
  5240. if ( ! current_user_can( 'edit_post', $entry['ID'] ) ) {
  5241. continue;
  5242. }
  5243. $post_date = $this->_convert_date( $entry['post_date'] );
  5244. $post_date_gmt = $this->_convert_date_gmt( $entry['post_date_gmt'], $entry['post_date'] );
  5245. $post_modified = $this->_convert_date( $entry['post_modified'] );
  5246. $post_modified_gmt = $this->_convert_date_gmt( $entry['post_modified_gmt'], $entry['post_modified'] );
  5247. $categories = array();
  5248. $catids = wp_get_post_categories( $entry['ID'] );
  5249. foreach ( $catids as $catid ) {
  5250. $categories[] = get_cat_name( $catid );
  5251. }
  5252. $tagnames = array();
  5253. $tags = wp_get_post_tags( $entry['ID'] );
  5254. if ( ! empty( $tags ) ) {
  5255. foreach ( $tags as $tag ) {
  5256. $tagnames[] = $tag->name;
  5257. }
  5258. $tagnames = implode( ', ', $tagnames );
  5259. } else {
  5260. $tagnames = '';
  5261. }
  5262. $post = get_extended( $entry['post_content'] );
  5263. $link = get_permalink( $entry['ID'] );
  5264. // Get the post author info.
  5265. $author = get_userdata( $entry['post_author'] );
  5266. $allow_comments = ( 'open' == $entry['comment_status'] ) ? 1 : 0;
  5267. $allow_pings = ( 'open' == $entry['ping_status'] ) ? 1 : 0;
  5268. // Consider future posts as published
  5269. if ( $entry['post_status'] === 'future' ) {
  5270. $entry['post_status'] = 'publish';
  5271. }
  5272. // Get post format
  5273. $post_format = get_post_format( $entry['ID'] );
  5274. if ( empty( $post_format ) ) {
  5275. $post_format = 'standard';
  5276. }
  5277. $recent_posts[] = array(
  5278. 'dateCreated' => $post_date,
  5279. 'userid' => $entry['post_author'],
  5280. 'postid' => (string) $entry['ID'],
  5281. 'description' => $post['main'],
  5282. 'title' => $entry['post_title'],
  5283. 'link' => $link,
  5284. 'permaLink' => $link,
  5285. // commented out because no other tool seems to use this
  5286. // 'content' => $entry['post_content'],
  5287. 'categories' => $categories,
  5288. 'mt_excerpt' => $entry['post_excerpt'],
  5289. 'mt_text_more' => $post['extended'],
  5290. 'wp_more_text' => $post['more_text'],
  5291. 'mt_allow_comments' => $allow_comments,
  5292. 'mt_allow_pings' => $allow_pings,
  5293. 'mt_keywords' => $tagnames,
  5294. 'wp_slug' => $entry['post_name'],
  5295. 'wp_password' => $entry['post_password'],
  5296. 'wp_author_id' => (string) $author->ID,
  5297. 'wp_author_display_name' => $author->display_name,
  5298. 'date_created_gmt' => $post_date_gmt,
  5299. 'post_status' => $entry['post_status'],
  5300. 'custom_fields' => $this->get_custom_fields( $entry['ID'] ),
  5301. 'wp_post_format' => $post_format,
  5302. 'date_modified' => $post_modified,
  5303. 'date_modified_gmt' => $post_modified_gmt,
  5304. 'sticky' => ( $entry['post_type'] === 'post' && is_sticky( $entry['ID'] ) ),
  5305. 'wp_post_thumbnail' => get_post_thumbnail_id( $entry['ID'] ),
  5306. );
  5307. }
  5308. return $recent_posts;
  5309. }
  5310. /**
  5311. * Retrieve the list of categories on a given blog.
  5312. *
  5313. * @since 1.5.0
  5314. *
  5315. * @param array $args {
  5316. * Method arguments. Note: arguments must be ordered as documented.
