class-wp-xmlrpc-server.php 208 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744374537463747374837493750375137523753375437553756375737583759376037613762376337643765376637673768376937703771377237733774377537763777377837793780378137823783378437853786378737883789379037913792379337943795379637973798379938003801380238033804380538063807380838093810381138123813381438153816381738183819382038213822382338243825382638273828382938303831383238333834383538363837383838393840384138423843384438453846384738483849385038513852385338543855385638573858385938603861386238633864386538663867386838693870387138723873387438753876387738783879388038813882388338843885388638873888388938903891389238933894389538963897389838993900390139023903390439053906390739083909391039113912391339143915391639173918391939203921392239233924392539263927392839293930393139323933393439353936393739383939394039413942394339443945394639473948394939503951395239533954395539563957395839593960396139623963396439653966396739683969397039713972397339743975397639773978397939803981398239833984398539863987398839893990399139923993399439953996399739983999400040014002400340044005400640074008400940104011401240134014401540164017401840194020402140224023402440254026402740284029403040314032403340344035403640374038403940404041404240434044404540464047404840494050405140524053405440554056405740584059406040614062406340644065406640674068406940704071407240734074407540764077407840794080408140824083408440854086408740884089409040914092409340944095409640974098409941004101410241034104410541064107410841094110411141124113411441154116411741184119412041214122412341244125412641274128412941304131413241334134413541364137413841394140414141424143414441454146414741484149415041514152415341544155415641574158415941604161416241634164416541664167416841694170417141724173417441754176417741784179418041814182418341844185418641874188418941904191419241934194419541964197419841994200420142024203420442054206420742084209421042114212421342144215421642174218421942204221422242234224422542264227422842294230423142324233423442354236423742384239424042414242424342444245424642474248424942504251425242534254425542564257425842594260426142624263426442654266426742684269427042714272427342744275427642774278427942804281428242834284428542864287428842894290429142924293429442954296429742984299430043014302430343044305430643074308430943104311431243134314431543164317431843194320432143224323432443254326432743284329433043314332433343344335433643374338433943404341434243434344434543464347434843494350435143524353435443554356435743584359436043614362436343644365436643674368436943704371437243734374437543764377437843794380438143824383438443854386438743884389439043914392439343944395439643974398439944004401440244034404440544064407440844094410441144124413441444154416441744184419442044214422442344244425442644274428442944304431443244334434443544364437443844394440444144424443444444454446444744484449445044514452445344544455445644574458445944604461446244634464446544664467446844694470447144724473447444754476447744784479448044814482448344844485448644874488448944904491449244934494449544964497449844994500450145024503450445054506450745084509451045114512451345144515451645174518451945204521452245234524452545264527452845294530453145324533453445354536453745384539454045414542454345444545454645474548454945504551455245534554455545564557455845594560456145624563456445654566456745684569457045714572457345744575457645774578457945804581458245834584458545864587458845894590459145924593459445954596459745984599460046014602460346044605460646074608460946104611461246134614461546164617461846194620462146224623462446254626462746284629463046314632463346344635463646374638463946404641464246434644464546464647464846494650465146524653465446554656465746584659466046614662466346644665466646674668466946704671467246734674467546764677467846794680468146824683468446854686468746884689469046914692469346944695469646974698469947004701470247034704470547064707470847094710471147124713471447154716471747184719472047214722472347244725472647274728472947304731473247334734473547364737473847394740474147424743474447454746474747484749475047514752475347544755475647574758475947604761476247634764476547664767476847694770477147724773477447754776477747784779478047814782478347844785478647874788478947904791479247934794479547964797479847994800480148024803480448054806480748084809481048114812481348144815481648174818481948204821482248234824482548264827482848294830483148324833483448354836483748384839484048414842484348444845484648474848484948504851485248534854485548564857485848594860486148624863486448654866486748684869487048714872487348744875487648774878487948804881488248834884488548864887488848894890489148924893489448954896489748984899490049014902490349044905490649074908490949104911491249134914491549164917491849194920492149224923492449254926492749284929493049314932493349344935493649374938493949404941494249434944494549464947494849494950495149524953495449554956495749584959496049614962496349644965496649674968496949704971497249734974497549764977497849794980498149824983498449854986498749884989499049914992499349944995499649974998499950005001500250035004500550065007500850095010501150125013501450155016501750185019502050215022502350245025502650275028502950305031503250335034503550365037503850395040504150425043504450455046504750485049505050515052505350545055505650575058505950605061506250635064506550665067506850695070507150725073507450755076507750785079508050815082508350845085508650875088508950905091509250935094509550965097509850995100510151025103510451055106510751085109511051115112511351145115511651175118511951205121512251235124512551265127512851295130513151325133513451355136513751385139514051415142514351445145514651475148514951505151515251535154515551565157515851595160516151625163516451655166516751685169517051715172517351745175517651775178517951805181518251835184518551865187518851895190519151925193519451955196519751985199520052015202520352045205520652075208520952105211521252135214521552165217521852195220522152225223522452255226522752285229523052315232523352345235523652375238523952405241524252435244524552465247524852495250525152525253525452555256525752585259526052615262526352645265526652675268526952705271527252735274527552765277527852795280528152825283528452855286528752885289529052915292529352945295529652975298529953005301530253035304530553065307530853095310531153125313531453155316531753185319532053215322532353245325532653275328532953305331533253335334533553365337533853395340534153425343534453455346534753485349535053515352535353545355535653575358535953605361536253635364536553665367536853695370537153725373537453755376537753785379538053815382538353845385538653875388538953905391539253935394539553965397539853995400540154025403540454055406540754085409541054115412541354145415541654175418541954205421542254235424542554265427542854295430543154325433543454355436543754385439544054415442544354445445544654475448544954505451545254535454545554565457545854595460546154625463546454655466546754685469547054715472547354745475547654775478547954805481548254835484548554865487548854895490549154925493549454955496549754985499550055015502550355045505550655075508550955105511551255135514551555165517551855195520552155225523552455255526552755285529553055315532553355345535553655375538553955405541554255435544554555465547554855495550555155525553555455555556555755585559556055615562556355645565556655675568556955705571557255735574557555765577557855795580558155825583558455855586558755885589559055915592559355945595559655975598559956005601560256035604560556065607560856095610561156125613561456155616561756185619562056215622562356245625562656275628562956305631563256335634563556365637563856395640564156425643564456455646564756485649565056515652565356545655565656575658565956605661566256635664566556665667566856695670567156725673567456755676567756785679568056815682568356845685568656875688568956905691569256935694569556965697569856995700570157025703570457055706570757085709571057115712571357145715571657175718571957205721572257235724572557265727572857295730573157325733573457355736573757385739574057415742574357445745574657475748574957505751575257535754575557565757575857595760576157625763576457655766576757685769577057715772577357745775577657775778577957805781578257835784578557865787578857895790579157925793579457955796579757985799580058015802580358045805580658075808580958105811581258135814581558165817581858195820582158225823582458255826582758285829583058315832583358345835583658375838583958405841584258435844584558465847584858495850585158525853585458555856585758585859586058615862586358645865586658675868586958705871587258735874587558765877587858795880588158825883588458855886588758885889589058915892589358945895589658975898589959005901590259035904590559065907590859095910591159125913591459155916591759185919592059215922592359245925592659275928592959305931593259335934593559365937593859395940594159425943594459455946594759485949595059515952595359545955595659575958595959605961596259635964596559665967596859695970597159725973597459755976597759785979598059815982598359845985598659875988598959905991599259935994599559965997599859996000600160026003600460056006600760086009601060116012601360146015601660176018601960206021602260236024602560266027602860296030603160326033603460356036603760386039604060416042604360446045604660476048604960506051605260536054605560566057605860596060606160626063606460656066606760686069607060716072607360746075607660776078607960806081608260836084608560866087608860896090609160926093609460956096609760986099610061016102610361046105610661076108610961106111611261136114611561166117611861196120612161226123612461256126612761286129613061316132613361346135613661376138613961406141614261436144614561466147614861496150615161526153615461556156615761586159616061616162616361646165616661676168616961706171617261736174617561766177617861796180618161826183618461856186618761886189619061916192619361946195619661976198619962006201620262036204620562066207620862096210621162126213621462156216621762186219622062216222622362246225622662276228622962306231623262336234623562366237623862396240624162426243624462456246624762486249625062516252625362546255625662576258625962606261626262636264626562666267626862696270627162726273627462756276627762786279628062816282628362846285628662876288628962906291629262936294629562966297629862996300630163026303630463056306630763086309631063116312631363146315631663176318631963206321632263236324632563266327632863296330633163326333633463356336633763386339634063416342634363446345634663476348634963506351635263536354635563566357635863596360636163626363636463656366636763686369637063716372637363746375637663776378637963806381638263836384638563866387638863896390639163926393639463956396639763986399640064016402640364046405640664076408640964106411641264136414641564166417641864196420642164226423642464256426642764286429643064316432643364346435643664376438643964406441644264436444644564466447644864496450645164526453645464556456645764586459646064616462646364646465646664676468646964706471647264736474647564766477647864796480648164826483648464856486648764886489649064916492649364946495649664976498649965006501650265036504650565066507650865096510651165126513651465156516651765186519652065216522652365246525652665276528652965306531653265336534653565366537653865396540654165426543654465456546654765486549655065516552655365546555655665576558655965606561656265636564656565666567656865696570657165726573657465756576657765786579658065816582658365846585658665876588658965906591659265936594659565966597659865996600660166026603660466056606660766086609661066116612661366146615661666176618661966206621662266236624662566266627662866296630663166326633663466356636663766386639664066416642664366446645664666476648664966506651665266536654665566566657665866596660666166626663666466656666666766686669667066716672667366746675667666776678667966806681668266836684668566866687668866896690669166926693669466956696669766986699670067016702670367046705670667076708670967106711671267136714671567166717671867196720672167226723672467256726672767286729673067316732673367346735673667376738673967406741674267436744674567466747674867496750675167526753675467556756675767586759676067616762676367646765676667676768676967706771677267736774677567766777677867796780678167826783678467856786678767886789679067916792679367946795679667976798679968006801680268036804680568066807680868096810681168126813681468156816681768186819682068216822682368246825682668276828682968306831683268336834683568366837683868396840684168426843684468456846684768486849685068516852685368546855685668576858685968606861686268636864686568666867686868696870687168726873687468756876687768786879688068816882688368846885688668876888688968906891689268936894689568966897689868996900690169026903690469056906690769086909691069116912691369146915691669176918691969206921692269236924692569266927692869296930693169326933693469356936693769386939694069416942694369446945694669476948694969506951695269536954695569566957695869596960696169626963696469656966696769686969697069716972697369746975697669776978697969806981698269836984698569866987698869896990699169926993699469956996699769986999700070017002700370047005700670077008700970107011701270137014701570167017701870197020702170227023702470257026702770287029703070317032703370347035703670377038703970407041704270437044704570467047704870497050705170527053705470557056705770587059706070617062706370647065706670677068706970707071707270737074707570767077707870797080708170827083708470857086708770887089709070917092709370947095709670977098709971007101710271037104710571067107710871097110711171127113711471157116711771187119712071217122712371247125712671277128
  1. <?php
  2. /**
  3. * XML-RPC protocol support for WordPress
  4. *
  5. * @package WordPress
  6. * @subpackage Publishing
  7. */
  8. /**
  9. * WordPress XMLRPC server implementation.
  10. *
  11. * Implements compatibility for Blogger API, MetaWeblog API, MovableType, and
  12. * pingback. Additional WordPress API for managing comments, pages, posts,
  13. * options, etc.
  14. *
  15. * As of WordPress 3.5.0, XML-RPC is enabled by default. It can be disabled
  16. * via the {@see 'xmlrpc_enabled'} filter found in wp_xmlrpc_server::set_is_enabled().
  17. *
  18. * @since 1.5.0
  19. *
  20. * @see IXR_Server
  21. */
  22. #[AllowDynamicProperties]
  23. class wp_xmlrpc_server extends IXR_Server {
  24. /**
  25. * Methods.
  26. *
  27. * @var array
  28. */
  29. public $methods;
  30. /**
  31. * Blog options.
  32. *
  33. * @var array
  34. */
  35. public $blog_options;
  36. /**
  37. * IXR_Error instance.
  38. *
  39. * @var IXR_Error
  40. */
  41. public $error;
  42. /**
  43. * Flags that the user authentication has failed in this instance of wp_xmlrpc_server.
  44. *
  45. * @var bool
  46. */
  47. protected $auth_failed = false;
  48. /**
  49. * Flags that XML-RPC is enabled
  50. *
  51. * @var bool
  52. */
  53. private $is_enabled;
  54. /**
  55. * Registers all of the XMLRPC methods that XMLRPC server understands.
  56. *
  57. * Sets up server and method property. Passes XMLRPC
  58. * methods through the {@see 'xmlrpc_methods'} filter to allow plugins to extend
  59. * or replace XML-RPC methods.
  60. *
  61. * @since 1.5.0
  62. */
  63. public function __construct() {
  64. $this->methods = array(
  65. // WordPress API.
  66. 'wp.getUsersBlogs' => 'this:wp_getUsersBlogs',
  67. 'wp.newPost' => 'this:wp_newPost',
  68. 'wp.editPost' => 'this:wp_editPost',
  69. 'wp.deletePost' => 'this:wp_deletePost',
  70. 'wp.getPost' => 'this:wp_getPost',
  71. 'wp.getPosts' => 'this:wp_getPosts',
  72. 'wp.newTerm' => 'this:wp_newTerm',
  73. 'wp.editTerm' => 'this:wp_editTerm',
  74. 'wp.deleteTerm' => 'this:wp_deleteTerm',
  75. 'wp.getTerm' => 'this:wp_getTerm',
  76. 'wp.getTerms' => 'this:wp_getTerms',
  77. 'wp.getTaxonomy' => 'this:wp_getTaxonomy',
  78. 'wp.getTaxonomies' => 'this:wp_getTaxonomies',
  79. 'wp.getUser' => 'this:wp_getUser',
  80. 'wp.getUsers' => 'this:wp_getUsers',
  81. 'wp.getProfile' => 'this:wp_getProfile',
  82. 'wp.editProfile' => 'this:wp_editProfile',
  83. 'wp.getPage' => 'this:wp_getPage',
  84. 'wp.getPages' => 'this:wp_getPages',
  85. 'wp.newPage' => 'this:wp_newPage',
  86. 'wp.deletePage' => 'this:wp_deletePage',
  87. 'wp.editPage' => 'this:wp_editPage',
  88. 'wp.getPageList' => 'this:wp_getPageList',
  89. 'wp.getAuthors' => 'this:wp_getAuthors',
  90. 'wp.getCategories' => 'this:mw_getCategories', // Alias.
  91. 'wp.getTags' => 'this:wp_getTags',
  92. 'wp.newCategory' => 'this:wp_newCategory',
  93. 'wp.deleteCategory' => 'this:wp_deleteCategory',
  94. 'wp.suggestCategories' => 'this:wp_suggestCategories',
  95. 'wp.uploadFile' => 'this:mw_newMediaObject', // Alias.
  96. 'wp.deleteFile' => 'this:wp_deletePost', // Alias.
  97. 'wp.getCommentCount' => 'this:wp_getCommentCount',
  98. 'wp.getPostStatusList' => 'this:wp_getPostStatusList',
  99. 'wp.getPageStatusList' => 'this:wp_getPageStatusList',
  100. 'wp.getPageTemplates' => 'this:wp_getPageTemplates',
  101. 'wp.getOptions' => 'this:wp_getOptions',
  102. 'wp.setOptions' => 'this:wp_setOptions',
  103. 'wp.getComment' => 'this:wp_getComment',
  104. 'wp.getComments' => 'this:wp_getComments',
  105. 'wp.deleteComment' => 'this:wp_deleteComment',
  106. 'wp.editComment' => 'this:wp_editComment',
  107. 'wp.newComment' => 'this:wp_newComment',
  108. 'wp.getCommentStatusList' => 'this:wp_getCommentStatusList',
  109. 'wp.getMediaItem' => 'this:wp_getMediaItem',
  110. 'wp.getMediaLibrary' => 'this:wp_getMediaLibrary',
  111. 'wp.getPostFormats' => 'this:wp_getPostFormats',
  112. 'wp.getPostType' => 'this:wp_getPostType',
  113. 'wp.getPostTypes' => 'this:wp_getPostTypes',
  114. 'wp.getRevisions' => 'this:wp_getRevisions',
  115. 'wp.restoreRevision' => 'this:wp_restoreRevision',
  116. // Blogger API.
  117. 'blogger.getUsersBlogs' => 'this:blogger_getUsersBlogs',
  118. 'blogger.getUserInfo' => 'this:blogger_getUserInfo',
  119. 'blogger.getPost' => 'this:blogger_getPost',
  120. 'blogger.getRecentPosts' => 'this:blogger_getRecentPosts',
  121. 'blogger.newPost' => 'this:blogger_newPost',
  122. 'blogger.editPost' => 'this:blogger_editPost',
  123. 'blogger.deletePost' => 'this:blogger_deletePost',
  124. // MetaWeblog API (with MT extensions to structs).
  125. 'metaWeblog.newPost' => 'this:mw_newPost',
  126. 'metaWeblog.editPost' => 'this:mw_editPost',
  127. 'metaWeblog.getPost' => 'this:mw_getPost',
  128. 'metaWeblog.getRecentPosts' => 'this:mw_getRecentPosts',
  129. 'metaWeblog.getCategories' => 'this:mw_getCategories',
  130. 'metaWeblog.newMediaObject' => 'this:mw_newMediaObject',
  131. // MetaWeblog API aliases for Blogger API.
  132. // See http://www.xmlrpc.com/stories/storyReader$2460
  133. 'metaWeblog.deletePost' => 'this:blogger_deletePost',
  134. 'metaWeblog.getUsersBlogs' => 'this:blogger_getUsersBlogs',
  135. // MovableType API.
  136. 'mt.getCategoryList' => 'this:mt_getCategoryList',
  137. 'mt.getRecentPostTitles' => 'this:mt_getRecentPostTitles',
  138. 'mt.getPostCategories' => 'this:mt_getPostCategories',
  139. 'mt.setPostCategories' => 'this:mt_setPostCategories',
  140. 'mt.supportedMethods' => 'this:mt_supportedMethods',
  141. 'mt.supportedTextFilters' => 'this:mt_supportedTextFilters',
  142. 'mt.getTrackbackPings' => 'this:mt_getTrackbackPings',
  143. 'mt.publishPost' => 'this:mt_publishPost',
  144. // Pingback.
  145. 'pingback.ping' => 'this:pingback_ping',
  146. 'pingback.extensions.getPingbacks' => 'this:pingback_extensions_getPingbacks',
  147. 'demo.sayHello' => 'this:sayHello',
  148. 'demo.addTwoNumbers' => 'this:addTwoNumbers',
  149. );
  150. $this->initialise_blog_option_info();
  151. /**
  152. * Filters the methods exposed by the XML-RPC server.
  153. *
  154. * This filter can be used to add new methods, and remove built-in methods.
  155. *
  156. * @since 1.5.0
  157. *
  158. * @param string[] $methods An array of XML-RPC methods, keyed by their methodName.
  159. */
  160. $this->methods = apply_filters( 'xmlrpc_methods', $this->methods );
  161. $this->set_is_enabled();
  162. }
  163. /**
  164. * Set wp_xmlrpc_server::$is_enabled property.
  165. *
  166. * Determine whether the xmlrpc server is enabled on this WordPress install
  167. * and set the is_enabled property accordingly.
  168. *
  169. * @since 5.7.3
  170. */
  171. private function set_is_enabled() {
  172. /*
  173. * Respect old get_option() filters left for back-compat when the 'enable_xmlrpc'
  174. * option was deprecated in 3.5.0. Use the {@see 'xmlrpc_enabled'} hook instead.
  175. */
  176. $is_enabled = apply_filters( 'pre_option_enable_xmlrpc', false );
  177. if ( false === $is_enabled ) {
  178. $is_enabled = apply_filters( 'option_enable_xmlrpc', true );
  179. }
  180. /**
  181. * Filters whether XML-RPC methods requiring authentication are enabled.