  5317. *
  5318. * @type int $blog_id (unused)
  5319. * @type string $username
  5320. * @type string $password
  5321. * }
  5322. * @return array|IXR_Error
  5323. */
  5324. public function mw_getCategories( $args ) {
  5325. $this->escape( $args );
  5326. $username = $args[1];
  5327. $password = $args[2];
  5328. $user = $this->login( $username, $password );
  5329. if ( ! $user ) {
  5330. return $this->error;
  5331. }
  5332. if ( ! current_user_can( 'edit_posts' ) ) {
  5333. return new IXR_Error( 401, __( 'Sorry, you must be able to edit posts on this site in order to view categories.' ) );
  5334. }
  5335. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5336. do_action( 'xmlrpc_call', 'metaWeblog.getCategories' );
  5337. $categories_struct = array();
  5338. $cats = get_categories( array( 'get' => 'all' ) );
  5339. if ( $cats ) {
  5340. foreach ( $cats as $cat ) {
  5341. $struct = array();
  5342. $struct['categoryId'] = $cat->term_id;
  5343. $struct['parentId'] = $cat->parent;
  5344. $struct['description'] = $cat->name;
  5345. $struct['categoryDescription'] = $cat->description;
  5346. $struct['categoryName'] = $cat->name;
  5347. $struct['htmlUrl'] = esc_html( get_category_link( $cat->term_id ) );
  5348. $struct['rssUrl'] = esc_html( get_category_feed_link( $cat->term_id, 'rss2' ) );
  5349. $categories_struct[] = $struct;
  5350. }
  5351. }
  5352. return $categories_struct;
  5353. }
  5354. /**
  5355. * Uploads a file, following your settings.
  5356. *
  5357. * Adapted from a patch by Johann Richard.
  5358. *
  5359. * @link http://mycvs.org/archives/2004/06/30/file-upload-to-wordpress-in-ecto/
  5360. *
  5361. * @since 1.5.0
  5362. *
  5363. * @global wpdb $wpdb WordPress database abstraction object.
  5364. *
  5365. * @param array $args {
  5366. * Method arguments. Note: arguments must be ordered as documented.
  5367. *
  5368. * @type int $blog_id (unused)
  5369. * @type string $username
  5370. * @type string $password
  5371. * @type array $data
  5372. * }
  5373. * @return array|IXR_Error
  5374. */
  5375. public function mw_newMediaObject( $args ) {
  5376. global $wpdb;
  5377. $username = $this->escape( $args[1] );
  5378. $password = $this->escape( $args[2] );
  5379. $data = $args[3];
  5380. $name = sanitize_file_name( $data['name'] );
  5381. $type = $data['type'];
  5382. $bits = $data['bits'];
  5383. $user = $this->login( $username, $password );
  5384. if ( ! $user ) {
  5385. return $this->error;
  5386. }
  5387. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5388. do_action( 'xmlrpc_call', 'metaWeblog.newMediaObject' );
  5389. if ( ! current_user_can( 'upload_files' ) ) {
  5390. $this->error = new IXR_Error( 401, __( 'Sorry, you are not allowed to upload files.' ) );
  5391. return $this->error;
  5392. }
  5393. if ( is_multisite() && upload_is_user_over_quota( false ) ) {
  5394. $this->error = new IXR_Error(
  5395. 401,
  5396. sprintf(
  5397. /* translators: %s: Allowed space allocation. */
  5398. __( 'Sorry, you have used your space allocation of %s. Please delete some files to upload more files.' ),
  5399. size_format( get_space_allowed() * MB_IN_BYTES )
  5400. )
  5401. );
  5402. return $this->error;
  5403. }
  5404. /**
  5405. * Filters whether to preempt the XML-RPC media upload.
  5406. *
  5407. * Passing a truthy value will effectively short-circuit the media upload,
  5408. * returning that value as a 500 error instead.
  5409. *
  5410. * @since 2.1.0
  5411. *
  5412. * @param bool $error Whether to pre-empt the media upload. Default false.
  5413. */
  5414. $upload_err = apply_filters( 'pre_upload_error', false );
  5415. if ( $upload_err ) {
  5416. return new IXR_Error( 500, $upload_err );
  5417. }
  5418. $upload = wp_upload_bits( $name, null, $bits );
  5419. if ( ! empty( $upload['error'] ) ) {
  5420. /* translators: 1: File name, 2: Error message. */
  5421. $errorString = sprintf( __( 'Could not write file %1$s (%2$s).' ), $name, $upload['error'] );
  5422. return new IXR_Error( 500, $errorString );
  5423. }
  5424. // Construct the attachment array
  5425. $post_id = 0;
  5426. if ( ! empty( $data['post_id'] ) ) {
  5427. $post_id = (int) $data['post_id'];
  5428. if ( ! current_user_can( 'edit_post', $post_id ) ) {
  5429. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  5430. }
  5431. }
  5432. $attachment = array(
  5433. 'post_title' => $name,
  5434. 'post_content' => '',
  5435. 'post_type' => 'attachment',
  5436. 'post_parent' => $post_id,
  5437. 'post_mime_type' => $type,
  5438. 'guid' => $upload['url'],
  5439. );
  5440. // Save the data
  5441. $id = wp_insert_attachment( $attachment, $upload['file'], $post_id );
  5442. wp_update_attachment_metadata( $id, wp_generate_attachment_metadata( $id, $upload['file'] ) );
  5443. /**
  5444. * Fires after a new attachment has been added via the XML-RPC MovableType API.