  182. *
  183. * Contrary to the way it's named, this filter does not control whether XML-RPC is *fully*
  184. * enabled, rather, it only controls whether XML-RPC methods requiring authentication - such
  185. * as for publishing purposes - are enabled.
  186. *
  187. * Further, the filter does not control whether pingbacks or other custom endpoints that don't
  188. * require authentication are enabled. This behavior is expected, and due to how parity was matched
  189. * with the `enable_xmlrpc` UI option the filter replaced when it was introduced in 3.5.
  190. *
  191. * To disable XML-RPC methods that require authentication, use:
  192. *
  193. * add_filter( 'xmlrpc_enabled', '__return_false' );
  194. *
  195. * For more granular control over all XML-RPC methods and requests, see the {@see 'xmlrpc_methods'}
  196. * and {@see 'xmlrpc_element_limit'} hooks.
  197. *
  198. * @since 3.5.0
  199. *
  200. * @param bool $is_enabled Whether XML-RPC is enabled. Default true.
  201. */
  202. $this->is_enabled = apply_filters( 'xmlrpc_enabled', $is_enabled );
  203. }
  204. /**
  205. * Make private/protected methods readable for backward compatibility.
  206. *
  207. * @since 4.0.0
  208. *
  209. * @param string $name Method to call.
  210. * @param array $arguments Arguments to pass when calling.
  211. * @return array|IXR_Error|false Return value of the callback, false otherwise.
  212. */
  213. public function __call( $name, $arguments ) {
  214. if ( '_multisite_getUsersBlogs' === $name ) {
  215. return $this->_multisite_getUsersBlogs( ...$arguments );
  216. }
  217. return false;
  218. }
  219. /**
  220. * Serves the XML-RPC request.
  221. *
  222. * @since 2.9.0
  223. */
  224. public function serve_request() {
  225. $this->IXR_Server( $this->methods );
  226. }
  227. /**
  228. * Test XMLRPC API by saying, "Hello!" to client.
  229. *
  230. * @since 1.5.0
  231. *
  232. * @return string Hello string response.
  233. */
  234. public function sayHello() {
  235. return 'Hello!';
  236. }
  237. /**
  238. * Test XMLRPC API by adding two numbers for client.
  239. *
  240. * @since 1.5.0
  241. *
  242. * @param array $args {
  243. * Method arguments. Note: arguments must be ordered as documented.
  244. *
  245. * @type int $0 A number to add.
  246. * @type int $1 A second number to add.
  247. * }
  248. * @return int Sum of the two given numbers.
  249. */
  250. public function addTwoNumbers( $args ) {
  251. $number1 = $args[0];
  252. $number2 = $args[1];
  253. return $number1 + $number2;
  254. }
  255. /**
  256. * Log user in.
  257. *
  258. * @since 2.8.0
  259. *
  260. * @param string $username User's username.
  261. * @param string $password User's password.
  262. * @return WP_User|false WP_User object if authentication passed, false otherwise
  263. */
  264. public function login( $username, $password ) {
  265. if ( ! $this->is_enabled ) {
  266. $this->error = new IXR_Error( 405, sprintf( __( 'XML-RPC services are disabled on this site.' ) ) );
  267. return false;
  268. }
  269. if ( $this->auth_failed ) {
  270. $user = new WP_Error( 'login_prevented' );
  271. } else {
  272. $user = wp_authenticate( $username, $password );
  273. }
  274. if ( is_wp_error( $user ) ) {
  275. $this->error = new IXR_Error( 403, __( 'Incorrect username or password.' ) );
  276. // Flag that authentication has failed once on this wp_xmlrpc_server instance.
  277. $this->auth_failed = true;
  278. /**
  279. * Filters the XML-RPC user login error message.
  280. *
  281. * @since 3.5.0
  282. *
  283. * @param IXR_Error $error The XML-RPC error message.
  284. * @param WP_Error $user WP_Error object.
  285. */
  286. $this->error = apply_filters( 'xmlrpc_login_error', $this->error, $user );
  287. return false;
  288. }
  289. wp_set_current_user( $user->ID );
  290. return $user;
  291. }
  292. /**
  293. * Check user's credentials. Deprecated.
  294. *
  295. * @since 1.5.0
  296. * @deprecated 2.8.0 Use wp_xmlrpc_server::login()
  297. * @see wp_xmlrpc_server::login()
  298. *
  299. * @param string $username User's username.
  300. * @param string $password User's password.
  301. * @return bool Whether authentication passed.
  302. */
  303. public function login_pass_ok( $username, $password ) {
  304. return (bool) $this->login( $username, $password );
  305. }
  306. /**
  307. * Escape string or array of strings for database.
  308. *
  309. * @since 1.5.2
  310. *
  311. * @param string|array $data Escape single string or array of strings.
  312. * @return string|void Returns with string is passed, alters by-reference
  313. * when array is passed.
  314. */
  315. public function escape( &$data ) {
  316. if ( ! is_array( $data ) ) {
  317. return wp_slash( $data );
  318. }
  319. foreach ( $data as &$v ) {
  320. if ( is_array( $v ) ) {
  321. $this->escape( $v );
  322. } elseif ( ! is_object( $v ) ) {
  323. $v = wp_slash( $v );
  324. }
  325. }
  326. }
  327. /**
  328. * Send error response to client.
  329. *
  330. * Send an XML error response to the client. If the endpoint is enabled
  331. * an HTTP 200 response is always sent per the XML-RPC specification.
  332. *
  333. * @since 5.7.3
  334. *
  335. * @param IXR_Error|string $error Error code or an error object.
  336. * @param false $message Error message. Optional.
  337. */
  338. public function error( $error, $message = false ) {
  339. // Accepts either an error object or an error code and message
  340. if ( $message && ! is_object( $error ) ) {
  341. $error = new IXR_Error( $error, $message );
  342. }
  343. if ( ! $this->is_enabled ) {
  344. status_header( $error->code );
  345. }
  346. $this->output( $error->getXml() );
  347. }
  348. /**
  349. * Retrieve custom fields for post.
  350. *
  351. * @since 2.5.0
  352. *
  353. * @param int $post_id Post ID.
  354. * @return array Custom fields, if exist.
  355. */
  356. public function get_custom_fields( $post_id ) {
  357. $post_id = (int) $post_id;
  358. $custom_fields = array();
  359. foreach ( (array) has_meta( $post_id ) as $meta ) {
  360. // Don't expose protected fields.
  361. if ( ! current_user_can( 'edit_post_meta', $post_id, $meta['meta_key'] ) ) {
  362. continue;
  363. }
  364. $custom_fields[] = array(
  365. 'id' => $meta['meta_id'],
  366. 'key' => $meta['meta_key'],
  367. 'value' => $meta['meta_value'],
  368. );
  369. }
  370. return $custom_fields;
  371. }
  372. /**
  373. * Set custom fields for post.
  374. *
  375. * @since 2.5.0
  376. *
  377. * @param int $post_id Post ID.
  378. * @param array $fields Custom fields.
  379. */
  380. public function set_custom_fields( $post_id, $fields ) {
  381. $post_id = (int) $post_id;
  382. foreach ( (array) $fields as $meta ) {
  383. if ( isset( $meta['id'] ) ) {
  384. $meta['id'] = (int) $meta['id'];
  385. $pmeta = get_metadata_by_mid( 'post', $meta['id'] );
  386. if ( ! $pmeta || $pmeta->post_id != $post_id ) {
  387. continue;
  388. }
  389. if ( isset( $meta['key'] ) ) {
  390. $meta['key'] = wp_unslash( $meta['key'] );
  391. if ( $meta['key'] !== $pmeta->meta_key ) {
  392. continue;
  393. }
  394. $meta['value'] = wp_unslash( $meta['value'] );
  395. if ( current_user_can( 'edit_post_meta', $post_id, $meta['key'] ) ) {
  396. update_metadata_by_mid( 'post', $meta['id'], $meta['value'] );
  397. }
  398. } elseif ( current_user_can( 'delete_post_meta', $post_id, $pmeta->meta_key ) ) {
  399. delete_metadata_by_mid( 'post', $meta['id'] );
  400. }
  401. } elseif ( current_user_can( 'add_post_meta', $post_id, wp_unslash( $meta['key'] ) ) ) {
  402. add_post_meta( $post_id, $meta['key'], $meta['value'] );
  403. }
  404. }
  405. }
  406. /**
  407. * Retrieve custom fields for a term.
  408. *
  409. * @since 4.9.0
  410. *
  411. * @param int $term_id Term ID.
  412. * @return array Array of custom fields, if they exist.
  413. */
  414. public function get_term_custom_fields( $term_id ) {
  415. $term_id = (int) $term_id;
  416. $custom_fields = array();
  417. foreach ( (array) has_term_meta( $term_id ) as $meta ) {
  418. if ( ! current_user_can( 'edit_term_meta', $term_id ) ) {
  419. continue;
  420. }
  421. $custom_fields[] = array(
  422. 'id' => $meta['meta_id'],
  423. 'key' => $meta['meta_key'],
  424. 'value' => $meta['meta_value'],
  425. );
  426. }
  427. return $custom_fields;
  428. }
  429. /**
  430. * Set custom fields for a term.
  431. *
  432. * @since 4.9.0
  433. *
  434. * @param int $term_id Term ID.
  435. * @param array $fields Custom fields.
  436. */
  437. public function set_term_custom_fields( $term_id, $fields ) {
  438. $term_id = (int) $term_id;
  439. foreach ( (array) $fields as $meta ) {
  440. if ( isset( $meta['id'] ) ) {
  441. $meta['id'] = (int) $meta['id'];
  442. $pmeta = get_metadata_by_mid( 'term', $meta['id'] );
  443. if ( isset( $meta['key'] ) ) {
  444. $meta['key'] = wp_unslash( $meta['key'] );
  445. if ( $meta['key'] !== $pmeta->meta_key ) {
  446. continue;
  447. }
  448. $meta['value'] = wp_unslash( $meta['value'] );
  449. if ( current_user_can( 'edit_term_meta', $term_id ) ) {
  450. update_metadata_by_mid( 'term', $meta['id'], $meta['value'] );
  451. }
  452. } elseif ( current_user_can( 'delete_term_meta', $term_id ) ) {
  453. delete_metadata_by_mid( 'term', $meta['id'] );
  454. }
  455. } elseif ( current_user_can( 'add_term_meta', $term_id ) ) {
  456. add_term_meta( $term_id, $meta['key'], $meta['value'] );
  457. }
  458. }
  459. }
  460. /**
  461. * Set up blog options property.
  462. *
  463. * Passes property through {@see 'xmlrpc_blog_options'} filter.
  464. *
  465. * @since 2.6.0
  466. */
  467. public function initialise_blog_option_info() {
  468. $this->blog_options = array(
  469. // Read-only options.
  470. 'software_name' => array(
  471. 'desc' => __( 'Software Name' ),
  472. 'readonly' => true,
  473. 'value' => 'WordPress',
  474. ),
  475. 'software_version' => array(
  476. 'desc' => __( 'Software Version' ),
  477. 'readonly' => true,
  478. 'value' => get_bloginfo( 'version' ),
  479. ),
  480. 'blog_url' => array(
  481. 'desc' => __( 'WordPress Address (URL)' ),
  482. 'readonly' => true,
  483. 'option' => 'siteurl',
  484. ),
  485. 'home_url' => array(
  486. 'desc' => __( 'Site Address (URL)' ),
  487. 'readonly' => true,
  488. 'option' => 'home',
  489. ),
  490. 'login_url' => array(
  491. 'desc' => __( 'Login Address (URL)' ),
  492. 'readonly' => true,
  493. 'value' => wp_login_url(),
  494. ),
  495. 'admin_url' => array(
  496. 'desc' => __( 'The URL to the admin area' ),
  497. 'readonly' => true,
  498. 'value' => get_admin_url(),
  499. ),
  500. 'image_default_link_type' => array(
  501. 'desc' => __( 'Image default link type' ),
  502. 'readonly' => true,
  503. 'option' => 'image_default_link_type',
  504. ),
  505. 'image_default_size' => array(
  506. 'desc' => __( 'Image default size' ),
  507. 'readonly' => true,
  508. 'option' => 'image_default_size',
  509. ),
  510. 'image_default_align' => array(
  511. 'desc' => __( 'Image default align' ),
  512. 'readonly' => true,
  513. 'option' => 'image_default_align',
  514. ),
  515. 'template' => array(
  516. 'desc' => __( 'Template' ),
  517. 'readonly' => true,
  518. 'option' => 'template',
  519. ),
  520. 'stylesheet' => array(
  521. 'desc' => __( 'Stylesheet' ),
  522. 'readonly' => true,
  523. 'option' => 'stylesheet',
  524. ),
  525. 'post_thumbnail' => array(
  526. 'desc' => __( 'Post Thumbnail' ),
  527. 'readonly' => true,
  528. 'value' => current_theme_supports( 'post-thumbnails' ),
  529. ),
  530. // Updatable options.
  531. 'time_zone' => array(
  532. 'desc' => __( 'Time Zone' ),
  533. 'readonly' => false,
  534. 'option' => 'gmt_offset',
  535. ),
  536. 'blog_title' => array(
  537. 'desc' => __( 'Site Title' ),
  538. 'readonly' => false,
  539. 'option' => 'blogname',
  540. ),
  541. 'blog_tagline' => array(
  542. 'desc' => __( 'Site Tagline' ),
  543. 'readonly' => false,
  544. 'option' => 'blogdescription',
  545. ),
  546. 'date_format' => array(
  547. 'desc' => __( 'Date Format' ),
  548. 'readonly' => false,
  549. 'option' => 'date_format',
  550. ),
  551. 'time_format' => array(
  552. 'desc' => __( 'Time Format' ),
  553. 'readonly' => false,
  554. 'option' => 'time_format',
  555. ),
  556. 'users_can_register' => array(
  557. 'desc' => __( 'Allow new users to sign up' ),
  558. 'readonly' => false,
  559. 'option' => 'users_can_register',
  560. ),
  561. 'thumbnail_size_w' => array(
  562. 'desc' => __( 'Thumbnail Width' ),
  563. 'readonly' => false,
  564. 'option' => 'thumbnail_size_w',
  565. ),
  566. 'thumbnail_size_h' => array(
  567. 'desc' => __( 'Thumbnail Height' ),
  568. 'readonly' => false,
  569. 'option' => 'thumbnail_size_h',
  570. ),
  571. 'thumbnail_crop' => array(
  572. 'desc' => __( 'Crop thumbnail to exact dimensions' ),
  573. 'readonly' => false,
  574. 'option' => 'thumbnail_crop',
  575. ),
  576. 'medium_size_w' => array(
  577. 'desc' => __( 'Medium size image width' ),
  578. 'readonly' => false,
  579. 'option' => 'medium_size_w',
  580. ),
  581. 'medium_size_h' => array(
  582. 'desc' => __( 'Medium size image height' ),
  583. 'readonly' => false,
  584. 'option' => 'medium_size_h',
  585. ),
  586. 'medium_large_size_w' => array(
  587. 'desc' => __( 'Medium-Large size image width' ),
  588. 'readonly' => false,
  589. 'option' => 'medium_large_size_w',
  590. ),
  591. 'medium_large_size_h' => array(
  592. 'desc' => __( 'Medium-Large size image height' ),
  593. 'readonly' => false,
  594. 'option' => 'medium_large_size_h',
  595. ),
  596. 'large_size_w' => array(
  597. 'desc' => __( 'Large size image width' ),
  598. 'readonly' => false,
  599. 'option' => 'large_size_w',
  600. ),
  601. 'large_size_h' => array(
  602. 'desc' => __( 'Large size image height' ),
  603. 'readonly' => false,
  604. 'option' => 'large_size_h',
  605. ),
  606. 'default_comment_status' => array(
  607. 'desc' => __( 'Allow people to submit comments on new posts.' ),
  608. 'readonly' => false,
  609. 'option' => 'default_comment_status',
  610. ),
  611. 'default_ping_status' => array(
  612. 'desc' => __( 'Allow link notifications from other blogs (pingbacks and trackbacks) on new posts.' ),
  613. 'readonly' => false,
  614. 'option' => 'default_ping_status',
  615. ),
  616. );
  617. /**
  618. * Filters the XML-RPC blog options property.
  619. *
  620. * @since 2.6.0
  621. *
  622. * @param array $blog_options An array of XML-RPC blog options.
  623. */
  624. $this->blog_options = apply_filters( 'xmlrpc_blog_options', $this->blog_options );
  625. }
  626. /**
  627. * Retrieve the blogs of the user.
  628. *
  629. * @since 2.6.0
  630. *
  631. * @param array $args {
  632. * Method arguments. Note: arguments must be ordered as documented.
  633. *
  634. * @type string $0 Username.
  635. * @type string $1 Password.
  636. * }
  637. * @return array|IXR_Error Array contains:
  638. * - 'isAdmin'
  639. * - 'isPrimary' - whether the blog is the user's primary blog
  640. * - 'url'
  641. * - 'blogid'
  642. * - 'blogName'
  643. * - 'xmlrpc' - url of xmlrpc endpoint
  644. */
  645. public function wp_getUsersBlogs( $args ) {
  646. if ( ! $this->minimum_args( $args, 2 ) ) {
  647. return $this->error;
  648. }
  649. // If this isn't on WPMU then just use blogger_getUsersBlogs().
  650. if ( ! is_multisite() ) {
  651. array_unshift( $args, 1 );
  652. return $this->blogger_getUsersBlogs( $args );
  653. }
  654. $this->escape( $args );
  655. $username = $args[0];
  656. $password = $args[1];
  657. $user = $this->login( $username, $password );
  658. if ( ! $user ) {
  659. return $this->error;
  660. }
  661. /**
  662. * Fires after the XML-RPC user has been authenticated but before the rest of
  663. * the method logic begins.
  664. *
  665. * All built-in XML-RPC methods use the action xmlrpc_call, with a parameter
  666. * equal to the method's name, e.g., wp.getUsersBlogs, wp.newPost, etc.
  667. *
  668. * @since 2.5.0
  669. * @since 5.7.0 Added the `$args` and `$server` parameters.
  670. *
  671. * @param string $name The method name.
  672. * @param array|string $args The escaped arguments passed to the method.
  673. * @param wp_xmlrpc_server $server The XML-RPC server instance.
  674. */
  675. do_action( 'xmlrpc_call', 'wp.getUsersBlogs', $args, $this );
  676. $blogs = (array) get_blogs_of_user( $user->ID );
  677. $struct = array();
  678. $primary_blog_id = 0;
  679. $active_blog = get_active_blog_for_user( $user->ID );
  680. if ( $active_blog ) {
  681. $primary_blog_id = (int) $active_blog->blog_id;
  682. }
  683. foreach ( $blogs as $blog ) {
  684. // Don't include blogs that aren't hosted at this site.
  685. if ( get_current_network_id() != $blog->site_id ) {
  686. continue;
  687. }
  688. $blog_id = $blog->userblog_id;
  689. switch_to_blog( $blog_id );
  690. $is_admin = current_user_can( 'manage_options' );
  691. $is_primary = ( (int) $blog_id === $primary_blog_id );
  692. $struct[] = array(
  693. 'isAdmin' => $is_admin,
  694. 'isPrimary' => $is_primary,
  695. 'url' => home_url( '/' ),
  696. 'blogid' => (string) $blog_id,
  697. 'blogName' => get_option( 'blogname' ),
  698. 'xmlrpc' => site_url( 'xmlrpc.php', 'rpc' ),
  699. );
  700. restore_current_blog();
  701. }
  702. return $struct;
  703. }
  704. /**
  705. * Checks if the method received at least the minimum number of arguments.
  706. *
  707. * @since 3.4.0
  708. *
  709. * @param array $args An array of arguments to check.
  710. * @param int $count Minimum number of arguments.
  711. * @return bool True if `$args` contains at least `$count` arguments, false otherwise.
  712. */
  713. protected function minimum_args( $args, $count ) {
  714. if ( ! is_array( $args ) || count( $args ) < $count ) {
  715. $this->error = new IXR_Error( 400, __( 'Insufficient arguments passed to this XML-RPC method.' ) );
  716. return false;
  717. }
  718. return true;
  719. }
  720. /**
  721. * Prepares taxonomy data for return in an XML-RPC object.
  722. *
  723. * @param WP_Taxonomy $taxonomy The unprepared taxonomy data.