  5445. *
  5446. * @since 3.4.0
  5447. *
  5448. * @param int $id ID of the new attachment.
  5449. * @param array $args An array of arguments to add the attachment.
  5450. */
  5451. do_action( 'xmlrpc_call_success_mw_newMediaObject', $id, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  5452. $struct = $this->_prepare_media_item( get_post( $id ) );
  5453. // Deprecated values
  5454. $struct['id'] = $struct['attachment_id'];
  5455. $struct['file'] = $struct['title'];
  5456. $struct['url'] = $struct['link'];
  5457. return $struct;
  5458. }
  5459. /* MovableType API functions
  5460. * specs on http://www.movabletype.org/docs/mtmanual_programmatic.html
  5461. */
  5462. /**
  5463. * Retrieve the post titles of recent posts.
  5464. *
  5465. * @since 1.5.0
  5466. *
  5467. * @param array $args {
  5468. * Method arguments. Note: arguments must be ordered as documented.
  5469. *
  5470. * @type int $blog_id (unused)
  5471. * @type string $username
  5472. * @type string $password
  5473. * @type int $numberposts
  5474. * }
  5475. * @return array|IXR_Error
  5476. */
  5477. public function mt_getRecentPostTitles( $args ) {
  5478. $this->escape( $args );
  5479. $username = $args[1];
  5480. $password = $args[2];
  5481. if ( isset( $args[3] ) ) {
  5482. $query = array( 'numberposts' => absint( $args[3] ) );
  5483. } else {
  5484. $query = array();
  5485. }
  5486. $user = $this->login( $username, $password );
  5487. if ( ! $user ) {
  5488. return $this->error;
  5489. }
  5490. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5491. do_action( 'xmlrpc_call', 'mt.getRecentPostTitles' );
  5492. $posts_list = wp_get_recent_posts( $query );
  5493. if ( ! $posts_list ) {
  5494. $this->error = new IXR_Error( 500, __( 'Either there are no posts, or something went wrong.' ) );
  5495. return $this->error;
  5496. }
  5497. $recent_posts = array();
  5498. foreach ( $posts_list as $entry ) {
  5499. if ( ! current_user_can( 'edit_post', $entry['ID'] ) ) {
  5500. continue;
  5501. }
  5502. $post_date = $this->_convert_date( $entry['post_date'] );
  5503. $post_date_gmt = $this->_convert_date_gmt( $entry['post_date_gmt'], $entry['post_date'] );
  5504. $recent_posts[] = array(
  5505. 'dateCreated' => $post_date,
  5506. 'userid' => $entry['post_author'],
  5507. 'postid' => (string) $entry['ID'],
  5508. 'title' => $entry['post_title'],
  5509. 'post_status' => $entry['post_status'],
  5510. 'date_created_gmt' => $post_date_gmt,
  5511. );
  5512. }
  5513. return $recent_posts;
  5514. }
  5515. /**
  5516. * Retrieve list of all categories on blog.
  5517. *
  5518. * @since 1.5.0
  5519. *
  5520. * @param array $args {
  5521. * Method arguments. Note: arguments must be ordered as documented.
  5522. *
  5523. * @type int $blog_id (unused)
  5524. * @type string $username
  5525. * @type string $password
  5526. * }
  5527. * @return array|IXR_Error
  5528. */
  5529. public function mt_getCategoryList( $args ) {
  5530. $this->escape( $args );
  5531. $username = $args[1];
  5532. $password = $args[2];
  5533. $user = $this->login( $username, $password );
  5534. if ( ! $user ) {
  5535. return $this->error;
  5536. }
  5537. if ( ! current_user_can( 'edit_posts' ) ) {
  5538. return new IXR_Error( 401, __( 'Sorry, you must be able to edit posts on this site in order to view categories.' ) );
  5539. }
  5540. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5541. do_action( 'xmlrpc_call', 'mt.getCategoryList' );
  5542. $categories_struct = array();
  5543. $cats = get_categories(
  5544. array(
  5545. 'hide_empty' => 0,
  5546. 'hierarchical' => 0,
  5547. )
  5548. );
  5549. if ( $cats ) {
  5550. foreach ( $cats as $cat ) {
  5551. $struct = array();
  5552. $struct['categoryId'] = $cat->term_id;
  5553. $struct['categoryName'] = $cat->name;
  5554. $categories_struct[] = $struct;
  5555. }
  5556. }
  5557. return $categories_struct;
  5558. }
  5559. /**
  5560. * Retrieve post categories.
  5561. *
  5562. * @since 1.5.0
  5563. *
  5564. * @param array $args {
  5565. * Method arguments. Note: arguments must be ordered as documented.
  5566. *
  5567. * @type int $post_ID
  5568. * @type string $username
  5569. * @type string $password
  5570. * }
  5571. * @return array|IXR_Error
  5572. */
  5573. public function mt_getPostCategories( $args ) {
  5574. $this->escape( $args );
  5575. $post_ID = (int) $args[0];
  5576. $username = $args[1];
  5577. $password = $args[2];
  5578. $user = $this->login( $username, $password );
  5579. if ( ! $user ) {
  5580. return $this->error;
  5581. }
  5582. if ( ! get_post( $post_ID ) ) {
  5583. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  5584. }
  5585. if ( ! current_user_can( 'edit_post', $post_ID ) ) {
  5586. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  5587. }
  5588. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5589. do_action( 'xmlrpc_call', 'mt.getPostCategories' );
  5590. $categories = array();
  5591. $catids = wp_get_post_categories( intval( $post_ID ) );
  5592. // first listed category will be the primary category
  5593. $isPrimary = true;
  5594. foreach ( $catids as $catid ) {
  5595. $categories[] = array(
  5596. 'categoryName' => get_cat_name( $catid ),
  5597. 'categoryId' => (string) $catid,
  5598. 'isPrimary' => $isPrimary,
  5599. );
  5600. $isPrimary = false;
  5601. }
  5602. return $categories;
  5603. }
  5604. /**
  5605. * Sets categories for a post.
  5606. *
  5607. * @since 1.5.0
  5608. *
  5609. * @param array $args {
  5610. * Method arguments. Note: arguments must be ordered as documented.
  5611. *
  5612. * @type int $post_ID
  5613. * @type string $username
  5614. * @type string $password
  5615. * @type array $categories
  5616. * }
  5617. * @return true|IXR_Error True on success.
  5618. */
  5619. public function mt_setPostCategories( $args ) {
  5620. $this->escape( $args );
  5621. $post_ID = (int) $args[0];
  5622. $username = $args[1];
  5623. $password = $args[2];
  5624. $categories = $args[3];
  5625. $user = $this->login( $username, $password );
  5626. if ( ! $user ) {
  5627. return $this->error;
  5628. }
  5629. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5630. do_action( 'xmlrpc_call', 'mt.setPostCategories' );
  5631. if ( ! get_post( $post_ID ) ) {
  5632. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  5633. }
  5634. if ( ! current_user_can( 'edit_post', $post_ID ) ) {
  5635. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  5636. }
  5637. $catids = array();
  5638. foreach ( $categories as $cat ) {
  5639. $catids[] = $cat['categoryId'];
  5640. }
  5641. wp_set_post_categories( $post_ID, $catids );
  5642. return true;
  5643. }
  5644. /**
  5645. * Retrieve an array of methods supported by this server.
  5646. *
  5647. * @since 1.5.0
  5648. *
  5649. * @return array
  5650. */
  5651. public function mt_supportedMethods() {
  5652. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5653. do_action( 'xmlrpc_call', 'mt.supportedMethods' );
  5654. return array_keys( $this->methods );
  5655. }
  5656. /**
  5657. * Retrieve an empty array because we don't support per-post text filters.
  5658. *
  5659. * @since 1.5.0
  5660. */
  5661. public function mt_supportedTextFilters() {
  5662. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5663. do_action( 'xmlrpc_call', 'mt.supportedTextFilters' );
  5664. /**
  5665. * Filters the MoveableType text filters list for XML-RPC.