  724. * @param array $fields The subset of taxonomy fields to return.
  725. * @return array The prepared taxonomy data.
  726. */
  727. protected function _prepare_taxonomy( $taxonomy, $fields ) {
  728. $_taxonomy = array(
  729. 'name' => $taxonomy->name,
  730. 'label' => $taxonomy->label,
  731. 'hierarchical' => (bool) $taxonomy->hierarchical,
  732. 'public' => (bool) $taxonomy->public,
  733. 'show_ui' => (bool) $taxonomy->show_ui,
  734. '_builtin' => (bool) $taxonomy->_builtin,
  735. );
  736. if ( in_array( 'labels', $fields, true ) ) {
  737. $_taxonomy['labels'] = (array) $taxonomy->labels;
  738. }
  739. if ( in_array( 'cap', $fields, true ) ) {
  740. $_taxonomy['cap'] = (array) $taxonomy->cap;
  741. }
  742. if ( in_array( 'menu', $fields, true ) ) {
  743. $_taxonomy['show_in_menu'] = (bool) $taxonomy->show_in_menu;
  744. }
  745. if ( in_array( 'object_type', $fields, true ) ) {
  746. $_taxonomy['object_type'] = array_unique( (array) $taxonomy->object_type );
  747. }
  748. /**
  749. * Filters XML-RPC-prepared data for the given taxonomy.
  750. *
  751. * @since 3.4.0
  752. *
  753. * @param array $_taxonomy An array of taxonomy data.
  754. * @param WP_Taxonomy $taxonomy Taxonomy object.
  755. * @param array $fields The subset of taxonomy fields to return.
  756. */
  757. return apply_filters( 'xmlrpc_prepare_taxonomy', $_taxonomy, $taxonomy, $fields );
  758. }
  759. /**
  760. * Prepares term data for return in an XML-RPC object.
  761. *
  762. * @param array|object $term The unprepared term data.
  763. * @return array The prepared term data.
  764. */
  765. protected function _prepare_term( $term ) {
  766. $_term = $term;
  767. if ( ! is_array( $_term ) ) {
  768. $_term = get_object_vars( $_term );
  769. }
  770. // For integers which may be larger than XML-RPC supports ensure we return strings.
  771. $_term['term_id'] = (string) $_term['term_id'];
  772. $_term['term_group'] = (string) $_term['term_group'];
  773. $_term['term_taxonomy_id'] = (string) $_term['term_taxonomy_id'];
  774. $_term['parent'] = (string) $_term['parent'];
  775. // Count we are happy to return as an integer because people really shouldn't use terms that much.
  776. $_term['count'] = (int) $_term['count'];
  777. // Get term meta.
  778. $_term['custom_fields'] = $this->get_term_custom_fields( $_term['term_id'] );
  779. /**
  780. * Filters XML-RPC-prepared data for the given term.
  781. *
  782. * @since 3.4.0
  783. *
  784. * @param array $_term An array of term data.
  785. * @param array|object $term Term object or array.
  786. */
  787. return apply_filters( 'xmlrpc_prepare_term', $_term, $term );
  788. }
  789. /**
  790. * Convert a WordPress date string to an IXR_Date object.
  791. *
  792. * @param string $date Date string to convert.
  793. * @return IXR_Date IXR_Date object.
  794. */
  795. protected function _convert_date( $date ) {
  796. if ( '0000-00-00 00:00:00' === $date ) {
  797. return new IXR_Date( '00000000T00:00:00Z' );
  798. }
  799. return new IXR_Date( mysql2date( 'Ymd\TH:i:s', $date, false ) );
  800. }
  801. /**
  802. * Convert a WordPress GMT date string to an IXR_Date object.
  803. *
  804. * @param string $date_gmt WordPress GMT date string.
  805. * @param string $date Date string.
  806. * @return IXR_Date IXR_Date object.
  807. */
  808. protected function _convert_date_gmt( $date_gmt, $date ) {
  809. if ( '0000-00-00 00:00:00' !== $date && '0000-00-00 00:00:00' === $date_gmt ) {
  810. return new IXR_Date( get_gmt_from_date( mysql2date( 'Y-m-d H:i:s', $date, false ), 'Ymd\TH:i:s' ) );
  811. }
  812. return $this->_convert_date( $date_gmt );
  813. }
  814. /**
  815. * Prepares post data for return in an XML-RPC object.
  816. *
  817. * @param array $post The unprepared post data.
  818. * @param array $fields The subset of post type fields to return.
  819. * @return array The prepared post data.
  820. */
  821. protected function _prepare_post( $post, $fields ) {
  822. // Holds the data for this post. built up based on $fields.
  823. $_post = array( 'post_id' => (string) $post['ID'] );
  824. // Prepare common post fields.
  825. $post_fields = array(
  826. 'post_title' => $post['post_title'],
  827. 'post_date' => $this->_convert_date( $post['post_date'] ),
  828. 'post_date_gmt' => $this->_convert_date_gmt( $post['post_date_gmt'], $post['post_date'] ),
  829. 'post_modified' => $this->_convert_date( $post['post_modified'] ),
  830. 'post_modified_gmt' => $this->_convert_date_gmt( $post['post_modified_gmt'], $post['post_modified'] ),
  831. 'post_status' => $post['post_status'],
  832. 'post_type' => $post['post_type'],
  833. 'post_name' => $post['post_name'],
  834. 'post_author' => $post['post_author'],
  835. 'post_password' => $post['post_password'],
  836. 'post_excerpt' => $post['post_excerpt'],
  837. 'post_content' => $post['post_content'],
  838. 'post_parent' => (string) $post['post_parent'],
  839. 'post_mime_type' => $post['post_mime_type'],
  840. 'link' => get_permalink( $post['ID'] ),
  841. 'guid' => $post['guid'],
  842. 'menu_order' => (int) $post['menu_order'],
  843. 'comment_status' => $post['comment_status'],
  844. 'ping_status' => $post['ping_status'],
  845. 'sticky' => ( 'post' === $post['post_type'] && is_sticky( $post['ID'] ) ),
  846. );
  847. // Thumbnail.
  848. $post_fields['post_thumbnail'] = array();
  849. $thumbnail_id = get_post_thumbnail_id( $post['ID'] );
  850. if ( $thumbnail_id ) {
  851. $thumbnail_size = current_theme_supports( 'post-thumbnail' ) ? 'post-thumbnail' : 'thumbnail';
  852. $post_fields['post_thumbnail'] = $this->_prepare_media_item( get_post( $thumbnail_id ), $thumbnail_size );
  853. }
  854. // Consider future posts as published.
  855. if ( 'future' === $post_fields['post_status'] ) {
  856. $post_fields['post_status'] = 'publish';
  857. }
  858. // Fill in blank post format.
  859. $post_fields['post_format'] = get_post_format( $post['ID'] );
  860. if ( empty( $post_fields['post_format'] ) ) {
  861. $post_fields['post_format'] = 'standard';
  862. }
  863. // Merge requested $post_fields fields into $_post.
  864. if ( in_array( 'post', $fields, true ) ) {
  865. $_post = array_merge( $_post, $post_fields );
  866. } else {
  867. $requested_fields = array_intersect_key( $post_fields, array_flip( $fields ) );
  868. $_post = array_merge( $_post, $requested_fields );
  869. }
  870. $all_taxonomy_fields = in_array( 'taxonomies', $fields, true );
  871. if ( $all_taxonomy_fields || in_array( 'terms', $fields, true ) ) {
  872. $post_type_taxonomies = get_object_taxonomies( $post['post_type'], 'names' );
  873. $terms = wp_get_object_terms( $post['ID'], $post_type_taxonomies );
  874. $_post['terms'] = array();
  875. foreach ( $terms as $term ) {
  876. $_post['terms'][] = $this->_prepare_term( $term );
  877. }
  878. }
  879. if ( in_array( 'custom_fields', $fields, true ) ) {
  880. $_post['custom_fields'] = $this->get_custom_fields( $post['ID'] );
  881. }
  882. if ( in_array( 'enclosure', $fields, true ) ) {
  883. $_post['enclosure'] = array();
  884. $enclosures = (array) get_post_meta( $post['ID'], 'enclosure' );
  885. if ( ! empty( $enclosures ) ) {
  886. $encdata = explode( "\n", $enclosures[0] );
  887. $_post['enclosure']['url'] = trim( htmlspecialchars( $encdata[0] ) );
  888. $_post['enclosure']['length'] = (int) trim( $encdata[1] );
  889. $_post['enclosure']['type'] = trim( $encdata[2] );
  890. }
  891. }
  892. /**
  893. * Filters XML-RPC-prepared date for the given post.
  894. *
  895. * @since 3.4.0
  896. *
  897. * @param array $_post An array of modified post data.
  898. * @param array $post An array of post data.
  899. * @param array $fields An array of post fields.
  900. */
  901. return apply_filters( 'xmlrpc_prepare_post', $_post, $post, $fields );
  902. }
  903. /**
  904. * Prepares post data for return in an XML-RPC object.
  905. *
  906. * @since 3.4.0
  907. * @since 4.6.0 Converted the `$post_type` parameter to accept a WP_Post_Type object.
  908. *
  909. * @param WP_Post_Type $post_type Post type object.
  910. * @param array $fields The subset of post fields to return.
  911. * @return array The prepared post type data.
  912. */
  913. protected function _prepare_post_type( $post_type, $fields ) {
  914. $_post_type = array(
  915. 'name' => $post_type->name,
  916. 'label' => $post_type->label,
  917. 'hierarchical' => (bool) $post_type->hierarchical,
  918. 'public' => (bool) $post_type->public,
  919. 'show_ui' => (bool) $post_type->show_ui,
  920. '_builtin' => (bool) $post_type->_builtin,
  921. 'has_archive' => (bool) $post_type->has_archive,
  922. 'supports' => get_all_post_type_supports( $post_type->name ),
  923. );
  924. if ( in_array( 'labels', $fields, true ) ) {
  925. $_post_type['labels'] = (array) $post_type->labels;
  926. }
  927. if ( in_array( 'cap', $fields, true ) ) {
  928. $_post_type['cap'] = (array) $post_type->cap;
  929. $_post_type['map_meta_cap'] = (bool) $post_type->map_meta_cap;
  930. }
  931. if ( in_array( 'menu', $fields, true ) ) {
  932. $_post_type['menu_position'] = (int) $post_type->menu_position;
  933. $_post_type['menu_icon'] = $post_type->menu_icon;
  934. $_post_type['show_in_menu'] = (bool) $post_type->show_in_menu;
  935. }
  936. if ( in_array( 'taxonomies', $fields, true ) ) {
  937. $_post_type['taxonomies'] = get_object_taxonomies( $post_type->name, 'names' );
  938. }
  939. /**
  940. * Filters XML-RPC-prepared date for the given post type.
  941. *
  942. * @since 3.4.0
  943. * @since 4.6.0 Converted the `$post_type` parameter to accept a WP_Post_Type object.
  944. *
  945. * @param array $_post_type An array of post type data.
  946. * @param WP_Post_Type $post_type Post type object.
  947. */
  948. return apply_filters( 'xmlrpc_prepare_post_type', $_post_type, $post_type );
  949. }
  950. /**
  951. * Prepares media item data for return in an XML-RPC object.
  952. *
  953. * @param WP_Post $media_item The unprepared media item data.
  954. * @param string $thumbnail_size The image size to use for the thumbnail URL.
  955. * @return array The prepared media item data.
  956. */
  957. protected function _prepare_media_item( $media_item, $thumbnail_size = 'thumbnail' ) {
  958. $_media_item = array(
  959. 'attachment_id' => (string) $media_item->ID,
  960. 'date_created_gmt' => $this->_convert_date_gmt( $media_item->post_date_gmt, $media_item->post_date ),
  961. 'parent' => $media_item->post_parent,
  962. 'link' => wp_get_attachment_url( $media_item->ID ),
  963. 'title' => $media_item->post_title,
  964. 'caption' => $media_item->post_excerpt,
  965. 'description' => $media_item->post_content,
  966. 'metadata' => wp_get_attachment_metadata( $media_item->ID ),
  967. 'type' => $media_item->post_mime_type,
  968. );
  969. $thumbnail_src = image_downsize( $media_item->ID, $thumbnail_size );
  970. if ( $thumbnail_src ) {
  971. $_media_item['thumbnail'] = $thumbnail_src[0];
  972. } else {
  973. $_media_item['thumbnail'] = $_media_item['link'];
  974. }
  975. /**
  976. * Filters XML-RPC-prepared data for the given media item.
  977. *
  978. * @since 3.4.0
  979. *
  980. * @param array $_media_item An array of media item data.
  981. * @param WP_Post $media_item Media item object.
  982. * @param string $thumbnail_size Image size.
  983. */
  984. return apply_filters( 'xmlrpc_prepare_media_item', $_media_item, $media_item, $thumbnail_size );
  985. }
  986. /**
  987. * Prepares page data for return in an XML-RPC object.
  988. *
  989. * @param WP_Post $page The unprepared page data.
  990. * @return array The prepared page data.
  991. */
  992. protected function _prepare_page( $page ) {
  993. // Get all of the page content and link.
  994. $full_page = get_extended( $page->post_content );
  995. $link = get_permalink( $page->ID );
  996. // Get info the page parent if there is one.
  997. $parent_title = '';
  998. if ( ! empty( $page->post_parent ) ) {
  999. $parent = get_post( $page->post_parent );
  1000. $parent_title = $parent->post_title;
  1001. }
  1002. // Determine comment and ping settings.
  1003. $allow_comments = comments_open( $page->ID ) ? 1 : 0;
  1004. $allow_pings = pings_open( $page->ID ) ? 1 : 0;
  1005. // Format page date.
  1006. $page_date = $this->_convert_date( $page->post_date );
  1007. $page_date_gmt = $this->_convert_date_gmt( $page->post_date_gmt, $page->post_date );
  1008. // Pull the categories info together.
  1009. $categories = array();
  1010. if ( is_object_in_taxonomy( 'page', 'category' ) ) {
  1011. foreach ( wp_get_post_categories( $page->ID ) as $cat_id ) {
  1012. $categories[] = get_cat_name( $cat_id );
  1013. }
  1014. }
  1015. // Get the author info.
  1016. $author = get_userdata( $page->post_author );
  1017. $page_template = get_page_template_slug( $page->ID );
  1018. if ( empty( $page_template ) ) {
  1019. $page_template = 'default';
  1020. }
  1021. $_page = array(
  1022. 'dateCreated' => $page_date,
  1023. 'userid' => $page->post_author,
  1024. 'page_id' => $page->ID,
  1025. 'page_status' => $page->post_status,
  1026. 'description' => $full_page['main'],
  1027. 'title' => $page->post_title,
  1028. 'link' => $link,
  1029. 'permaLink' => $link,
  1030. 'categories' => $categories,
  1031. 'excerpt' => $page->post_excerpt,
  1032. 'text_more' => $full_page['extended'],
  1033. 'mt_allow_comments' => $allow_comments,
  1034. 'mt_allow_pings' => $allow_pings,
  1035. 'wp_slug' => $page->post_name,
  1036. 'wp_password' => $page->post_password,
  1037. 'wp_author' => $author->display_name,
  1038. 'wp_page_parent_id' => $page->post_parent,
  1039. 'wp_page_parent_title' => $parent_title,
  1040. 'wp_page_order' => $page->menu_order,
  1041. 'wp_author_id' => (string) $author->ID,
  1042. 'wp_author_display_name' => $author->display_name,
  1043. 'date_created_gmt' => $page_date_gmt,
  1044. 'custom_fields' => $this->get_custom_fields( $page->ID ),
  1045. 'wp_page_template' => $page_template,
  1046. );
  1047. /**
  1048. * Filters XML-RPC-prepared data for the given page.
  1049. *
  1050. * @since 3.4.0
  1051. *
  1052. * @param array $_page An array of page data.
  1053. * @param WP_Post $page Page object.
  1054. */
  1055. return apply_filters( 'xmlrpc_prepare_page', $_page, $page );
  1056. }
  1057. /**
  1058. * Prepares comment data for return in an XML-RPC object.
  1059. *
  1060. * @param WP_Comment $comment The unprepared comment data.
  1061. * @return array The prepared comment data.
  1062. */
  1063. protected function _prepare_comment( $comment ) {
  1064. // Format page date.
  1065. $comment_date_gmt = $this->_convert_date_gmt( $comment->comment_date_gmt, $comment->comment_date );
  1066. if ( '0' == $comment->comment_approved ) {
  1067. $comment_status = 'hold';
  1068. } elseif ( 'spam' === $comment->comment_approved ) {
  1069. $comment_status = 'spam';
  1070. } elseif ( '1' == $comment->comment_approved ) {
  1071. $comment_status = 'approve';
  1072. } else {
  1073. $comment_status = $comment->comment_approved;
  1074. }
  1075. $_comment = array(
  1076. 'date_created_gmt' => $comment_date_gmt,
  1077. 'user_id' => $comment->user_id,
  1078. 'comment_id' => $comment->comment_ID,
  1079. 'parent' => $comment->comment_parent,
  1080. 'status' => $comment_status,
  1081. 'content' => $comment->comment_content,
  1082. 'link' => get_comment_link( $comment ),
  1083. 'post_id' => $comment->comment_post_ID,
  1084. 'post_title' => get_the_title( $comment->comment_post_ID ),
  1085. 'author' => $comment->comment_author,
  1086. 'author_url' => $comment->comment_author_url,
  1087. 'author_email' => $comment->comment_author_email,
  1088. 'author_ip' => $comment->comment_author_IP,
  1089. 'type' => $comment->comment_type,
  1090. );
  1091. /**
  1092. * Filters XML-RPC-prepared data for the given comment.
  1093. *
  1094. * @since 3.4.0
  1095. *
  1096. * @param array $_comment An array of prepared comment data.
  1097. * @param WP_Comment $comment Comment object.
  1098. */
  1099. return apply_filters( 'xmlrpc_prepare_comment', $_comment, $comment );
  1100. }
  1101. /**
  1102. * Prepares user data for return in an XML-RPC object.
  1103. *
  1104. * @param WP_User $user The unprepared user object.
  1105. * @param array $fields The subset of user fields to return.
  1106. * @return array The prepared user data.
  1107. */
  1108. protected function _prepare_user( $user, $fields ) {
  1109. $_user = array( 'user_id' => (string) $user->ID );
  1110. $user_fields = array(
  1111. 'username' => $user->user_login,
  1112. 'first_name' => $user->user_firstname,
  1113. 'last_name' => $user->user_lastname,
  1114. 'registered' => $this->_convert_date( $user->user_registered ),
  1115. 'bio' => $user->user_description,
  1116. 'email' => $user->user_email,
  1117. 'nickname' => $user->nickname,
  1118. 'nicename' => $user->user_nicename,
  1119. 'url' => $user->user_url,
  1120. 'display_name' => $user->display_name,
  1121. 'roles' => $user->roles,
  1122. );
  1123. if ( in_array( 'all', $fields, true ) ) {
  1124. $_user = array_merge( $_user, $user_fields );
  1125. } else {
  1126. if ( in_array( 'basic', $fields, true ) ) {
  1127. $basic_fields = array( 'username', 'email', 'registered', 'display_name', 'nicename' );
  1128. $fields = array_merge( $fields, $basic_fields );
  1129. }
  1130. $requested_fields = array_intersect_key( $user_fields, array_flip( $fields ) );
  1131. $_user = array_merge( $_user, $requested_fields );
  1132. }
  1133. /**
  1134. * Filters XML-RPC-prepared data for the given user.
  1135. *
  1136. * @since 3.5.0
  1137. *
  1138. * @param array $_user An array of user data.
  1139. * @param WP_User $user User object.
  1140. * @param array $fields An array of user fields.
  1141. */
  1142. return apply_filters( 'xmlrpc_prepare_user', $_user, $user, $fields );
  1143. }
  1144. /**
  1145. * Create a new post for any registered post type.
  1146. *
  1147. * @since 3.4.0
  1148. *
  1149. * @link https://en.wikipedia.org/wiki/RSS_enclosure for information on RSS enclosures.
  1150. *
  1151. * @param array $args {
  1152. * Method arguments. Note: top-level arguments must be ordered as documented.
  1153. *
  1154. * @type int $0 Blog ID (unused).