  5666. *
  5667. * @since 2.2.0
  5668. *
  5669. * @param array $filters An array of text filters.
  5670. */
  5671. return apply_filters( 'xmlrpc_text_filters', array() );
  5672. }
  5673. /**
  5674. * Retrieve trackbacks sent to a given post.
  5675. *
  5676. * @since 1.5.0
  5677. *
  5678. * @global wpdb $wpdb WordPress database abstraction object.
  5679. *
  5680. * @param int $post_ID
  5681. * @return array|IXR_Error
  5682. */
  5683. public function mt_getTrackbackPings( $post_ID ) {
  5684. global $wpdb;
  5685. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5686. do_action( 'xmlrpc_call', 'mt.getTrackbackPings' );
  5687. $actual_post = get_post( $post_ID, ARRAY_A );
  5688. if ( ! $actual_post ) {
  5689. return new IXR_Error( 404, __( 'Sorry, no such post.' ) );
  5690. }
  5691. $comments = $wpdb->get_results( $wpdb->prepare( "SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID ) );
  5692. if ( ! $comments ) {
  5693. return array();
  5694. }
  5695. $trackback_pings = array();
  5696. foreach ( $comments as $comment ) {
  5697. if ( 'trackback' == $comment->comment_type ) {
  5698. $content = $comment->comment_content;
  5699. $title = substr( $content, 8, ( strpos( $content, '</strong>' ) - 8 ) );
  5700. $trackback_pings[] = array(
  5701. 'pingTitle' => $title,
  5702. 'pingURL' => $comment->comment_author_url,
  5703. 'pingIP' => $comment->comment_author_IP,
  5704. );
  5705. }
  5706. }
  5707. return $trackback_pings;
  5708. }
  5709. /**
  5710. * Sets a post's publish status to 'publish'.
  5711. *
  5712. * @since 1.5.0
  5713. *
  5714. * @param array $args {
  5715. * Method arguments. Note: arguments must be ordered as documented.
  5716. *
  5717. * @type int $post_ID
  5718. * @type string $username
  5719. * @type string $password
  5720. * }
  5721. * @return int|IXR_Error
  5722. */
  5723. public function mt_publishPost( $args ) {
  5724. $this->escape( $args );
  5725. $post_ID = (int) $args[0];
  5726. $username = $args[1];
  5727. $password = $args[2];
  5728. $user = $this->login( $username, $password );
  5729. if ( ! $user ) {
  5730. return $this->error;
  5731. }
  5732. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5733. do_action( 'xmlrpc_call', 'mt.publishPost' );
  5734. $postdata = get_post( $post_ID, ARRAY_A );
  5735. if ( ! $postdata ) {
  5736. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  5737. }
  5738. if ( ! current_user_can( 'publish_posts' ) || ! current_user_can( 'edit_post', $post_ID ) ) {
  5739. return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish this post.' ) );
  5740. }
  5741. $postdata['post_status'] = 'publish';
  5742. // retain old cats
  5743. $cats = wp_get_post_categories( $post_ID );
  5744. $postdata['post_category'] = $cats;
  5745. $this->escape( $postdata );
  5746. return wp_update_post( $postdata );
  5747. }
  5748. /* PingBack functions
  5749. * specs on www.hixie.ch/specs/pingback/pingback
  5750. */
  5751. /**
  5752. * Retrieves a pingback and registers it.
  5753. *
  5754. * @since 1.5.0
  5755. *
  5756. * @param array $args {
  5757. * Method arguments. Note: arguments must be ordered as documented.
  5758. *
  5759. * @type string $pagelinkedfrom
  5760. * @type string $pagelinkedto
  5761. * }
  5762. * @return string|IXR_Error
  5763. */
  5764. public function pingback_ping( $args ) {
  5765. global $wpdb;
  5766. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5767. do_action( 'xmlrpc_call', 'pingback.ping' );
  5768. $this->escape( $args );
  5769. $pagelinkedfrom = str_replace( '&amp;', '&', $args[0] );
  5770. $pagelinkedto = str_replace( '&amp;', '&', $args[1] );
  5771. $pagelinkedto = str_replace( '&', '&amp;', $pagelinkedto );
  5772. /**
  5773. * Filters the pingback source URI.
  5774. *
  5775. * @since 3.6.0
  5776. *
  5777. * @param string $pagelinkedfrom URI of the page linked from.
  5778. * @param string $pagelinkedto URI of the page linked to.