  1155. * @type string $1 Username.
  1156. * @type string $2 Password.
  1157. * @type array $3 {
  1158. * Content struct for adding a new post. See wp_insert_post() for information on
  1159. * additional post fields
  1160. *
  1161. * @type string $post_type Post type. Default 'post'.
  1162. * @type string $post_status Post status. Default 'draft'
  1163. * @type string $post_title Post title.
  1164. * @type int $post_author Post author ID.
  1165. * @type string $post_excerpt Post excerpt.
  1166. * @type string $post_content Post content.
  1167. * @type string $post_date_gmt Post date in GMT.
  1168. * @type string $post_date Post date.
  1169. * @type string $post_password Post password (20-character limit).
  1170. * @type string $comment_status Post comment enabled status. Accepts 'open' or 'closed'.
  1171. * @type string $ping_status Post ping status. Accepts 'open' or 'closed'.
  1172. * @type bool $sticky Whether the post should be sticky. Automatically false if
  1173. * `$post_status` is 'private'.
  1174. * @type int $post_thumbnail ID of an image to use as the post thumbnail/featured image.
  1175. * @type array $custom_fields Array of meta key/value pairs to add to the post.
  1176. * @type array $terms Associative array with taxonomy names as keys and arrays
  1177. * of term IDs as values.
  1178. * @type array $terms_names Associative array with taxonomy names as keys and arrays
  1179. * of term names as values.
  1180. * @type array $enclosure {
  1181. * Array of feed enclosure data to add to post meta.
  1182. *
  1183. * @type string $url URL for the feed enclosure.
  1184. * @type int $length Size in bytes of the enclosure.
  1185. * @type string $type Mime-type for the enclosure.
  1186. * }
  1187. * }
  1188. * }
  1189. * @return int|IXR_Error Post ID on success, IXR_Error instance otherwise.
  1190. */
  1191. public function wp_newPost( $args ) {
  1192. if ( ! $this->minimum_args( $args, 4 ) ) {
  1193. return $this->error;
  1194. }
  1195. $this->escape( $args );
  1196. $username = $args[1];
  1197. $password = $args[2];
  1198. $content_struct = $args[3];
  1199. $user = $this->login( $username, $password );
  1200. if ( ! $user ) {
  1201. return $this->error;
  1202. }
  1203. // Convert the date field back to IXR form.
  1204. if ( isset( $content_struct['post_date'] ) && ! ( $content_struct['post_date'] instanceof IXR_Date ) ) {
  1205. $content_struct['post_date'] = $this->_convert_date( $content_struct['post_date'] );
  1206. }
  1207. /*
  1208. * Ignore the existing GMT date if it is empty or a non-GMT date was supplied in $content_struct,
  1209. * since _insert_post() will ignore the non-GMT date if the GMT date is set.
  1210. */
  1211. if ( isset( $content_struct['post_date_gmt'] ) && ! ( $content_struct['post_date_gmt'] instanceof IXR_Date ) ) {
  1212. if ( '0000-00-00 00:00:00' === $content_struct['post_date_gmt'] || isset( $content_struct['post_date'] ) ) {
  1213. unset( $content_struct['post_date_gmt'] );
  1214. } else {
  1215. $content_struct['post_date_gmt'] = $this->_convert_date( $content_struct['post_date_gmt'] );
  1216. }
  1217. }
  1218. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1219. do_action( 'xmlrpc_call', 'wp.newPost', $args, $this );
  1220. unset( $content_struct['ID'] );
  1221. return $this->_insert_post( $user, $content_struct );
  1222. }
  1223. /**
  1224. * Helper method for filtering out elements from an array.
  1225. *
  1226. * @since 3.4.0
  1227. *
  1228. * @param int $count Number to compare to one.
  1229. * @return bool True if the number is greater than one, false otherwise.
  1230. */
  1231. private function _is_greater_than_one( $count ) {
  1232. return $count > 1;
  1233. }
  1234. /**
  1235. * Encapsulate the logic for sticking a post
  1236. * and determining if the user has permission to do so
  1237. *
  1238. * @since 4.3.0
  1239. *
  1240. * @param array $post_data
  1241. * @param bool $update
  1242. * @return void|IXR_Error
  1243. */
  1244. private function _toggle_sticky( $post_data, $update = false ) {
  1245. $post_type = get_post_type_object( $post_data['post_type'] );
  1246. // Private and password-protected posts cannot be stickied.
  1247. if ( 'private' === $post_data['post_status'] || ! empty( $post_data['post_password'] ) ) {
  1248. // Error if the client tried to stick the post, otherwise, silently unstick.
  1249. if ( ! empty( $post_data['sticky'] ) ) {
  1250. return new IXR_Error( 401, __( 'Sorry, you cannot stick a private post.' ) );
  1251. }
  1252. if ( $update ) {
  1253. unstick_post( $post_data['ID'] );
  1254. }
  1255. } elseif ( isset( $post_data['sticky'] ) ) {
  1256. if ( ! current_user_can( $post_type->cap->edit_others_posts ) ) {
  1257. return new IXR_Error( 401, __( 'Sorry, you are not allowed to make posts sticky.' ) );
  1258. }
  1259. $sticky = wp_validate_boolean( $post_data['sticky'] );
  1260. if ( $sticky ) {
  1261. stick_post( $post_data['ID'] );
  1262. } else {
  1263. unstick_post( $post_data['ID'] );
  1264. }
  1265. }
  1266. }
  1267. /**
  1268. * Helper method for wp_newPost() and wp_editPost(), containing shared logic.
  1269. *
  1270. * @since 3.4.0
  1271. *
  1272. * @see wp_insert_post()
  1273. *
  1274. * @param WP_User $user The post author if post_author isn't set in $content_struct.
  1275. * @param array|IXR_Error $content_struct Post data to insert.
  1276. * @return IXR_Error|string
  1277. */
  1278. protected function _insert_post( $user, $content_struct ) {
  1279. $defaults = array(
  1280. 'post_status' => 'draft',
  1281. 'post_type' => 'post',
  1282. 'post_author' => 0,
  1283. 'post_password' => '',
  1284. 'post_excerpt' => '',
  1285. 'post_content' => '',
  1286. 'post_title' => '',
  1287. 'post_date' => '',
  1288. 'post_date_gmt' => '',
  1289. 'post_format' => null,
  1290. 'post_name' => null,
  1291. 'post_thumbnail' => null,
  1292. 'post_parent' => 0,
  1293. 'ping_status' => '',
  1294. 'comment_status' => '',
  1295. 'custom_fields' => null,
  1296. 'terms_names' => null,
  1297. 'terms' => null,
  1298. 'sticky' => null,
  1299. 'enclosure' => null,
  1300. 'ID' => null,
  1301. );
  1302. $post_data = wp_parse_args( array_intersect_key( $content_struct, $defaults ), $defaults );
  1303. $post_type = get_post_type_object( $post_data['post_type'] );
  1304. if ( ! $post_type ) {
  1305. return new IXR_Error( 403, __( 'Invalid post type.' ) );
  1306. }
  1307. $update = ! empty( $post_data['ID'] );
  1308. if ( $update ) {
  1309. if ( ! get_post( $post_data['ID'] ) ) {
  1310. return new IXR_Error( 401, __( 'Invalid post ID.' ) );
  1311. }
  1312. if ( ! current_user_can( 'edit_post', $post_data['ID'] ) ) {
  1313. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  1314. }
  1315. if ( get_post_type( $post_data['ID'] ) !== $post_data['post_type'] ) {
  1316. return new IXR_Error( 401, __( 'The post type may not be changed.' ) );
  1317. }
  1318. } else {
  1319. if ( ! current_user_can( $post_type->cap->create_posts ) || ! current_user_can( $post_type->cap->edit_posts ) ) {
  1320. return new IXR_Error( 401, __( 'Sorry, you are not allowed to post on this site.' ) );
  1321. }
  1322. }
  1323. switch ( $post_data['post_status'] ) {
  1324. case 'draft':
  1325. case 'pending':
  1326. break;
  1327. case 'private':
  1328. if ( ! current_user_can( $post_type->cap->publish_posts ) ) {
  1329. return new IXR_Error( 401, __( 'Sorry, you are not allowed to create private posts in this post type.' ) );
  1330. }
  1331. break;
  1332. case 'publish':
  1333. case 'future':
  1334. if ( ! current_user_can( $post_type->cap->publish_posts ) ) {
  1335. return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish posts in this post type.' ) );
  1336. }
  1337. break;
  1338. default:
  1339. if ( ! get_post_status_object( $post_data['post_status'] ) ) {
  1340. $post_data['post_status'] = 'draft';
  1341. }
  1342. break;
  1343. }
  1344. if ( ! empty( $post_data['post_password'] ) && ! current_user_can( $post_type->cap->publish_posts ) ) {
  1345. return new IXR_Error( 401, __( 'Sorry, you are not allowed to create password protected posts in this post type.' ) );
  1346. }
  1347. $post_data['post_author'] = absint( $post_data['post_author'] );
  1348. if ( ! empty( $post_data['post_author'] ) && $post_data['post_author'] != $user->ID ) {
  1349. if ( ! current_user_can( $post_type->cap->edit_others_posts ) ) {
  1350. return new IXR_Error( 401, __( 'Sorry, you are not allowed to create posts as this user.' ) );
  1351. }
  1352. $author = get_userdata( $post_data['post_author'] );
  1353. if ( ! $author ) {
  1354. return new IXR_Error( 404, __( 'Invalid author ID.' ) );
  1355. }
  1356. } else {
  1357. $post_data['post_author'] = $user->ID;
  1358. }
  1359. if ( 'open' !== $post_data['comment_status'] && 'closed' !== $post_data['comment_status'] ) {
  1360. unset( $post_data['comment_status'] );
  1361. }
  1362. if ( 'open' !== $post_data['ping_status'] && 'closed' !== $post_data['ping_status'] ) {
  1363. unset( $post_data['ping_status'] );
  1364. }
  1365. // Do some timestamp voodoo.
  1366. if ( ! empty( $post_data['post_date_gmt'] ) ) {
  1367. // We know this is supposed to be GMT, so we're going to slap that Z on there by force.
  1368. $dateCreated = rtrim( $post_data['post_date_gmt']->getIso(), 'Z' ) . 'Z';
  1369. } elseif ( ! empty( $post_data['post_date'] ) ) {
  1370. $dateCreated = $post_data['post_date']->getIso();
  1371. }
  1372. // Default to not flagging the post date to be edited unless it's intentional.
  1373. $post_data['edit_date'] = false;
  1374. if ( ! empty( $dateCreated ) ) {
  1375. $post_data['post_date'] = iso8601_to_datetime( $dateCreated );
  1376. $post_data['post_date_gmt'] = iso8601_to_datetime( $dateCreated, 'gmt' );
  1377. // Flag the post date to be edited.
  1378. $post_data['edit_date'] = true;
  1379. }
  1380. if ( ! isset( $post_data['ID'] ) ) {
  1381. $post_data['ID'] = get_default_post_to_edit( $post_data['post_type'], true )->ID;
  1382. }
  1383. $post_ID = $post_data['ID'];
  1384. if ( 'post' === $post_data['post_type'] ) {
  1385. $error = $this->_toggle_sticky( $post_data, $update );
  1386. if ( $error ) {
  1387. return $error;
  1388. }
  1389. }
  1390. if ( isset( $post_data['post_thumbnail'] ) ) {
  1391. // Empty value deletes, non-empty value adds/updates.
  1392. if ( ! $post_data['post_thumbnail'] ) {
  1393. delete_post_thumbnail( $post_ID );
  1394. } elseif ( ! get_post( absint( $post_data['post_thumbnail'] ) ) ) {
  1395. return new IXR_Error( 404, __( 'Invalid attachment ID.' ) );
  1396. }
  1397. set_post_thumbnail( $post_ID, $post_data['post_thumbnail'] );
  1398. unset( $content_struct['post_thumbnail'] );
  1399. }
  1400. if ( isset( $post_data['custom_fields'] ) ) {
  1401. $this->set_custom_fields( $post_ID, $post_data['custom_fields'] );
  1402. }
  1403. if ( isset( $post_data['terms'] ) || isset( $post_data['terms_names'] ) ) {
  1404. $post_type_taxonomies = get_object_taxonomies( $post_data['post_type'], 'objects' );
  1405. // Accumulate term IDs from terms and terms_names.
  1406. $terms = array();
  1407. // First validate the terms specified by ID.
  1408. if ( isset( $post_data['terms'] ) && is_array( $post_data['terms'] ) ) {
  1409. $taxonomies = array_keys( $post_data['terms'] );
  1410. // Validating term IDs.
  1411. foreach ( $taxonomies as $taxonomy ) {
  1412. if ( ! array_key_exists( $taxonomy, $post_type_taxonomies ) ) {
  1413. return new IXR_Error( 401, __( 'Sorry, one of the given taxonomies is not supported by the post type.' ) );
  1414. }
  1415. if ( ! current_user_can( $post_type_taxonomies[ $taxonomy ]->cap->assign_terms ) ) {
  1416. return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign a term to one of the given taxonomies.' ) );
  1417. }
  1418. $term_ids = $post_data['terms'][ $taxonomy ];
  1419. $terms[ $taxonomy ] = array();
  1420. foreach ( $term_ids as $term_id ) {
  1421. $term = get_term_by( 'id', $term_id, $taxonomy );
  1422. if ( ! $term ) {
  1423. return new IXR_Error( 403, __( 'Invalid term ID.' ) );
  1424. }
  1425. $terms[ $taxonomy ][] = (int) $term_id;
  1426. }
  1427. }
  1428. }
  1429. // Now validate terms specified by name.
  1430. if ( isset( $post_data['terms_names'] ) && is_array( $post_data['terms_names'] ) ) {
  1431. $taxonomies = array_keys( $post_data['terms_names'] );
  1432. foreach ( $taxonomies as $taxonomy ) {
  1433. if ( ! array_key_exists( $taxonomy, $post_type_taxonomies ) ) {
  1434. return new IXR_Error( 401, __( 'Sorry, one of the given taxonomies is not supported by the post type.' ) );
  1435. }
  1436. if ( ! current_user_can( $post_type_taxonomies[ $taxonomy ]->cap->assign_terms ) ) {
  1437. return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign a term to one of the given taxonomies.' ) );
  1438. }
  1439. /*
  1440. * For hierarchical taxonomies, we can't assign a term when multiple terms
  1441. * in the hierarchy share the same name.
  1442. */
  1443. $ambiguous_terms = array();
  1444. if ( is_taxonomy_hierarchical( $taxonomy ) ) {
  1445. $tax_term_names = get_terms(
  1446. array(
  1447. 'taxonomy' => $taxonomy,
  1448. 'fields' => 'names',
  1449. 'hide_empty' => false,
  1450. )
  1451. );
  1452. // Count the number of terms with the same name.
  1453. $tax_term_names_count = array_count_values( $tax_term_names );
  1454. // Filter out non-ambiguous term names.
  1455. $ambiguous_tax_term_counts = array_filter( $tax_term_names_count, array( $this, '_is_greater_than_one' ) );
  1456. $ambiguous_terms = array_keys( $ambiguous_tax_term_counts );
  1457. }
  1458. $term_names = $post_data['terms_names'][ $taxonomy ];
  1459. foreach ( $term_names as $term_name ) {
  1460. if ( in_array( $term_name, $ambiguous_terms, true ) ) {
  1461. return new IXR_Error( 401, __( 'Ambiguous term name used in a hierarchical taxonomy. Please use term ID instead.' ) );
  1462. }
  1463. $term = get_term_by( 'name', $term_name, $taxonomy );
  1464. if ( ! $term ) {
  1465. // Term doesn't exist, so check that the user is allowed to create new terms.
  1466. if ( ! current_user_can( $post_type_taxonomies[ $taxonomy ]->cap->edit_terms ) ) {
  1467. return new IXR_Error( 401, __( 'Sorry, you are not allowed to add a term to one of the given taxonomies.' ) );
  1468. }
  1469. // Create the new term.
  1470. $term_info = wp_insert_term( $term_name, $taxonomy );
  1471. if ( is_wp_error( $term_info ) ) {
  1472. return new IXR_Error( 500, $term_info->get_error_message() );
  1473. }
  1474. $terms[ $taxonomy ][] = (int) $term_info['term_id'];
  1475. } else {
  1476. $terms[ $taxonomy ][] = (int) $term->term_id;
  1477. }
  1478. }
  1479. }
  1480. }
  1481. $post_data['tax_input'] = $terms;
  1482. unset( $post_data['terms'], $post_data['terms_names'] );
  1483. }
  1484. if ( isset( $post_data['post_format'] ) ) {
  1485. $format = set_post_format( $post_ID, $post_data['post_format'] );
  1486. if ( is_wp_error( $format ) ) {
  1487. return new IXR_Error( 500, $format->get_error_message() );
  1488. }
  1489. unset( $post_data['post_format'] );
  1490. }
  1491. // Handle enclosures.
  1492. $enclosure = isset( $post_data['enclosure'] ) ? $post_data['enclosure'] : null;
  1493. $this->add_enclosure_if_new( $post_ID, $enclosure );
  1494. $this->attach_uploads( $post_ID, $post_data['post_content'] );
  1495. /**
  1496. * Filters post data array to be inserted via XML-RPC.
  1497. *
  1498. * @since 3.4.0
  1499. *
  1500. * @param array $post_data Parsed array of post data.
  1501. * @param array $content_struct Post data array.
  1502. */
  1503. $post_data = apply_filters( 'xmlrpc_wp_insert_post_data', $post_data, $content_struct );
  1504. // Remove all null values to allow for using the insert/update post default values for those keys instead.
  1505. $post_data = array_filter(
  1506. $post_data,
  1507. static function ( $value ) {
  1508. return null !== $value;
  1509. }
  1510. );
  1511. $post_ID = $update ? wp_update_post( $post_data, true ) : wp_insert_post( $post_data, true );
  1512. if ( is_wp_error( $post_ID ) ) {
  1513. return new IXR_Error( 500, $post_ID->get_error_message() );
  1514. }
  1515. if ( ! $post_ID ) {
  1516. if ( $update ) {
  1517. return new IXR_Error( 401, __( 'Sorry, the post could not be updated.' ) );
  1518. } else {
  1519. return new IXR_Error( 401, __( 'Sorry, the post could not be created.' ) );
  1520. }
  1521. }
  1522. return (string) $post_ID;
  1523. }
  1524. /**
  1525. * Edit a post for any registered post type.
  1526. *
  1527. * The $content_struct parameter only needs to contain fields that
  1528. * should be changed. All other fields will retain their existing values.
  1529. *
  1530. * @since 3.4.0
  1531. *
  1532. * @param array $args {
  1533. * Method arguments. Note: arguments must be ordered as documented.
  1534. *
  1535. * @type int $0 Blog ID (unused).
  1536. * @type string $1 Username.
  1537. * @type string $2 Password.
  1538. * @type int $3 Post ID.
  1539. * @type array $4 Extra content arguments.
  1540. * }
  1541. * @return true|IXR_Error True on success, IXR_Error on failure.
  1542. */
  1543. public function wp_editPost( $args ) {
  1544. if ( ! $this->minimum_args( $args, 5 ) ) {
  1545. return $this->error;
  1546. }
  1547. $this->escape( $args );
  1548. $username = $args[1];
  1549. $password = $args[2];
  1550. $post_id = (int) $args[3];
  1551. $content_struct = $args[4];
  1552. $user = $this->login( $username, $password );
  1553. if ( ! $user ) {
  1554. return $this->error;
  1555. }
  1556. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1557. do_action( 'xmlrpc_call', 'wp.editPost', $args, $this );
  1558. $post = get_post( $post_id, ARRAY_A );
  1559. if ( empty( $post['ID'] ) ) {
  1560. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  1561. }
  1562. if ( isset( $content_struct['if_not_modified_since'] ) ) {
  1563. // If the post has been modified since the date provided, return an error.
  1564. if ( mysql2date( 'U', $post['post_modified_gmt'] ) > $content_struct['if_not_modified_since']->getTimestamp() ) {
  1565. return new IXR_Error( 409, __( 'There is a revision of this post that is more recent.' ) );
  1566. }
  1567. }
  1568. // Convert the date field back to IXR form.