  5779. */
  5780. $pagelinkedfrom = apply_filters( 'pingback_ping_source_uri', $pagelinkedfrom, $pagelinkedto );
  5781. if ( ! $pagelinkedfrom ) {
  5782. return $this->pingback_error( 0, __( 'A valid URL was not provided.' ) );
  5783. }
  5784. // Check if the page linked to is in our site
  5785. $pos1 = strpos( $pagelinkedto, str_replace( array( 'http://www.', 'http://', 'https://www.', 'https://' ), '', get_option( 'home' ) ) );
  5786. if ( ! $pos1 ) {
  5787. return $this->pingback_error( 0, __( 'Is there no link to us?' ) );
  5788. }
  5789. // let's find which post is linked to
  5790. // FIXME: does url_to_postid() cover all these cases already?
  5791. // if so, then let's use it and drop the old code.
  5792. $urltest = parse_url( $pagelinkedto );
  5793. $post_ID = url_to_postid( $pagelinkedto );
  5794. if ( $post_ID ) {
  5795. // $way
  5796. } elseif ( isset( $urltest['path'] ) && preg_match( '#p/[0-9]{1,}#', $urltest['path'], $match ) ) {
  5797. // the path defines the post_ID (archives/p/XXXX)
  5798. $blah = explode( '/', $match[0] );
  5799. $post_ID = (int) $blah[1];
  5800. } elseif ( isset( $urltest['query'] ) && preg_match( '#p=[0-9]{1,}#', $urltest['query'], $match ) ) {
  5801. // the querystring defines the post_ID (?p=XXXX)
  5802. $blah = explode( '=', $match[0] );
  5803. $post_ID = (int) $blah[1];
  5804. } elseif ( isset( $urltest['fragment'] ) ) {
  5805. // an #anchor is there, it's either...
  5806. if ( intval( $urltest['fragment'] ) ) {
  5807. // ...an integer #XXXX (simplest case)
  5808. $post_ID = (int) $urltest['fragment'];
  5809. } elseif ( preg_match( '/post-[0-9]+/', $urltest['fragment'] ) ) {
  5810. // ...a post id in the form 'post-###'
  5811. $post_ID = preg_replace( '/[^0-9]+/', '', $urltest['fragment'] );
  5812. } elseif ( is_string( $urltest['fragment'] ) ) {
  5813. // ...or a string #title, a little more complicated
  5814. $title = preg_replace( '/[^a-z0-9]/i', '.', $urltest['fragment'] );
  5815. $sql = $wpdb->prepare( "SELECT ID FROM $wpdb->posts WHERE post_title RLIKE %s", $title );
  5816. $post_ID = $wpdb->get_var( $sql );
  5817. if ( ! $post_ID ) {
  5818. // returning unknown error '0' is better than die()ing
  5819. return $this->pingback_error( 0, '' );
  5820. }
  5821. }
  5822. } else {
  5823. // TODO: Attempt to extract a post ID from the given URL
  5824. return $this->pingback_error( 33, __( 'The specified target URL cannot be used as a target. It either doesn&#8217;t exist, or it is not a pingback-enabled resource.' ) );
  5825. }
  5826. $post_ID = (int) $post_ID;
  5827. $post = get_post( $post_ID );
  5828. if ( ! $post ) { // Post_ID not found
  5829. return $this->pingback_error( 33, __( 'The specified target URL cannot be used as a target. It either doesn&#8217;t exist, or it is not a pingback-enabled resource.' ) );
  5830. }
  5831. if ( $post_ID == url_to_postid( $pagelinkedfrom ) ) {
  5832. return $this->pingback_error( 0, __( 'The source URL and the target URL cannot both point to the same resource.' ) );
  5833. }
  5834. // Check if pings are on
  5835. if ( ! pings_open( $post ) ) {
  5836. return $this->pingback_error( 33, __( 'The specified target URL cannot be used as a target. It either doesn&#8217;t exist, or it is not a pingback-enabled resource.' ) );
  5837. }
  5838. // Let's check that the remote site didn't already pingback this entry
  5839. if ( $wpdb->get_results( $wpdb->prepare( "SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_author_url = %s", $post_ID, $pagelinkedfrom ) ) ) {
  5840. return $this->pingback_error( 48, __( 'The pingback has already been registered.' ) );
  5841. }
  5842. // very stupid, but gives time to the 'from' server to publish !