  1569. $post['post_date'] = $this->_convert_date( $post['post_date'] );
  1570. /*
  1571. * Ignore the existing GMT date if it is empty or a non-GMT date was supplied in $content_struct,
  1572. * since _insert_post() will ignore the non-GMT date if the GMT date is set.
  1573. */
  1574. if ( '0000-00-00 00:00:00' === $post['post_date_gmt'] || isset( $content_struct['post_date'] ) ) {
  1575. unset( $post['post_date_gmt'] );
  1576. } else {
  1577. $post['post_date_gmt'] = $this->_convert_date( $post['post_date_gmt'] );
  1578. }
  1579. /*
  1580. * If the API client did not provide 'post_date', then we must not perpetuate the value that
  1581. * was stored in the database, or it will appear to be an intentional edit. Conveying it here
  1582. * as if it was coming from the API client will cause an otherwise zeroed out 'post_date_gmt'
  1583. * to get set with the value that was originally stored in the database when the draft was created.
  1584. */
  1585. if ( ! isset( $content_struct['post_date'] ) ) {
  1586. unset( $post['post_date'] );
  1587. }
  1588. $this->escape( $post );
  1589. $merged_content_struct = array_merge( $post, $content_struct );
  1590. $retval = $this->_insert_post( $user, $merged_content_struct );
  1591. if ( $retval instanceof IXR_Error ) {
  1592. return $retval;
  1593. }
  1594. return true;
  1595. }
  1596. /**
  1597. * Delete a post for any registered post type.
  1598. *
  1599. * @since 3.4.0
  1600. *
  1601. * @see wp_delete_post()
  1602. *
  1603. * @param array $args {
  1604. * Method arguments. Note: arguments must be ordered as documented.
  1605. *
  1606. * @type int $0 Blog ID (unused).
  1607. * @type string $1 Username.
  1608. * @type string $2 Password.
  1609. * @type int $3 Post ID.
  1610. * }
  1611. * @return true|IXR_Error True on success, IXR_Error instance on failure.
  1612. */
  1613. public function wp_deletePost( $args ) {
  1614. if ( ! $this->minimum_args( $args, 4 ) ) {
  1615. return $this->error;
  1616. }
  1617. $this->escape( $args );
  1618. $username = $args[1];
  1619. $password = $args[2];
  1620. $post_id = (int) $args[3];
  1621. $user = $this->login( $username, $password );
  1622. if ( ! $user ) {
  1623. return $this->error;
  1624. }
  1625. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1626. do_action( 'xmlrpc_call', 'wp.deletePost', $args, $this );
  1627. $post = get_post( $post_id, ARRAY_A );
  1628. if ( empty( $post['ID'] ) ) {
  1629. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  1630. }
  1631. if ( ! current_user_can( 'delete_post', $post_id ) ) {
  1632. return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this post.' ) );
  1633. }
  1634. $result = wp_delete_post( $post_id );
  1635. if ( ! $result ) {
  1636. return new IXR_Error( 500, __( 'Sorry, the post could not be deleted.' ) );
  1637. }
  1638. return true;
  1639. }
  1640. /**
  1641. * Retrieve a post.
  1642. *
  1643. * @since 3.4.0
  1644. *
  1645. * The optional $fields parameter specifies what fields will be included
  1646. * in the response array. This should be a list of field names. 'post_id' will
  1647. * always be included in the response regardless of the value of $fields.
  1648. *
  1649. * Instead of, or in addition to, individual field names, conceptual group
  1650. * names can be used to specify multiple fields. The available conceptual
  1651. * groups are 'post' (all basic fields), 'taxonomies', 'custom_fields',
  1652. * and 'enclosure'.
  1653. *
  1654. * @see get_post()
  1655. *
  1656. * @param array $args {
  1657. * Method arguments. Note: arguments must be ordered as documented.
  1658. *
  1659. * @type int $0 Blog ID (unused).
  1660. * @type string $1 Username.
  1661. * @type string $2 Password.
  1662. * @type int $3 Post ID.
  1663. * @type array $4 Optional. The subset of post type fields to return.
  1664. * }
  1665. * @return array|IXR_Error Array contains (based on $fields parameter):
  1666. * - 'post_id'
  1667. * - 'post_title'
  1668. * - 'post_date'
  1669. * - 'post_date_gmt'
  1670. * - 'post_modified'
  1671. * - 'post_modified_gmt'
  1672. * - 'post_status'
  1673. * - 'post_type'
  1674. * - 'post_name'
  1675. * - 'post_author'
  1676. * - 'post_password'
  1677. * - 'post_excerpt'
  1678. * - 'post_content'
  1679. * - 'link'
  1680. * - 'comment_status'
  1681. * - 'ping_status'
  1682. * - 'sticky'
  1683. * - 'custom_fields'
  1684. * - 'terms'
  1685. * - 'categories'
  1686. * - 'tags'
  1687. * - 'enclosure'
  1688. */
  1689. public function wp_getPost( $args ) {
  1690. if ( ! $this->minimum_args( $args, 4 ) ) {
  1691. return $this->error;
  1692. }
  1693. $this->escape( $args );
  1694. $username = $args[1];
  1695. $password = $args[2];
  1696. $post_id = (int) $args[3];
  1697. if ( isset( $args[4] ) ) {
  1698. $fields = $args[4];
  1699. } else {
  1700. /**
  1701. * Filters the list of post query fields used by the given XML-RPC method.
  1702. *
  1703. * @since 3.4.0
  1704. *
  1705. * @param array $fields Array of post fields. Default array contains 'post', 'terms', and 'custom_fields'.
  1706. * @param string $method Method name.
  1707. */
  1708. $fields = apply_filters( 'xmlrpc_default_post_fields', array( 'post', 'terms', 'custom_fields' ), 'wp.getPost' );
  1709. }
  1710. $user = $this->login( $username, $password );
  1711. if ( ! $user ) {
  1712. return $this->error;
  1713. }
  1714. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1715. do_action( 'xmlrpc_call', 'wp.getPost', $args, $this );
  1716. $post = get_post( $post_id, ARRAY_A );
  1717. if ( empty( $post['ID'] ) ) {
  1718. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  1719. }
  1720. if ( ! current_user_can( 'edit_post', $post_id ) ) {
  1721. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  1722. }
  1723. return $this->_prepare_post( $post, $fields );
  1724. }
  1725. /**
  1726. * Retrieve posts.
  1727. *
  1728. * @since 3.4.0
  1729. *
  1730. * @see wp_get_recent_posts()
  1731. * @see wp_getPost() for more on `$fields`
  1732. * @see get_posts() for more on `$filter` values
  1733. *
  1734. * @param array $args {
  1735. * Method arguments. Note: arguments must be ordered as documented.
  1736. *
  1737. * @type int $0 Blog ID (unused).
  1738. * @type string $1 Username.
  1739. * @type string $2 Password.
  1740. * @type array $3 Optional. Modifies the query used to retrieve posts. Accepts 'post_type',
  1741. * 'post_status', 'number', 'offset', 'orderby', 's', and 'order'.
  1742. * Default empty array.
  1743. * @type array $4 Optional. The subset of post type fields to return in the response array.
  1744. * }
  1745. * @return array|IXR_Error Array contains a collection of posts.
  1746. */
  1747. public function wp_getPosts( $args ) {
  1748. if ( ! $this->minimum_args( $args, 3 ) ) {
  1749. return $this->error;
  1750. }
  1751. $this->escape( $args );
  1752. $username = $args[1];
  1753. $password = $args[2];
  1754. $filter = isset( $args[3] ) ? $args[3] : array();
  1755. if ( isset( $args[4] ) ) {
  1756. $fields = $args[4];
  1757. } else {
  1758. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1759. $fields = apply_filters( 'xmlrpc_default_post_fields', array( 'post', 'terms', 'custom_fields' ), 'wp.getPosts' );
  1760. }
  1761. $user = $this->login( $username, $password );
  1762. if ( ! $user ) {
  1763. return $this->error;
  1764. }
  1765. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1766. do_action( 'xmlrpc_call', 'wp.getPosts', $args, $this );
  1767. $query = array();
  1768. if ( isset( $filter['post_type'] ) ) {
  1769. $post_type = get_post_type_object( $filter['post_type'] );
  1770. if ( ! ( (bool) $post_type ) ) {
  1771. return new IXR_Error( 403, __( 'Invalid post type.' ) );
  1772. }
  1773. } else {
  1774. $post_type = get_post_type_object( 'post' );
  1775. }
  1776. if ( ! current_user_can( $post_type->cap->edit_posts ) ) {
  1777. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts in this post type.' ) );
  1778. }
  1779. $query['post_type'] = $post_type->name;
  1780. if ( isset( $filter['post_status'] ) ) {
  1781. $query['post_status'] = $filter['post_status'];
  1782. }
  1783. if ( isset( $filter['number'] ) ) {
  1784. $query['numberposts'] = absint( $filter['number'] );
  1785. }
  1786. if ( isset( $filter['offset'] ) ) {
  1787. $query['offset'] = absint( $filter['offset'] );
  1788. }
  1789. if ( isset( $filter['orderby'] ) ) {
  1790. $query['orderby'] = $filter['orderby'];
  1791. if ( isset( $filter['order'] ) ) {
  1792. $query['order'] = $filter['order'];
  1793. }
  1794. }
  1795. if ( isset( $filter['s'] ) ) {
  1796. $query['s'] = $filter['s'];
  1797. }
  1798. $posts_list = wp_get_recent_posts( $query );
  1799. if ( ! $posts_list ) {
  1800. return array();
  1801. }
  1802. // Holds all the posts data.
  1803. $struct = array();
  1804. foreach ( $posts_list as $post ) {
  1805. if ( ! current_user_can( 'edit_post', $post['ID'] ) ) {
  1806. continue;
  1807. }
  1808. $struct[] = $this->_prepare_post( $post, $fields );
  1809. }
  1810. return $struct;
  1811. }
  1812. /**
  1813. * Create a new term.
  1814. *
  1815. * @since 3.4.0
  1816. *
  1817. * @see wp_insert_term()
  1818. *
  1819. * @param array $args {
  1820. * Method arguments. Note: arguments must be ordered as documented.
  1821. *
  1822. * @type int $0 Blog ID (unused).
  1823. * @type string $1 Username.
  1824. * @type string $2 Password.
  1825. * @type array $3 Content struct for adding a new term. The struct must contain
  1826. * the term 'name' and 'taxonomy'. Optional accepted values include
  1827. * 'parent', 'description', and 'slug'.
  1828. * }
  1829. * @return int|IXR_Error The term ID on success, or an IXR_Error object on failure.
  1830. */
  1831. public function wp_newTerm( $args ) {
  1832. if ( ! $this->minimum_args( $args, 4 ) ) {
  1833. return $this->error;
  1834. }
  1835. $this->escape( $args );
  1836. $username = $args[1];
  1837. $password = $args[2];
  1838. $content_struct = $args[3];
  1839. $user = $this->login( $username, $password );
  1840. if ( ! $user ) {
  1841. return $this->error;
  1842. }
  1843. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1844. do_action( 'xmlrpc_call', 'wp.newTerm', $args, $this );
  1845. if ( ! taxonomy_exists( $content_struct['taxonomy'] ) ) {
  1846. return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
  1847. }
  1848. $taxonomy = get_taxonomy( $content_struct['taxonomy'] );
  1849. if ( ! current_user_can( $taxonomy->cap->edit_terms ) ) {
  1850. return new IXR_Error( 401, __( 'Sorry, you are not allowed to create terms in this taxonomy.' ) );
  1851. }
  1852. $taxonomy = (array) $taxonomy;
  1853. // Hold the data of the term.
  1854. $term_data = array();
  1855. $term_data['name'] = trim( $content_struct['name'] );
  1856. if ( empty( $term_data['name'] ) ) {
  1857. return new IXR_Error( 403, __( 'The term name cannot be empty.' ) );
  1858. }
  1859. if ( isset( $content_struct['parent'] ) ) {
  1860. if ( ! $taxonomy['hierarchical'] ) {
  1861. return new IXR_Error( 403, __( 'This taxonomy is not hierarchical.' ) );
  1862. }
  1863. $parent_term_id = (int) $content_struct['parent'];
  1864. $parent_term = get_term( $parent_term_id, $taxonomy['name'] );
  1865. if ( is_wp_error( $parent_term ) ) {
  1866. return new IXR_Error( 500, $parent_term->get_error_message() );
  1867. }
  1868. if ( ! $parent_term ) {
  1869. return new IXR_Error( 403, __( 'Parent term does not exist.' ) );
  1870. }
  1871. $term_data['parent'] = $content_struct['parent'];
  1872. }
  1873. if ( isset( $content_struct['description'] ) ) {
  1874. $term_data['description'] = $content_struct['description'];
  1875. }
  1876. if ( isset( $content_struct['slug'] ) ) {
  1877. $term_data['slug'] = $content_struct['slug'];
  1878. }
  1879. $term = wp_insert_term( $term_data['name'], $taxonomy['name'], $term_data );
  1880. if ( is_wp_error( $term ) ) {
  1881. return new IXR_Error( 500, $term->get_error_message() );
  1882. }
  1883. if ( ! $term ) {
  1884. return new IXR_Error( 500, __( 'Sorry, the term could not be created.' ) );
  1885. }
  1886. // Add term meta.
  1887. if ( isset( $content_struct['custom_fields'] ) ) {
  1888. $this->set_term_custom_fields( $term['term_id'], $content_struct['custom_fields'] );
  1889. }
  1890. return (string) $term['term_id'];
  1891. }
  1892. /**
  1893. * Edit a term.
  1894. *
  1895. * @since 3.4.0
  1896. *
  1897. * @see wp_update_term()
  1898. *
  1899. * @param array $args {
  1900. * Method arguments. Note: arguments must be ordered as documented.
  1901. *
  1902. * @type int $0 Blog ID (unused).
  1903. * @type string $1 Username.
  1904. * @type string $2 Password.
  1905. * @type int $3 Term ID.
  1906. * @type array $4 Content struct for editing a term. The struct must contain the
  1907. * term 'taxonomy'. Optional accepted values include 'name', 'parent',
  1908. * 'description', and 'slug'.
  1909. * }
  1910. * @return true|IXR_Error True on success, IXR_Error instance on failure.
  1911. */
  1912. public function wp_editTerm( $args ) {
  1913. if ( ! $this->minimum_args( $args, 5 ) ) {
  1914. return $this->error;
  1915. }
  1916. $this->escape( $args );
  1917. $username = $args[1];
  1918. $password = $args[2];
  1919. $term_id = (int) $args[3];
  1920. $content_struct = $args[4];
  1921. $user = $this->login( $username, $password );
  1922. if ( ! $user ) {
  1923. return $this->error;
  1924. }
  1925. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1926. do_action( 'xmlrpc_call', 'wp.editTerm', $args, $this );
  1927. if ( ! taxonomy_exists( $content_struct['taxonomy'] ) ) {
  1928. return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
  1929. }
  1930. $taxonomy = get_taxonomy( $content_struct['taxonomy'] );
  1931. $taxonomy = (array) $taxonomy;
  1932. // Hold the data of the term.
  1933. $term_data = array();
  1934. $term = get_term( $term_id, $content_struct['taxonomy'] );
  1935. if ( is_wp_error( $term ) ) {
  1936. return new IXR_Error( 500, $term->get_error_message() );
  1937. }
  1938. if ( ! $term ) {
  1939. return new IXR_Error( 404, __( 'Invalid term ID.' ) );
  1940. }
  1941. if ( ! current_user_can( 'edit_term', $term_id ) ) {
  1942. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this term.' ) );
  1943. }
  1944. if ( isset( $content_struct['name'] ) ) {
  1945. $term_data['name'] = trim( $content_struct['name'] );
  1946. if ( empty( $term_data['name'] ) ) {
  1947. return new IXR_Error( 403, __( 'The term name cannot be empty.' ) );
  1948. }
  1949. }
  1950. if ( ! empty( $content_struct['parent'] ) ) {
  1951. if ( ! $taxonomy['hierarchical'] ) {
  1952. return new IXR_Error( 403, __( 'Cannot set parent term, taxonomy is not hierarchical.' ) );
  1953. }
  1954. $parent_term_id = (int) $content_struct['parent'];
  1955. $parent_term = get_term( $parent_term_id, $taxonomy['name'] );
  1956. if ( is_wp_error( $parent_term ) ) {
  1957. return new IXR_Error( 500, $parent_term->get_error_message() );
  1958. }
  1959. if ( ! $parent_term ) {
  1960. return new IXR_Error( 403, __( 'Parent term does not exist.' ) );
  1961. }
  1962. $term_data['parent'] = $content_struct['parent'];
  1963. }
  1964. if ( isset( $content_struct['description'] ) ) {
  1965. $term_data['description'] = $content_struct['description'];
  1966. }
  1967. if ( isset( $content_struct['slug'] ) ) {
  1968. $term_data['slug'] = $content_struct['slug'];
  1969. }
  1970. $term = wp_update_term( $term_id, $taxonomy['name'], $term_data );
  1971. if ( is_wp_error( $term ) ) {
  1972. return new IXR_Error( 500, $term->get_error_message() );
  1973. }
  1974. if ( ! $term ) {
  1975. return new IXR_Error( 500, __( 'Sorry, editing the term failed.' ) );
  1976. }
  1977. // Update term meta.
  1978. if ( isset( $content_struct['custom_fields'] ) ) {
  1979. $this->set_term_custom_fields( $term_id, $content_struct['custom_fields'] );
  1980. }
  1981. return true;
  1982. }
  1983. /**
  1984. * Delete a term.
  1985. *
  1986. * @since 3.4.0
  1987. *
  1988. * @see wp_delete_term()
  1989. *
  1990. * @param array $args {
  1991. * Method arguments. Note: arguments must be ordered as documented.
  1992. *
  1993. * @type int $0 Blog ID (unused).
  1994. * @type string $1 Username.
  1995. * @type string $2 Password.
  1996. * @type string $3 Taxonomy name.
  1997. * @type int $4 Term ID.
  1998. * }
  1999. * @return true|IXR_Error True on success, IXR_Error instance on failure.
  2000. */
  2001. public function wp_deleteTerm( $args ) {
  2002. if ( ! $this->minimum_args( $args, 5 ) ) {
  2003. return $this->error;
  2004. }
  2005. $this->escape( $args );
  2006. $username = $args[1];
  2007. $password = $args[2];
  2008. $taxonomy = $args[3];
  2009. $term_id = (int) $args[4];
  2010. $user = $this->login( $username, $password );
  2011. if ( ! $user ) {
  2012. return $this->error;
  2013. }
  2014. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2015. do_action( 'xmlrpc_call', 'wp.deleteTerm', $args, $this );
  2016. if ( ! taxonomy_exists( $taxonomy ) ) {
  2017. return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
  2018. }
  2019. $taxonomy = get_taxonomy( $taxonomy );
  2020. $term = get_term( $term_id, $taxonomy->name );
  2021. if ( is_wp_error( $term ) ) {
  2022. return new IXR_Error( 500, $term->get_error_message() );
  2023. }
  2024. if ( ! $term ) {
  2025. return new IXR_Error( 404, __( 'Invalid term ID.' ) );
  2026. }
  2027. if ( ! current_user_can( 'delete_term', $term_id ) ) {
  2028. return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this term.' ) );
  2029. }
  2030. $result = wp_delete_term( $term_id, $taxonomy->name );
  2031. if ( is_wp_error( $result ) ) {
  2032. return new IXR_Error( 500, $term->get_error_message() );
  2033. }
  2034. if ( ! $result ) {
  2035. return new IXR_Error( 500, __( 'Sorry, deleting the term failed.' ) );
  2036. }
  2037. return $result;
  2038. }
  2039. /**
  2040. * Retrieve a term.
  2041. *
  2042. * @since 3.4.0
  2043. *
  2044. * @see get_term()
  2045. *
  2046. * @param array $args {
  2047. * Method arguments. Note: arguments must be ordered as documented.
  2048. *
  2049. * @type int $0 Blog ID (unused).
  2050. * @type string $1 Username.
  2051. * @type string $2 Password.
  2052. * @type string $3 Taxonomy name.
  2053. * @type int $4 Term ID.