  5843. sleep( 1 );
  5844. $remote_ip = preg_replace( '/[^0-9a-fA-F:., ]/', '', $_SERVER['REMOTE_ADDR'] );
  5845. /** This filter is documented in wp-includes/class-http.php */
  5846. $user_agent = apply_filters( 'http_headers_useragent', 'WordPress/' . get_bloginfo( 'version' ) . '; ' . get_bloginfo( 'url' ), $url );
  5847. // Let's check the remote site
  5848. $http_api_args = array(
  5849. 'timeout' => 10,
  5850. 'redirection' => 0,
  5851. 'limit_response_size' => 153600, // 150 KB
  5852. 'user-agent' => "$user_agent; verifying pingback from $remote_ip",
  5853. 'headers' => array(
  5854. 'X-Pingback-Forwarded-For' => $remote_ip,
  5855. ),
  5856. );
  5857. $request = wp_safe_remote_get( $pagelinkedfrom, $http_api_args );
  5858. $remote_source = wp_remote_retrieve_body( $request );
  5859. $remote_source_original = $remote_source;
  5860. if ( ! $remote_source ) {
  5861. return $this->pingback_error( 16, __( 'The source URL does not exist.' ) );
  5862. }
  5863. /**
  5864. * Filters the pingback remote source.
  5865. *
  5866. * @since 2.5.0
  5867. *
  5868. * @param string $remote_source Response source for the page linked from.
  5869. * @param string $pagelinkedto URL of the page linked to.
  5870. */
  5871. $remote_source = apply_filters( 'pre_remote_source', $remote_source, $pagelinkedto );
  5872. // Work around bug in strip_tags():
  5873. $remote_source = str_replace( '<!DOC', '<DOC', $remote_source );
  5874. $remote_source = preg_replace( '/[\r\n\t ]+/', ' ', $remote_source ); // normalize spaces
  5875. $remote_source = preg_replace( '/<\/*(h1|h2|h3|h4|h5|h6|p|th|td|li|dt|dd|pre|caption|input|textarea|button|body)[^>]*>/', "\n\n", $remote_source );
  5876. preg_match( '|<title>([^<]*?)</title>|is', $remote_source, $matchtitle );
  5877. $title = isset( $matchtitle[1] ) ? $matchtitle[1] : '';
  5878. if ( empty( $title ) ) {
  5879. return $this->pingback_error( 32, __( 'We cannot find a title on that page.' ) );
  5880. }
  5881. // Remove all script and style tags including their content.
  5882. $remote_source = preg_replace( '@<(script|style)[^>]*?>.*?</\\1>@si', '', $remote_source );
  5883. // Just keep the tag we need.
  5884. $remote_source = strip_tags( $remote_source, '<a>' );
  5885. $p = explode( "\n\n", $remote_source );
  5886. $preg_target = preg_quote( $pagelinkedto, '|' );
  5887. foreach ( $p as $para ) {
  5888. if ( strpos( $para, $pagelinkedto ) !== false ) { // it exists, but is it a link?
  5889. preg_match( '|<a[^>]+?' . $preg_target . '[^>]*>([^>]+?)</a>|', $para, $context );
  5890. // If the URL isn't in a link context, keep looking
  5891. if ( empty( $context ) ) {
  5892. continue;
  5893. }
  5894. // We're going to use this fake tag to mark the context in a bit
  5895. // the marker is needed in case the link text appears more than once in the paragraph
  5896. $excerpt = preg_replace( '|\</?wpcontext\>|', '', $para );
  5897. // prevent really long link text
  5898. if ( strlen( $context[1] ) > 100 ) {
  5899. $context[1] = substr( $context[1], 0, 100 ) . '&#8230;';
  5900. }
  5901. $marker = '<wpcontext>' . $context[1] . '</wpcontext>'; // set up our marker
  5902. $excerpt = str_replace( $context[0], $marker, $excerpt ); // swap out the link for our marker
  5903. $excerpt = strip_tags( $excerpt, '<wpcontext>' ); // strip all tags but our context marker
  5904. $excerpt = trim( $excerpt );
  5905. $preg_marker = preg_quote( $marker, '|' );
  5906. $excerpt = preg_replace( "|.*?\s(.{0,100}$preg_marker.{0,100})\s.*|s", '$1', $excerpt );
  5907. $excerpt = strip_tags( $excerpt ); // YES, again, to remove the marker wrapper
  5908. break;
  5909. }
  5910. }
  5911. if ( empty( $context ) ) { // Link to target not found
  5912. return $this->pingback_error( 17, __( 'The source URL does not contain a link to the target URL, and so cannot be used as a source.' ) );
  5913. }
  5914. $pagelinkedfrom = str_replace( '&', '&amp;', $pagelinkedfrom );
  5915. $context = '[&#8230;] ' . esc_html( $excerpt ) . ' [&#8230;]';
  5916. $pagelinkedfrom = $this->escape( $pagelinkedfrom );
  5917. $comment_post_ID = (int) $post_ID;
  5918. $comment_author = $title;
  5919. $comment_author_email = '';
  5920. $this->escape( $comment_author );
  5921. $comment_author_url = $pagelinkedfrom;
  5922. $comment_content = $context;
  5923. $this->escape( $comment_content );
  5924. $comment_type = 'pingback';
  5925. $commentdata = compact(
  5926. 'comment_post_ID',
  5927. 'comment_author',
  5928. 'comment_author_url',
  5929. 'comment_author_email',
  5930. 'comment_content',
  5931. 'comment_type',
  5932. 'remote_source',
  5933. 'remote_source_original'
  5934. );
  5935. $comment_ID = wp_new_comment( $commentdata );
  5936. if ( is_wp_error( $comment_ID ) ) {
  5937. return $this->pingback_error( 0, $comment_ID->get_error_message() );
  5938. }
  5939. /**
  5940. * Fires after a post pingback has been sent.
  5941. *
  5942. * @since 0.71
  5943. *
  5944. * @param int $comment_ID Comment ID.
  5945. */
  5946. do_action( 'pingback_post', $comment_ID );
  5947. /* translators: 1: URL of the page linked from, 2: URL of the page linked to. */
  5948. return sprintf( __( 'Pingback from %1$s to %2$s registered. Keep the web talking! :-)' ), $pagelinkedfrom, $pagelinkedto );
  5949. }
  5950. /**
  5951. * Retrieve array of URLs that pingbacked the given URL.
  5952. *
  5953. * Specs on http://www.aquarionics.com/misc/archives/blogite/0198.html
  5954. *
  5955. * @since 1.5.0
  5956. *
  5957. * @global wpdb $wpdb WordPress database abstraction object.
  5958. *
  5959. * @param string $url
  5960. * @return array|IXR_Error
  5961. */
  5962. public function pingback_extensions_getPingbacks( $url ) {
  5963. global $wpdb;
  5964. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5965. do_action( 'xmlrpc_call', 'pingback.extensions.getPingbacks' );
  5966. $url = $this->escape( $url );
  5967. $post_ID = url_to_postid( $url );
  5968. if ( ! $post_ID ) {
  5969. // We aren't sure that the resource is available and/or pingback enabled
  5970. return $this->pingback_error( 33, __( 'The specified target URL cannot be used as a target. It either doesn&#8217;t exist, or it is not a pingback-enabled resource.' ) );
  5971. }
  5972. $actual_post = get_post( $post_ID, ARRAY_A );
  5973. if ( ! $actual_post ) {
  5974. // No such post = resource not found
  5975. return $this->pingback_error( 32, __( 'The specified target URL does not exist.' ) );
  5976. }
  5977. $comments = $wpdb->get_results( $wpdb->prepare( "SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID ) );
  5978. if ( ! $comments ) {
  5979. return array();
  5980. }
  5981. $pingbacks = array();
  5982. foreach ( $comments as $comment ) {
  5983. if ( 'pingback' == $comment->comment_type ) {
  5984. $pingbacks[] = $comment->comment_author_url;
  5985. }
  5986. }
  5987. return $pingbacks;
  5988. }
  5989. /**
  5990. * Sends a pingback error based on the given error code and message.
  5991. *
  5992. * @since 3.6.0
  5993. *
  5994. * @param int $code Error code.
  5995. * @param string $message Error message.
  5996. * @return IXR_Error Error object.
  5997. */
  5998. protected function pingback_error( $code, $message ) {
  5999. /**
  6000. * Filters the XML-RPC pingback error return.
  6001. *
  6002. * @since 3.5.1
  6003. *
  6004. * @param IXR_Error $error An IXR_Error object containing the error code and message.
  6005. */
  6006. return apply_filters( 'xmlrpc_pingback_error', new IXR_Error( $code, $message ) );
  6007. }
  6008. }