  2054. * }
  2055. * @return array|IXR_Error IXR_Error on failure, array on success, containing:
  2056. * - 'term_id'
  2057. * - 'name'
  2058. * - 'slug'
  2059. * - 'term_group'
  2060. * - 'term_taxonomy_id'
  2061. * - 'taxonomy'
  2062. * - 'description'
  2063. * - 'parent'
  2064. * - 'count'
  2065. */
  2066. public function wp_getTerm( $args ) {
  2067. if ( ! $this->minimum_args( $args, 5 ) ) {
  2068. return $this->error;
  2069. }
  2070. $this->escape( $args );
  2071. $username = $args[1];
  2072. $password = $args[2];
  2073. $taxonomy = $args[3];
  2074. $term_id = (int) $args[4];
  2075. $user = $this->login( $username, $password );
  2076. if ( ! $user ) {
  2077. return $this->error;
  2078. }
  2079. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2080. do_action( 'xmlrpc_call', 'wp.getTerm', $args, $this );
  2081. if ( ! taxonomy_exists( $taxonomy ) ) {
  2082. return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
  2083. }
  2084. $taxonomy = get_taxonomy( $taxonomy );
  2085. $term = get_term( $term_id, $taxonomy->name, ARRAY_A );
  2086. if ( is_wp_error( $term ) ) {
  2087. return new IXR_Error( 500, $term->get_error_message() );
  2088. }
  2089. if ( ! $term ) {
  2090. return new IXR_Error( 404, __( 'Invalid term ID.' ) );
  2091. }
  2092. if ( ! current_user_can( 'assign_term', $term_id ) ) {
  2093. return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign this term.' ) );
  2094. }
  2095. return $this->_prepare_term( $term );
  2096. }
  2097. /**
  2098. * Retrieve all terms for a taxonomy.
  2099. *
  2100. * @since 3.4.0
  2101. *
  2102. * The optional $filter parameter modifies the query used to retrieve terms.
  2103. * Accepted keys are 'number', 'offset', 'orderby', 'order', 'hide_empty', and 'search'.
  2104. *
  2105. * @see get_terms()
  2106. *
  2107. * @param array $args {
  2108. * Method arguments. Note: arguments must be ordered as documented.
  2109. *
  2110. * @type int $0 Blog ID (unused).
  2111. * @type string $1 Username.
  2112. * @type string $2 Password.
  2113. * @type string $3 Taxonomy name.
  2114. * @type array $4 Optional. Modifies the query used to retrieve posts. Accepts 'number',
  2115. * 'offset', 'orderby', 'order', 'hide_empty', and 'search'. Default empty array.
  2116. * }
  2117. * @return array|IXR_Error An associative array of terms data on success, IXR_Error instance otherwise.
  2118. */
  2119. public function wp_getTerms( $args ) {
  2120. if ( ! $this->minimum_args( $args, 4 ) ) {
  2121. return $this->error;
  2122. }
  2123. $this->escape( $args );
  2124. $username = $args[1];
  2125. $password = $args[2];
  2126. $taxonomy = $args[3];
  2127. $filter = isset( $args[4] ) ? $args[4] : array();
  2128. $user = $this->login( $username, $password );
  2129. if ( ! $user ) {
  2130. return $this->error;
  2131. }
  2132. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2133. do_action( 'xmlrpc_call', 'wp.getTerms', $args, $this );
  2134. if ( ! taxonomy_exists( $taxonomy ) ) {
  2135. return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
  2136. }
  2137. $taxonomy = get_taxonomy( $taxonomy );
  2138. if ( ! current_user_can( $taxonomy->cap->assign_terms ) ) {
  2139. return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign terms in this taxonomy.' ) );
  2140. }
  2141. $query = array( 'taxonomy' => $taxonomy->name );
  2142. if ( isset( $filter['number'] ) ) {
  2143. $query['number'] = absint( $filter['number'] );
  2144. }
  2145. if ( isset( $filter['offset'] ) ) {
  2146. $query['offset'] = absint( $filter['offset'] );
  2147. }
  2148. if ( isset( $filter['orderby'] ) ) {
  2149. $query['orderby'] = $filter['orderby'];
  2150. if ( isset( $filter['order'] ) ) {
  2151. $query['order'] = $filter['order'];
  2152. }
  2153. }
  2154. if ( isset( $filter['hide_empty'] ) ) {
  2155. $query['hide_empty'] = $filter['hide_empty'];
  2156. } else {
  2157. $query['get'] = 'all';
  2158. }
  2159. if ( isset( $filter['search'] ) ) {
  2160. $query['search'] = $filter['search'];
  2161. }
  2162. $terms = get_terms( $query );
  2163. if ( is_wp_error( $terms ) ) {
  2164. return new IXR_Error( 500, $terms->get_error_message() );
  2165. }
  2166. $struct = array();
  2167. foreach ( $terms as $term ) {
  2168. $struct[] = $this->_prepare_term( $term );
  2169. }
  2170. return $struct;
  2171. }
  2172. /**
  2173. * Retrieve a taxonomy.
  2174. *
  2175. * @since 3.4.0
  2176. *
  2177. * @see get_taxonomy()
  2178. *
  2179. * @param array $args {
  2180. * Method arguments. Note: arguments must be ordered as documented.
  2181. *
  2182. * @type int $0 Blog ID (unused).
  2183. * @type string $1 Username.
  2184. * @type string $2 Password.
  2185. * @type string $3 Taxonomy name.
  2186. * @type array $4 Optional. Array of taxonomy fields to limit to in the return.
  2187. * Accepts 'labels', 'cap', 'menu', and 'object_type'.
  2188. * Default empty array.
  2189. * }
  2190. * @return array|IXR_Error An array of taxonomy data on success, IXR_Error instance otherwise.
  2191. */
  2192. public function wp_getTaxonomy( $args ) {
  2193. if ( ! $this->minimum_args( $args, 4 ) ) {
  2194. return $this->error;
  2195. }
  2196. $this->escape( $args );
  2197. $username = $args[1];
  2198. $password = $args[2];
  2199. $taxonomy = $args[3];
  2200. if ( isset( $args[4] ) ) {
  2201. $fields = $args[4];
  2202. } else {
  2203. /**
  2204. * Filters the taxonomy query fields used by the given XML-RPC method.
  2205. *
  2206. * @since 3.4.0
  2207. *
  2208. * @param array $fields An array of taxonomy fields to retrieve.
  2209. * @param string $method The method name.
  2210. */
  2211. $fields = apply_filters( 'xmlrpc_default_taxonomy_fields', array( 'labels', 'cap', 'object_type' ), 'wp.getTaxonomy' );
  2212. }
  2213. $user = $this->login( $username, $password );
  2214. if ( ! $user ) {
  2215. return $this->error;
  2216. }
  2217. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2218. do_action( 'xmlrpc_call', 'wp.getTaxonomy', $args, $this );
  2219. if ( ! taxonomy_exists( $taxonomy ) ) {
  2220. return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
  2221. }
  2222. $taxonomy = get_taxonomy( $taxonomy );
  2223. if ( ! current_user_can( $taxonomy->cap->assign_terms ) ) {
  2224. return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign terms in this taxonomy.' ) );
  2225. }
  2226. return $this->_prepare_taxonomy( $taxonomy, $fields );
  2227. }
  2228. /**
  2229. * Retrieve all taxonomies.
  2230. *
  2231. * @since 3.4.0
  2232. *
  2233. * @see get_taxonomies()
  2234. *
  2235. * @param array $args {
  2236. * Method arguments. Note: arguments must be ordered as documented.
  2237. *
  2238. * @type int $0 Blog ID (unused).
  2239. * @type string $1 Username.
  2240. * @type string $2 Password.
  2241. * @type array $3 Optional. An array of arguments for retrieving taxonomies.
  2242. * @type array $4 Optional. The subset of taxonomy fields to return.
  2243. * }
  2244. * @return array|IXR_Error An associative array of taxonomy data with returned fields determined
  2245. * by `$fields`, or an IXR_Error instance on failure.
  2246. */
  2247. public function wp_getTaxonomies( $args ) {
  2248. if ( ! $this->minimum_args( $args, 3 ) ) {
  2249. return $this->error;
  2250. }
  2251. $this->escape( $args );
  2252. $username = $args[1];
  2253. $password = $args[2];
  2254. $filter = isset( $args[3] ) ? $args[3] : array( 'public' => true );
  2255. if ( isset( $args[4] ) ) {
  2256. $fields = $args[4];
  2257. } else {
  2258. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2259. $fields = apply_filters( 'xmlrpc_default_taxonomy_fields', array( 'labels', 'cap', 'object_type' ), 'wp.getTaxonomies' );
  2260. }
  2261. $user = $this->login( $username, $password );
  2262. if ( ! $user ) {
  2263. return $this->error;
  2264. }
  2265. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2266. do_action( 'xmlrpc_call', 'wp.getTaxonomies', $args, $this );
  2267. $taxonomies = get_taxonomies( $filter, 'objects' );
  2268. // Holds all the taxonomy data.
  2269. $struct = array();
  2270. foreach ( $taxonomies as $taxonomy ) {
  2271. // Capability check for post types.
  2272. if ( ! current_user_can( $taxonomy->cap->assign_terms ) ) {
  2273. continue;
  2274. }
  2275. $struct[] = $this->_prepare_taxonomy( $taxonomy, $fields );
  2276. }
  2277. return $struct;
  2278. }
  2279. /**
  2280. * Retrieve a user.
  2281. *
  2282. * The optional $fields parameter specifies what fields will be included
  2283. * in the response array. This should be a list of field names. 'user_id' will
  2284. * always be included in the response regardless of the value of $fields.
  2285. *
  2286. * Instead of, or in addition to, individual field names, conceptual group
  2287. * names can be used to specify multiple fields. The available conceptual
  2288. * groups are 'basic' and 'all'.
  2289. *
  2290. * @uses get_userdata()
  2291. *
  2292. * @param array $args {
  2293. * Method arguments. Note: arguments must be ordered as documented.
  2294. *
  2295. * @type int $0 Blog ID (unused).
  2296. * @type string $1 Username.
  2297. * @type string $2 Password.
  2298. * @type int $3 User ID.
  2299. * @type array $4 Optional. Array of fields to return.
  2300. * }
  2301. * @return array|IXR_Error Array contains (based on $fields parameter):
  2302. * - 'user_id'
  2303. * - 'username'
  2304. * - 'first_name'
  2305. * - 'last_name'
  2306. * - 'registered'
  2307. * - 'bio'
  2308. * - 'email'
  2309. * - 'nickname'
  2310. * - 'nicename'
  2311. * - 'url'
  2312. * - 'display_name'
  2313. * - 'roles'
  2314. */
  2315. public function wp_getUser( $args ) {
  2316. if ( ! $this->minimum_args( $args, 4 ) ) {
  2317. return $this->error;
  2318. }
  2319. $this->escape( $args );
  2320. $username = $args[1];
  2321. $password = $args[2];
  2322. $user_id = (int) $args[3];
  2323. if ( isset( $args[4] ) ) {
  2324. $fields = $args[4];
  2325. } else {
  2326. /**
  2327. * Filters the default user query fields used by the given XML-RPC method.
  2328. *
  2329. * @since 3.5.0
  2330. *
  2331. * @param array $fields User query fields for given method. Default 'all'.
  2332. * @param string $method The method name.
  2333. */
  2334. $fields = apply_filters( 'xmlrpc_default_user_fields', array( 'all' ), 'wp.getUser' );
  2335. }
  2336. $user = $this->login( $username, $password );
  2337. if ( ! $user ) {
  2338. return $this->error;
  2339. }
  2340. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2341. do_action( 'xmlrpc_call', 'wp.getUser', $args, $this );
  2342. if ( ! current_user_can( 'edit_user', $user_id ) ) {
  2343. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this user.' ) );
  2344. }
  2345. $user_data = get_userdata( $user_id );
  2346. if ( ! $user_data ) {
  2347. return new IXR_Error( 404, __( 'Invalid user ID.' ) );
  2348. }
  2349. return $this->_prepare_user( $user_data, $fields );
  2350. }
  2351. /**
  2352. * Retrieve users.
  2353. *
  2354. * The optional $filter parameter modifies the query used to retrieve users.
  2355. * Accepted keys are 'number' (default: 50), 'offset' (default: 0), 'role',
  2356. * 'who', 'orderby', and 'order'.
  2357. *
  2358. * The optional $fields parameter specifies what fields will be included
  2359. * in the response array.
  2360. *
  2361. * @uses get_users()
  2362. * @see wp_getUser() for more on $fields and return values
  2363. *
  2364. * @param array $args {
  2365. * Method arguments. Note: arguments must be ordered as documented.
  2366. *
  2367. * @type int $0 Blog ID (unused).
  2368. * @type string $1 Username.
  2369. * @type string $2 Password.
  2370. * @type array $3 Optional. Arguments for the user query.
  2371. * @type array $4 Optional. Fields to return.
  2372. * }
  2373. * @return array|IXR_Error users data
  2374. */
  2375. public function wp_getUsers( $args ) {
  2376. if ( ! $this->minimum_args( $args, 3 ) ) {
  2377. return $this->error;
  2378. }
  2379. $this->escape( $args );
  2380. $username = $args[1];
  2381. $password = $args[2];
  2382. $filter = isset( $args[3] ) ? $args[3] : array();
  2383. if ( isset( $args[4] ) ) {
  2384. $fields = $args[4];
  2385. } else {
  2386. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2387. $fields = apply_filters( 'xmlrpc_default_user_fields', array( 'all' ), 'wp.getUsers' );
  2388. }
  2389. $user = $this->login( $username, $password );
  2390. if ( ! $user ) {
  2391. return $this->error;
  2392. }
  2393. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2394. do_action( 'xmlrpc_call', 'wp.getUsers', $args, $this );
  2395. if ( ! current_user_can( 'list_users' ) ) {
  2396. return new IXR_Error( 401, __( 'Sorry, you are not allowed to list users.' ) );
  2397. }
  2398. $query = array( 'fields' => 'all_with_meta' );
  2399. $query['number'] = ( isset( $filter['number'] ) ) ? absint( $filter['number'] ) : 50;
  2400. $query['offset'] = ( isset( $filter['offset'] ) ) ? absint( $filter['offset'] ) : 0;
  2401. if ( isset( $filter['orderby'] ) ) {
  2402. $query['orderby'] = $filter['orderby'];
  2403. if ( isset( $filter['order'] ) ) {
  2404. $query['order'] = $filter['order'];
  2405. }
  2406. }
  2407. if ( isset( $filter['role'] ) ) {
  2408. if ( get_role( $filter['role'] ) === null ) {
  2409. return new IXR_Error( 403, __( 'Invalid role.' ) );
  2410. }
  2411. $query['role'] = $filter['role'];
  2412. }
  2413. if ( isset( $filter['who'] ) ) {
  2414. $query['who'] = $filter['who'];
  2415. }
  2416. $users = get_users( $query );
  2417. $_users = array();
  2418. foreach ( $users as $user_data ) {
  2419. if ( current_user_can( 'edit_user', $user_data->ID ) ) {
  2420. $_users[] = $this->_prepare_user( $user_data, $fields );
  2421. }
  2422. }
  2423. return $_users;
  2424. }
  2425. /**
  2426. * Retrieve information about the requesting user.
  2427. *
  2428. * @uses get_userdata()
  2429. *
  2430. * @param array $args {
  2431. * Method arguments. Note: arguments must be ordered as documented.
  2432. *
  2433. * @type int $0 Blog ID (unused).
  2434. * @type string $1 Username
  2435. * @type string $2 Password
  2436. * @type array $3 Optional. Fields to return.
  2437. * }
  2438. * @return array|IXR_Error (@see wp_getUser)
  2439. */
  2440. public function wp_getProfile( $args ) {
  2441. if ( ! $this->minimum_args( $args, 3 ) ) {
  2442. return $this->error;
  2443. }
  2444. $this->escape( $args );
  2445. $username = $args[1];
  2446. $password = $args[2];
  2447. if ( isset( $args[3] ) ) {
  2448. $fields = $args[3];
  2449. } else {
  2450. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2451. $fields = apply_filters( 'xmlrpc_default_user_fields', array( 'all' ), 'wp.getProfile' );
  2452. }
  2453. $user = $this->login( $username, $password );
  2454. if ( ! $user ) {
  2455. return $this->error;
  2456. }
  2457. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2458. do_action( 'xmlrpc_call', 'wp.getProfile', $args, $this );
  2459. if ( ! current_user_can( 'edit_user', $user->ID ) ) {
  2460. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit your profile.' ) );
  2461. }
  2462. $user_data = get_userdata( $user->ID );
  2463. return $this->_prepare_user( $user_data, $fields );
  2464. }
  2465. /**
  2466. * Edit user's profile.
  2467. *
  2468. * @uses wp_update_user()
  2469. *
  2470. * @param array $args {
  2471. * Method arguments. Note: arguments must be ordered as documented.
  2472. *
  2473. * @type int $0 Blog ID (unused).
  2474. * @type string $1 Username.
  2475. * @type string $2 Password.
  2476. * @type array $3 Content struct. It can optionally contain:
  2477. * - 'first_name'
  2478. * - 'last_name'
  2479. * - 'website'
  2480. * - 'display_name'
  2481. * - 'nickname'
  2482. * - 'nicename'
  2483. * - 'bio'
  2484. * }
  2485. * @return true|IXR_Error True, on success.
  2486. */
  2487. public function wp_editProfile( $args ) {
  2488. if ( ! $this->minimum_args( $args, 4 ) ) {
  2489. return $this->error;
  2490. }
  2491. $this->escape( $args );
  2492. $username = $args[1];
  2493. $password = $args[2];
  2494. $content_struct = $args[3];
  2495. $user = $this->login( $username, $password );
  2496. if ( ! $user ) {
  2497. return $this->error;
  2498. }
  2499. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2500. do_action( 'xmlrpc_call', 'wp.editProfile', $args, $this );
  2501. if ( ! current_user_can( 'edit_user', $user->ID ) ) {
  2502. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit your profile.' ) );
  2503. }
  2504. // Holds data of the user.
  2505. $user_data = array();
  2506. $user_data['ID'] = $user->ID;
  2507. // Only set the user details if they were given.
  2508. if ( isset( $content_struct['first_name'] ) ) {
  2509. $user_data['first_name'] = $content_struct['first_name'];
  2510. }
  2511. if ( isset( $content_struct['last_name'] ) ) {
  2512. $user_data['last_name'] = $content_struct['last_name'];
  2513. }
  2514. if ( isset( $content_struct['url'] ) ) {
  2515. $user_data['user_url'] = $content_struct['url'];
  2516. }
  2517. if ( isset( $content_struct['display_name'] ) ) {
  2518. $user_data['display_name'] = $content_struct['display_name'];
  2519. }
  2520. if ( isset( $content_struct['nickname'] ) ) {
  2521. $user_data['nickname'] = $content_struct['nickname'];
  2522. }
  2523. if ( isset( $content_struct['nicename'] ) ) {
  2524. $user_data['user_nicename'] = $content_struct['nicename'];
  2525. }
  2526. if ( isset( $content_struct['bio'] ) ) {
  2527. $user_data['description'] = $content_struct['bio'];
  2528. }
  2529. $result = wp_update_user( $user_data );
  2530. if ( is_wp_error( $result ) ) {
  2531. return new IXR_Error( 500, $result->get_error_message() );
  2532. }
  2533. if ( ! $result ) {
  2534. return new IXR_Error( 500, __( 'Sorry, the user could not be updated.' ) );
  2535. }
  2536. return true;
  2537. }
  2538. /**
  2539. * Retrieve page.
  2540. *
  2541. * @since 2.2.0
  2542. *
  2543. * @param array $args {
  2544. * Method arguments. Note: arguments must be ordered as documented.
  2545. *
  2546. * @type int $0 Blog ID (unused).
  2547. * @type int $1 Page ID.
  2548. * @type string $2 Username.
  2549. * @type string $3 Password.
  2550. * }
  2551. * @return array|IXR_Error
  2552. */
  2553. public function wp_getPage( $args ) {
  2554. $this->escape( $args );
  2555. $page_id = (int) $args[1];
  2556. $username = $args[2];
  2557. $password = $args[3];
  2558. $user = $this->login( $username, $password );
  2559. if ( ! $user ) {
  2560. return $this->error;
  2561. }
  2562. $page = get_post( $page_id );
  2563. if ( ! $page ) {
  2564. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  2565. }
  2566. if ( ! current_user_can( 'edit_page', $page_id ) ) {
  2567. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this page.' ) );
  2568. }
  2569. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2570. do_action( 'xmlrpc_call', 'wp.getPage', $args, $this );
  2571. // If we found the page then format the data.
  2572. if ( $page->ID && ( 'page' === $page->post_type ) ) {
  2573. return $this->_prepare_page( $page );
  2574. } else {
  2575. // If the page doesn't exist, indicate that.
  2576. return new IXR_Error( 404, __( 'Sorry, no such page.' ) );
  2577. }
  2578. }
  2579. /**
  2580. * Retrieve Pages.
  2581. *
  2582. * @since 2.2.0
  2583. *
  2584. * @param array $args {
  2585. * Method arguments. Note: arguments must be ordered as documented.
  2586. *
  2587. * @type int $0 Blog ID (unused).
  2588. * @type string $1 Username.
  2589. * @type string $2 Password.
  2590. * @type int $3 Optional. Number of pages. Default 10.
  2591. * }
  2592. * @return array|IXR_Error
  2593. */
  2594. public function wp_getPages( $args ) {
  2595. $this->escape( $args );
  2596. $username = $args[1];
  2597. $password = $args[2];
  2598. $num_pages = isset( $args[3] ) ? (int) $args[3] : 10;
  2599. $user = $this->login( $username, $password );
  2600. if ( ! $user ) {
  2601. return $this->error;
  2602. }
  2603. if ( ! current_user_can( 'edit_pages' ) ) {
  2604. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit pages.' ) );
  2605. }
  2606. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2607. do_action( 'xmlrpc_call', 'wp.getPages', $args, $this );
  2608. $pages = get_posts(
  2609. array(
  2610. 'post_type' => 'page',
  2611. 'post_status' => 'any',
  2612. 'numberposts' => $num_pages,
  2613. )
  2614. );
  2615. $num_pages = count( $pages );
  2616. // If we have pages, put together their info.
  2617. if ( $num_pages >= 1 ) {
  2618. $pages_struct = array();
  2619. foreach ( $pages as $page ) {
  2620. if ( current_user_can( 'edit_page', $page->ID ) ) {
  2621. $pages_struct[] = $this->_prepare_page( $page );
  2622. }
  2623. }
  2624. return $pages_struct;
  2625. }
  2626. return array();
  2627. }
  2628. /**
  2629. * Create new page.
  2630. *
  2631. * @since 2.2.0
  2632. *
  2633. * @see wp_xmlrpc_server::mw_newPost()
  2634. *
  2635. * @param array $args {
  2636. * Method arguments. Note: arguments must be ordered as documented.
  2637. *
  2638. * @type int $0 Blog ID (unused).
  2639. * @type string $1 Username.
  2640. * @type string $2 Password.
  2641. * @type array $3 Content struct.
  2642. * }
  2643. * @return int|IXR_Error
  2644. */
  2645. public function wp_newPage( $args ) {
  2646. // Items not escaped here will be escaped in wp_newPost().
  2647. $username = $this->escape( $args[1] );
  2648. $password = $this->escape( $args[2] );
  2649. $user = $this->login( $username, $password );
  2650. if ( ! $user ) {
  2651. return $this->error;
  2652. }
  2653. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2654. do_action( 'xmlrpc_call', 'wp.newPage', $args, $this );
  2655. // Mark this as content for a page.
  2656. $args[3]['post_type'] = 'page';
  2657. // Let mw_newPost() do all of the heavy lifting.
  2658. return $this->mw_newPost( $args );
  2659. }
  2660. /**
  2661. * Delete page.
  2662. *
  2663. * @since 2.2.0
  2664. *
  2665. * @param array $args {
  2666. * Method arguments. Note: arguments must be ordered as documented.
  2667. *
  2668. * @type int $0 Blog ID (unused).
  2669. * @type string $1 Username.
  2670. * @type string $2 Password.
  2671. * @type int $3 Page ID.
  2672. * }
  2673. * @return true|IXR_Error True, if success.
  2674. */
  2675. public function wp_deletePage( $args ) {
  2676. $this->escape( $args );
  2677. $username = $args[1];
  2678. $password = $args[2];
  2679. $page_id = (int) $args[3];
  2680. $user = $this->login( $username, $password );
  2681. if ( ! $user ) {
  2682. return $this->error;
  2683. }
  2684. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2685. do_action( 'xmlrpc_call', 'wp.deletePage', $args, $this );
  2686. // Get the current page based on the 'page_id' and
  2687. // make sure it is a page and not a post.
  2688. $actual_page = get_post( $page_id, ARRAY_A );
  2689. if ( ! $actual_page || ( 'page' !== $actual_page['post_type'] ) ) {
  2690. return new IXR_Error( 404, __( 'Sorry, no such page.' ) );
  2691. }
  2692. // Make sure the user can delete pages.
  2693. if ( ! current_user_can( 'delete_page', $page_id ) ) {
  2694. return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this page.' ) );
  2695. }
  2696. // Attempt to delete the page.
  2697. $result = wp_delete_post( $page_id );
  2698. if ( ! $result ) {
  2699. return new IXR_Error( 500, __( 'Failed to delete the page.' ) );
  2700. }
  2701. /**
  2702. * Fires after a page has been successfully deleted via XML-RPC.
  2703. *
  2704. * @since 3.4.0
  2705. *
  2706. * @param int $page_id ID of the deleted page.
  2707. * @param array $args An array of arguments to delete the page.
  2708. */
  2709. do_action( 'xmlrpc_call_success_wp_deletePage', $page_id, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  2710. return true;
  2711. }
  2712. /**
  2713. * Edit page.
  2714. *
  2715. * @since 2.2.0
  2716. *
  2717. * @param array $args {
  2718. * Method arguments. Note: arguments must be ordered as documented.
  2719. *
  2720. * @type int $0 Blog ID (unused).
  2721. * @type int $1 Page ID.
  2722. * @type string $2 Username.
  2723. * @type string $3 Password.
  2724. * @type string $4 Content.
  2725. * @type int $5 Publish flag. 0 for draft, 1 for publish.
  2726. * }
  2727. * @return array|IXR_Error
  2728. */
  2729. public function wp_editPage( $args ) {
  2730. // Items will be escaped in mw_editPost().
  2731. $page_id = (int) $args[1];
  2732. $username = $args[2];
  2733. $password = $args[3];
  2734. $content = $args[4];
  2735. $publish = $args[5];
  2736. $escaped_username = $this->escape( $username );
  2737. $escaped_password = $this->escape( $password );
  2738. $user = $this->login( $escaped_username, $escaped_password );
  2739. if ( ! $user ) {
  2740. return $this->error;
  2741. }
  2742. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2743. do_action( 'xmlrpc_call', 'wp.editPage', $args, $this );
  2744. // Get the page data and make sure it is a page.
  2745. $actual_page = get_post( $page_id, ARRAY_A );
  2746. if ( ! $actual_page || ( 'page' !== $actual_page['post_type'] ) ) {
  2747. return new IXR_Error( 404, __( 'Sorry, no such page.' ) );
  2748. }
  2749. // Make sure the user is allowed to edit pages.
  2750. if ( ! current_user_can( 'edit_page', $page_id ) ) {
  2751. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this page.' ) );
  2752. }
  2753. // Mark this as content for a page.
  2754. $content['post_type'] = 'page';
  2755. // Arrange args in the way mw_editPost() understands.
  2756. $args = array(
  2757. $page_id,
  2758. $username,
  2759. $password,
  2760. $content,
  2761. $publish,
  2762. );
  2763. // Let mw_editPost() do all of the heavy lifting.
  2764. return $this->mw_editPost( $args );
  2765. }
  2766. /**
  2767. * Retrieve page list.
  2768. *
  2769. * @since 2.2.0
  2770. *
  2771. * @global wpdb $wpdb WordPress database abstraction object.
  2772. *
  2773. * @param array $args {
  2774. * Method arguments. Note: arguments must be ordered as documented.
  2775. *
  2776. * @type int $0 Blog ID (unused).
  2777. * @type string $1 Username.
  2778. * @type string $2 Password.
  2779. * }
  2780. * @return array|IXR_Error
  2781. */
  2782. public function wp_getPageList( $args ) {
  2783. global $wpdb;
  2784. $this->escape( $args );
  2785. $username = $args[1];
  2786. $password = $args[2];
  2787. $user = $this->login( $username, $password );
  2788. if ( ! $user ) {
  2789. return $this->error;
  2790. }
  2791. if ( ! current_user_can( 'edit_pages' ) ) {
  2792. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit pages.' ) );
  2793. }
  2794. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2795. do_action( 'xmlrpc_call', 'wp.getPageList', $args, $this );
  2796. // Get list of page IDs and titles.
  2797. $page_list = $wpdb->get_results(
  2798. "
  2799. SELECT ID page_id,
  2800. post_title page_title,
  2801. post_parent page_parent_id,
  2802. post_date_gmt,
  2803. post_date,
  2804. post_status
  2805. FROM {$wpdb->posts}
  2806. WHERE post_type = 'page'
  2807. ORDER BY ID
  2808. "
  2809. );
  2810. // The date needs to be formatted properly.
  2811. $num_pages = count( $page_list );
  2812. for ( $i = 0; $i < $num_pages; $i++ ) {
  2813. $page_list[ $i ]->dateCreated = $this->_convert_date( $page_list[ $i ]->post_date );
  2814. $page_list[ $i ]->date_created_gmt = $this->_convert_date_gmt( $page_list[ $i ]->post_date_gmt, $page_list[ $i ]->post_date );
  2815. unset( $page_list[ $i ]->post_date_gmt );
  2816. unset( $page_list[ $i ]->post_date );
  2817. unset( $page_list[ $i ]->post_status );
  2818. }
  2819. return $page_list;
  2820. }
  2821. /**
  2822. * Retrieve authors list.
  2823. *
  2824. * @since 2.2.0
  2825. *
  2826. * @param array $args {
  2827. * Method arguments. Note: arguments must be ordered as documented.
  2828. *
  2829. * @type int $0 Blog ID (unused).
  2830. * @type string $1 Username.
  2831. * @type string $2 Password.
  2832. * }
  2833. * @return array|IXR_Error
  2834. */
  2835. public function wp_getAuthors( $args ) {
  2836. $this->escape( $args );
  2837. $username = $args[1];
  2838. $password = $args[2];
  2839. $user = $this->login( $username, $password );
  2840. if ( ! $user ) {
  2841. return $this->error;
  2842. }
  2843. if ( ! current_user_can( 'edit_posts' ) ) {
  2844. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts.' ) );
  2845. }
  2846. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2847. do_action( 'xmlrpc_call', 'wp.getAuthors', $args, $this );
  2848. $authors = array();
  2849. foreach ( get_users( array( 'fields' => array( 'ID', 'user_login', 'display_name' ) ) ) as $user ) {
  2850. $authors[] = array(
  2851. 'user_id' => $user->ID,
  2852. 'user_login' => $user->user_login,
  2853. 'display_name' => $user->display_name,
  2854. );
  2855. }
  2856. return $authors;
  2857. }
  2858. /**
  2859. * Get list of all tags
  2860. *
  2861. * @since 2.7.0
  2862. *
  2863. * @param array $args {
  2864. * Method arguments. Note: arguments must be ordered as documented.
  2865. *
  2866. * @type int $0 Blog ID (unused).
  2867. * @type string $1 Username.
  2868. * @type string $2 Password.
  2869. * }
  2870. * @return array|IXR_Error
  2871. */
  2872. public function wp_getTags( $args ) {
  2873. $this->escape( $args );
  2874. $username = $args[1];
  2875. $password = $args[2];
  2876. $user = $this->login( $username, $password );
  2877. if ( ! $user ) {
  2878. return $this->error;
  2879. }
  2880. if ( ! current_user_can( 'edit_posts' ) ) {
  2881. return new IXR_Error( 401, __( 'Sorry, you must be able to edit posts on this site in order to view tags.' ) );
  2882. }
  2883. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2884. do_action( 'xmlrpc_call', 'wp.getKeywords', $args, $this );
  2885. $tags = array();
  2886. $all_tags = get_tags();
  2887. if ( $all_tags ) {
  2888. foreach ( (array) $all_tags as $tag ) {
  2889. $struct = array();
  2890. $struct['tag_id'] = $tag->term_id;
  2891. $struct['name'] = $tag->name;
  2892. $struct['count'] = $tag->count;
  2893. $struct['slug'] = $tag->slug;
  2894. $struct['html_url'] = esc_html( get_tag_link( $tag->term_id ) );
  2895. $struct['rss_url'] = esc_html( get_tag_feed_link( $tag->term_id ) );
  2896. $tags[] = $struct;
  2897. }
  2898. }
  2899. return $tags;
  2900. }
  2901. /**
  2902. * Create new category.
  2903. *
  2904. * @since 2.2.0
  2905. *
  2906. * @param array $args {
  2907. * Method arguments. Note: arguments must be ordered as documented.
  2908. *
  2909. * @type int $0 Blog ID (unused).
  2910. * @type string $1 Username.
  2911. * @type string $2 Password.
  2912. * @type array $3 Category.
  2913. * }
  2914. * @return int|IXR_Error Category ID.
  2915. */
  2916. public function wp_newCategory( $args ) {
  2917. $this->escape( $args );
  2918. $username = $args[1];
  2919. $password = $args[2];
  2920. $category = $args[3];
  2921. $user = $this->login( $username, $password );
  2922. if ( ! $user ) {
  2923. return $this->error;
  2924. }
  2925. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2926. do_action( 'xmlrpc_call', 'wp.newCategory', $args, $this );
  2927. // Make sure the user is allowed to add a category.
  2928. if ( ! current_user_can( 'manage_categories' ) ) {
  2929. return new IXR_Error( 401, __( 'Sorry, you are not allowed to add a category.' ) );
  2930. }
  2931. // If no slug was provided, make it empty
  2932. // so that WordPress will generate one.
  2933. if ( empty( $category['slug'] ) ) {
  2934. $category['slug'] = '';
  2935. }
  2936. // If no parent_id was provided, make it empty
  2937. // so that it will be a top-level page (no parent).
  2938. if ( ! isset( $category['parent_id'] ) ) {
  2939. $category['parent_id'] = '';
  2940. }
  2941. // If no description was provided, make it empty.
  2942. if ( empty( $category['description'] ) ) {
  2943. $category['description'] = '';
  2944. }
  2945. $new_category = array(
  2946. 'cat_name' => $category['name'],
  2947. 'category_nicename' => $category['slug'],
  2948. 'category_parent' => $category['parent_id'],
  2949. 'category_description' => $category['description'],
  2950. );
  2951. $cat_id = wp_insert_category( $new_category, true );
  2952. if ( is_wp_error( $cat_id ) ) {
  2953. if ( 'term_exists' === $cat_id->get_error_code() ) {
  2954. return (int) $cat_id->get_error_data();
  2955. } else {
  2956. return new IXR_Error( 500, __( 'Sorry, the category could not be created.' ) );
  2957. }
  2958. } elseif ( ! $cat_id ) {
  2959. return new IXR_Error( 500, __( 'Sorry, the category could not be created.' ) );
  2960. }
  2961. /**
  2962. * Fires after a new category has been successfully created via XML-RPC.
  2963. *
  2964. * @since 3.4.0
  2965. *
  2966. * @param int $cat_id ID of the new category.
  2967. * @param array $args An array of new category arguments.
  2968. */
  2969. do_action( 'xmlrpc_call_success_wp_newCategory', $cat_id, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  2970. return $cat_id;
  2971. }
  2972. /**
  2973. * Remove category.
  2974. *
  2975. * @since 2.5.0
  2976. *
  2977. * @param array $args {
  2978. * Method arguments. Note: arguments must be ordered as documented.
  2979. *
  2980. * @type int $0 Blog ID (unused).
  2981. * @type string $1 Username.
  2982. * @type string $2 Password.
  2983. * @type int $3 Category ID.
  2984. * }
  2985. * @return bool|IXR_Error See wp_delete_term() for return info.
  2986. */
  2987. public function wp_deleteCategory( $args ) {
  2988. $this->escape( $args );
  2989. $username = $args[1];
  2990. $password = $args[2];
  2991. $category_id = (int) $args[3];
  2992. $user = $this->login( $username, $password );
  2993. if ( ! $user ) {
  2994. return $this->error;
  2995. }
  2996. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2997. do_action( 'xmlrpc_call', 'wp.deleteCategory', $args, $this );
  2998. if ( ! current_user_can( 'delete_term', $category_id ) ) {
  2999. return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this category.' ) );
  3000. }
  3001. $status = wp_delete_term( $category_id, 'category' );
  3002. if ( true == $status ) {
  3003. /**
  3004. * Fires after a category has been successfully deleted via XML-RPC.
  3005. *
  3006. * @since 3.4.0
  3007. *
  3008. * @param int $category_id ID of the deleted category.
  3009. * @param array $args An array of arguments to delete the category.
  3010. */
  3011. do_action( 'xmlrpc_call_success_wp_deleteCategory', $category_id, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  3012. }
  3013. return $status;
  3014. }
  3015. /**
  3016. * Retrieve category list.
  3017. *
  3018. * @since 2.2.0
  3019. *
  3020. * @param array $args {
  3021. * Method arguments. Note: arguments must be ordered as documented.
  3022. *
  3023. * @type int $0 Blog ID (unused).
  3024. * @type string $1 Username.
  3025. * @type string $2 Password.
  3026. * @type array $3 Category
  3027. * @type int $4 Max number of results.
  3028. * }
  3029. * @return array|IXR_Error
  3030. */
  3031. public function wp_suggestCategories( $args ) {
  3032. $this->escape( $args );
  3033. $username = $args[1];
  3034. $password = $args[2];
  3035. $category = $args[3];
  3036. $max_results = (int) $args[4];
  3037. $user = $this->login( $username, $password );
  3038. if ( ! $user ) {
  3039. return $this->error;
  3040. }
  3041. if ( ! current_user_can( 'edit_posts' ) ) {
  3042. return new IXR_Error( 401, __( 'Sorry, you must be able to edit posts on this site in order to view categories.' ) );
  3043. }
  3044. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3045. do_action( 'xmlrpc_call', 'wp.suggestCategories', $args, $this );
  3046. $category_suggestions = array();
  3047. $args = array(
  3048. 'get' => 'all',
  3049. 'number' => $max_results,
  3050. 'name__like' => $category,
  3051. );
  3052. foreach ( (array) get_categories( $args ) as $cat ) {
  3053. $category_suggestions[] = array(
  3054. 'category_id' => $cat->term_id,
  3055. 'category_name' => $cat->name,
  3056. );
  3057. }
  3058. return $category_suggestions;
  3059. }
  3060. /**
  3061. * Retrieve comment.
  3062. *
  3063. * @since 2.7.0
  3064. *
  3065. * @param array $args {
  3066. * Method arguments. Note: arguments must be ordered as documented.
  3067. *
  3068. * @type int $0 Blog ID (unused).
  3069. * @type string $1 Username.
  3070. * @type string $2 Password.
  3071. * @type int $3 Comment ID.
  3072. * }
  3073. * @return array|IXR_Error
  3074. */
  3075. public function wp_getComment( $args ) {
  3076. $this->escape( $args );
  3077. $username = $args[1];
  3078. $password = $args[2];
  3079. $comment_id = (int) $args[3];
  3080. $user = $this->login( $username, $password );
  3081. if ( ! $user ) {
  3082. return $this->error;
  3083. }
  3084. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3085. do_action( 'xmlrpc_call', 'wp.getComment', $args, $this );
  3086. $comment = get_comment( $comment_id );
  3087. if ( ! $comment ) {
  3088. return new IXR_Error( 404, __( 'Invalid comment ID.' ) );
  3089. }
  3090. if ( ! current_user_can( 'edit_comment', $comment_id ) ) {
  3091. return new IXR_Error( 403, __( 'Sorry, you are not allowed to moderate or edit this comment.' ) );
  3092. }
  3093. return $this->_prepare_comment( $comment );
  3094. }
  3095. /**
  3096. * Retrieve comments.
  3097. *
  3098. * Besides the common blog_id (unused), username, and password arguments, it takes a filter
  3099. * array as last argument.
  3100. *
  3101. * Accepted 'filter' keys are 'status', 'post_id', 'offset', and 'number'.
  3102. *
  3103. * The defaults are as follows:
  3104. * - 'status' - Default is ''. Filter by status (e.g., 'approve', 'hold')
  3105. * - 'post_id' - Default is ''. The post where the comment is posted. Empty string shows all comments.
  3106. * - 'number' - Default is 10. Total number of media items to retrieve.
  3107. * - 'offset' - Default is 0. See WP_Query::query() for more.
  3108. *
  3109. * @since 2.7.0
  3110. *
  3111. * @param array $args {
  3112. * Method arguments. Note: arguments must be ordered as documented.
  3113. *
  3114. * @type int $0 Blog ID (unused).
  3115. * @type string $1 Username.
  3116. * @type string $2 Password.
  3117. * @type array $3 Optional. Query arguments.
  3118. * }
  3119. * @return array|IXR_Error Contains a collection of comments. See wp_xmlrpc_server::wp_getComment() for a description of each item contents
  3120. */
  3121. public function wp_getComments( $args ) {
  3122. $this->escape( $args );
  3123. $username = $args[1];
  3124. $password = $args[2];
  3125. $struct = isset( $args[3] ) ? $args[3] : array();
  3126. $user = $this->login( $username, $password );
  3127. if ( ! $user ) {
  3128. return $this->error;
  3129. }
  3130. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3131. do_action( 'xmlrpc_call', 'wp.getComments', $args, $this );
  3132. if ( isset( $struct['status'] ) ) {
  3133. $status = $struct['status'];
  3134. } else {
  3135. $status = '';
  3136. }
  3137. if ( ! current_user_can( 'moderate_comments' ) && 'approve' !== $status ) {
  3138. return new IXR_Error( 401, __( 'Invalid comment status.' ) );
  3139. }
  3140. $post_id = '';
  3141. if ( isset( $struct['post_id'] ) ) {
  3142. $post_id = absint( $struct['post_id'] );
  3143. }
  3144. $post_type = '';
  3145. if ( isset( $struct['post_type'] ) ) {
  3146. $post_type_object = get_post_type_object( $struct['post_type'] );
  3147. if ( ! $post_type_object || ! post_type_supports( $post_type_object->name, 'comments' ) ) {
  3148. return new IXR_Error( 404, __( 'Invalid post type.' ) );
  3149. }
  3150. $post_type = $struct['post_type'];
  3151. }
  3152. $offset = 0;
  3153. if ( isset( $struct['offset'] ) ) {
  3154. $offset = absint( $struct['offset'] );
  3155. }
  3156. $number = 10;
  3157. if ( isset( $struct['number'] ) ) {
  3158. $number = absint( $struct['number'] );
  3159. }
  3160. $comments = get_comments(
  3161. array(
  3162. 'status' => $status,
  3163. 'post_id' => $post_id,
  3164. 'offset' => $offset,
  3165. 'number' => $number,
  3166. 'post_type' => $post_type,
  3167. )
  3168. );
  3169. $comments_struct = array();
  3170. if ( is_array( $comments ) ) {
  3171. foreach ( $comments as $comment ) {
  3172. $comments_struct[] = $this->_prepare_comment( $comment );
  3173. }
  3174. }
  3175. return $comments_struct;
  3176. }
  3177. /**
  3178. * Delete a comment.
  3179. *
  3180. * By default, the comment will be moved to the Trash instead of deleted.
  3181. * See wp_delete_comment() for more information on this behavior.
  3182. *
  3183. * @since 2.7.0
  3184. *
  3185. * @param array $args {
  3186. * Method arguments. Note: arguments must be ordered as documented.
  3187. *
  3188. * @type int $0 Blog ID (unused).
  3189. * @type string $1 Username.
  3190. * @type string $2 Password.
  3191. * @type int $3 Comment ID.
  3192. * }
  3193. * @return bool|IXR_Error See wp_delete_comment().
  3194. */
  3195. public function wp_deleteComment( $args ) {
  3196. $this->escape( $args );
  3197. $username = $args[1];
  3198. $password = $args[2];
  3199. $comment_ID = (int) $args[3];
  3200. $user = $this->login( $username, $password );
  3201. if ( ! $user ) {
  3202. return $this->error;
  3203. }
  3204. if ( ! get_comment( $comment_ID ) ) {
  3205. return new IXR_Error( 404, __( 'Invalid comment ID.' ) );
  3206. }
  3207. if ( ! current_user_can( 'edit_comment', $comment_ID ) ) {
  3208. return new IXR_Error( 403, __( 'Sorry, you are not allowed to delete this comment.' ) );
  3209. }
  3210. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3211. do_action( 'xmlrpc_call', 'wp.deleteComment', $args, $this );
  3212. $status = wp_delete_comment( $comment_ID );
  3213. if ( $status ) {
  3214. /**
  3215. * Fires after a comment has been successfully deleted via XML-RPC.
  3216. *
  3217. * @since 3.4.0
  3218. *
  3219. * @param int $comment_ID ID of the deleted comment.
  3220. * @param array $args An array of arguments to delete the comment.
  3221. */
  3222. do_action( 'xmlrpc_call_success_wp_deleteComment', $comment_ID, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  3223. }
  3224. return $status;
  3225. }
  3226. /**
  3227. * Edit comment.
  3228. *
  3229. * Besides the common blog_id (unused), username, and password arguments, it takes a
  3230. * comment_id integer and a content_struct array as last argument.
  3231. *
  3232. * The allowed keys in the content_struct array are:
  3233. * - 'author'
  3234. * - 'author_url'
  3235. * - 'author_email'
  3236. * - 'content'
  3237. * - 'date_created_gmt'
  3238. * - 'status'. Common statuses are 'approve', 'hold', 'spam'. See get_comment_statuses() for more details
  3239. *
  3240. * @since 2.7.0
  3241. *
  3242. * @param array $args {
  3243. * Method arguments. Note: arguments must be ordered as documented.
  3244. *
  3245. * @type int $0 Blog ID (unused).
  3246. * @type string $1 Username.
  3247. * @type string $2 Password.
  3248. * @type int $3 Comment ID.
  3249. * @type array $4 Content structure.
  3250. * }
  3251. * @return true|IXR_Error True, on success.
  3252. */
  3253. public function wp_editComment( $args ) {
  3254. $this->escape( $args );
  3255. $username = $args[1];
  3256. $password = $args[2];
  3257. $comment_ID = (int) $args[3];
  3258. $content_struct = $args[4];
  3259. $user = $this->login( $username, $password );
  3260. if ( ! $user ) {
  3261. return $this->error;
  3262. }
  3263. if ( ! get_comment( $comment_ID ) ) {
  3264. return new IXR_Error( 404, __( 'Invalid comment ID.' ) );
  3265. }
  3266. if ( ! current_user_can( 'edit_comment', $comment_ID ) ) {
  3267. return new IXR_Error( 403, __( 'Sorry, you are not allowed to moderate or edit this comment.' ) );
  3268. }
  3269. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3270. do_action( 'xmlrpc_call', 'wp.editComment', $args, $this );
  3271. $comment = array(
  3272. 'comment_ID' => $comment_ID,
  3273. );
  3274. if ( isset( $content_struct['status'] ) ) {
  3275. $statuses = get_comment_statuses();
  3276. $statuses = array_keys( $statuses );
  3277. if ( ! in_array( $content_struct['status'], $statuses, true ) ) {
  3278. return new IXR_Error( 401, __( 'Invalid comment status.' ) );
  3279. }
  3280. $comment['comment_approved'] = $content_struct['status'];
  3281. }
  3282. // Do some timestamp voodoo.
  3283. if ( ! empty( $content_struct['date_created_gmt'] ) ) {
  3284. // We know this is supposed to be GMT, so we're going to slap that Z on there by force.
  3285. $dateCreated = rtrim( $content_struct['date_created_gmt']->getIso(), 'Z' ) . 'Z';
  3286. $comment['comment_date'] = get_date_from_gmt( $dateCreated );
  3287. $comment['comment_date_gmt'] = iso8601_to_datetime( $dateCreated, 'gmt' );
  3288. }
  3289. if ( isset( $content_struct['content'] ) ) {
  3290. $comment['comment_content'] = $content_struct['content'];
  3291. }
  3292. if ( isset( $content_struct['author'] ) ) {
  3293. $comment['comment_author'] = $content_struct['author'];
  3294. }
  3295. if ( isset( $content_struct['author_url'] ) ) {
  3296. $comment['comment_author_url'] = $content_struct['author_url'];
  3297. }
  3298. if ( isset( $content_struct['author_email'] ) ) {
  3299. $comment['comment_author_email'] = $content_struct['author_email'];
  3300. }
  3301. $result = wp_update_comment( $comment, true );
  3302. if ( is_wp_error( $result ) ) {
  3303. return new IXR_Error( 500, $result->get_error_message() );
  3304. }
  3305. if ( ! $result ) {
  3306. return new IXR_Error( 500, __( 'Sorry, the comment could not be updated.' ) );
  3307. }
  3308. /**
  3309. * Fires after a comment has been successfully updated via XML-RPC.
  3310. *
  3311. * @since 3.4.0
  3312. *
  3313. * @param int $comment_ID ID of the updated comment.
  3314. * @param array $args An array of arguments to update the comment.
  3315. */
  3316. do_action( 'xmlrpc_call_success_wp_editComment', $comment_ID, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  3317. return true;
  3318. }
  3319. /**
  3320. * Create new comment.
  3321. *
  3322. * @since 2.7.0
  3323. *
  3324. * @param array $args {
  3325. * Method arguments. Note: arguments must be ordered as documented.
  3326. *
  3327. * @type int $0 Blog ID (unused).
  3328. * @type string $1 Username.
  3329. * @type string $2 Password.
  3330. * @type string|int $3 Post ID or URL.
  3331. * @type array $4 Content structure.
  3332. * }
  3333. * @return int|IXR_Error See wp_new_comment().
  3334. */
  3335. public function wp_newComment( $args ) {
  3336. $this->escape( $args );
  3337. $username = $args[1];
  3338. $password = $args[2];
  3339. $post = $args[3];
  3340. $content_struct = $args[4];
  3341. /**
  3342. * Filters whether to allow anonymous comments over XML-RPC.
  3343. *
  3344. * @since 2.7.0
  3345. *
  3346. * @param bool $allow Whether to allow anonymous commenting via XML-RPC.
  3347. * Default false.
  3348. */
  3349. $allow_anon = apply_filters( 'xmlrpc_allow_anonymous_comments', false );
  3350. $user = $this->login( $username, $password );
  3351. if ( ! $user ) {
  3352. $logged_in = false;
  3353. if ( $allow_anon && get_option( 'comment_registration' ) ) {
  3354. return new IXR_Error( 403, __( 'Sorry, you must be logged in to comment.' ) );
  3355. } elseif ( ! $allow_anon ) {
  3356. return $this->error;
  3357. }
  3358. } else {
  3359. $logged_in = true;
  3360. }
  3361. if ( is_numeric( $post ) ) {
  3362. $post_id = absint( $post );
  3363. } else {
  3364. $post_id = url_to_postid( $post );
  3365. }
  3366. if ( ! $post_id ) {
  3367. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  3368. }
  3369. if ( ! get_post( $post_id ) ) {
  3370. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  3371. }
  3372. if ( ! comments_open( $post_id ) ) {
  3373. return new IXR_Error( 403, __( 'Sorry, comments are closed for this item.' ) );
  3374. }
  3375. if (
  3376. 'publish' === get_post_status( $post_id ) &&
  3377. ! current_user_can( 'edit_post', $post_id ) &&
  3378. post_password_required( $post_id )
  3379. ) {
  3380. return new IXR_Error( 403, __( 'Sorry, you are not allowed to comment on this post.' ) );
  3381. }
  3382. if (
  3383. 'private' === get_post_status( $post_id ) &&
  3384. ! current_user_can( 'read_post', $post_id )
  3385. ) {
  3386. return new IXR_Error( 403, __( 'Sorry, you are not allowed to comment on this post.' ) );
  3387. }
  3388. $comment = array(
  3389. 'comment_post_ID' => $post_id,
  3390. 'comment_content' => trim( $content_struct['content'] ),
  3391. );
  3392. if ( $logged_in ) {
  3393. $display_name = $user->display_name;
  3394. $user_email = $user->user_email;
  3395. $user_url = $user->user_url;
  3396. $comment['comment_author'] = $this->escape( $display_name );
  3397. $comment['comment_author_email'] = $this->escape( $user_email );
  3398. $comment['comment_author_url'] = $this->escape( $user_url );
  3399. $comment['user_id'] = $user->ID;
  3400. } else {
  3401. $comment['comment_author'] = '';
  3402. if ( isset( $content_struct['author'] ) ) {
  3403. $comment['comment_author'] = $content_struct['author'];
  3404. }
  3405. $comment['comment_author_email'] = '';
  3406. if ( isset( $content_struct['author_email'] ) ) {
  3407. $comment['comment_author_email'] = $content_struct['author_email'];
  3408. }
  3409. $comment['comment_author_url'] = '';
  3410. if ( isset( $content_struct['author_url'] ) ) {
  3411. $comment['comment_author_url'] = $content_struct['author_url'];
  3412. }
  3413. $comment['user_id'] = 0;
  3414. if ( get_option( 'require_name_email' ) ) {
  3415. if ( strlen( $comment['comment_author_email'] ) < 6 || '' === $comment['comment_author'] ) {
  3416. return new IXR_Error( 403, __( 'Comment author name and email are required.' ) );
  3417. } elseif ( ! is_email( $comment['comment_author_email'] ) ) {
  3418. return new IXR_Error( 403, __( 'A valid email address is required.' ) );
  3419. }
  3420. }
  3421. }
  3422. $comment['comment_parent'] = isset( $content_struct['comment_parent'] ) ? absint( $content_struct['comment_parent'] ) : 0;
  3423. /** This filter is documented in wp-includes/comment.php */
  3424. $allow_empty = apply_filters( 'allow_empty_comment', false, $comment );
  3425. if ( ! $allow_empty && '' === $comment['comment_content'] ) {
  3426. return new IXR_Error( 403, __( 'Comment is required.' ) );
  3427. }
  3428. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3429. do_action( 'xmlrpc_call', 'wp.newComment', $args, $this );
  3430. $comment_ID = wp_new_comment( $comment, true );
  3431. if ( is_wp_error( $comment_ID ) ) {
  3432. return new IXR_Error( 403, $comment_ID->get_error_message() );
  3433. }
  3434. if ( ! $comment_ID ) {
  3435. return new IXR_Error( 403, __( 'Something went wrong.' ) );
  3436. }
  3437. /**
  3438. * Fires after a new comment has been successfully created via XML-RPC.
  3439. *
  3440. * @since 3.4.0
  3441. *
  3442. * @param int $comment_ID ID of the new comment.
  3443. * @param array $args An array of new comment arguments.
  3444. */
  3445. do_action( 'xmlrpc_call_success_wp_newComment', $comment_ID, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  3446. return $comment_ID;
  3447. }
  3448. /**
  3449. * Retrieve all of the comment status.
  3450. *
  3451. * @since 2.7.0
  3452. *
  3453. * @param array $args {
  3454. * Method arguments. Note: arguments must be ordered as documented.
  3455. *
  3456. * @type int $0 Blog ID (unused).
  3457. * @type string $1 Username.
  3458. * @type string $2 Password.
  3459. * }
  3460. * @return array|IXR_Error
  3461. */
  3462. public function wp_getCommentStatusList( $args ) {
  3463. $this->escape( $args );
  3464. $username = $args[1];
  3465. $password = $args[2];
  3466. $user = $this->login( $username, $password );
  3467. if ( ! $user ) {
  3468. return $this->error;
  3469. }
  3470. if ( ! current_user_can( 'publish_posts' ) ) {
  3471. return new IXR_Error( 403, __( 'Sorry, you are not allowed to access details about this site.' ) );
  3472. }
  3473. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3474. do_action( 'xmlrpc_call', 'wp.getCommentStatusList', $args, $this );
  3475. return get_comment_statuses();
  3476. }
  3477. /**
  3478. * Retrieve comment count.
  3479. *
  3480. * @since 2.5.0
  3481. *
  3482. * @param array $args {
  3483. * Method arguments. Note: arguments must be ordered as documented.
  3484. *
  3485. * @type int $0 Blog ID (unused).
  3486. * @type string $1 Username.
  3487. * @type string $2 Password.
  3488. * @type int $3 Post ID.
  3489. * }
  3490. * @return array|IXR_Error
  3491. */
  3492. public function wp_getCommentCount( $args ) {
  3493. $this->escape( $args );
  3494. $username = $args[1];
  3495. $password = $args[2];
  3496. $post_id = (int) $args[3];
  3497. $user = $this->login( $username, $password );
  3498. if ( ! $user ) {
  3499. return $this->error;
  3500. }
  3501. $post = get_post( $post_id, ARRAY_A );
  3502. if ( empty( $post['ID'] ) ) {
  3503. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  3504. }
  3505. if ( ! current_user_can( 'edit_post', $post_id ) ) {
  3506. return new IXR_Error( 403, __( 'Sorry, you are not allowed to access details of this post.' ) );
  3507. }
  3508. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3509. do_action( 'xmlrpc_call', 'wp.getCommentCount', $args, $this );
  3510. $count = wp_count_comments( $post_id );
  3511. return array(
  3512. 'approved' => $count->approved,
  3513. 'awaiting_moderation' => $count->moderated,
  3514. 'spam' => $count->spam,
  3515. 'total_comments' => $count->total_comments,
  3516. );
  3517. }
  3518. /**
  3519. * Retrieve post statuses.
  3520. *
  3521. * @since 2.5.0
  3522. *
  3523. * @param array $args {
  3524. * Method arguments. Note: arguments must be ordered as documented.
  3525. *
  3526. * @type int $0 Blog ID (unused).
  3527. * @type string $1 Username.
  3528. * @type string $2 Password.
  3529. * }
  3530. * @return array|IXR_Error
  3531. */
  3532. public function wp_getPostStatusList( $args ) {
  3533. $this->escape( $args );
  3534. $username = $args[1];
  3535. $password = $args[2];
  3536. $user = $this->login( $username, $password );
  3537. if ( ! $user ) {
  3538. return $this->error;
  3539. }
  3540. if ( ! current_user_can( 'edit_posts' ) ) {
  3541. return new IXR_Error( 403, __( 'Sorry, you are not allowed to access details about this site.' ) );
  3542. }
  3543. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3544. do_action( 'xmlrpc_call', 'wp.getPostStatusList', $args, $this );
  3545. return get_post_statuses();
  3546. }
  3547. /**
  3548. * Retrieve page statuses.
  3549. *
  3550. * @since 2.5.0
  3551. *
  3552. * @param array $args {
  3553. * Method arguments. Note: arguments must be ordered as documented.
  3554. *
  3555. * @type int $0 Blog ID (unused).
  3556. * @type string $1 Username.
  3557. * @type string $2 Password.
  3558. * }
  3559. * @return array|IXR_Error
  3560. */
  3561. public function wp_getPageStatusList( $args ) {
  3562. $this->escape( $args );
  3563. $username = $args[1];
  3564. $password = $args[2];
  3565. $user = $this->login( $username, $password );
  3566. if ( ! $user ) {
  3567. return $this->error;
  3568. }
  3569. if ( ! current_user_can( 'edit_pages' ) ) {
  3570. return new IXR_Error( 403, __( 'Sorry, you are not allowed to access details about this site.' ) );
  3571. }
  3572. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3573. do_action( 'xmlrpc_call', 'wp.getPageStatusList', $args, $this );
  3574. return get_page_statuses();
  3575. }
  3576. /**
  3577. * Retrieve page templates.
  3578. *
  3579. * @since 2.6.0
  3580. *
  3581. * @param array $args {
  3582. * Method arguments. Note: arguments must be ordered as documented.
  3583. *
  3584. * @type int $0 Blog ID (unused).
  3585. * @type string $1 Username.
  3586. * @type string $2 Password.
  3587. * }
  3588. * @return array|IXR_Error
  3589. */
  3590. public function wp_getPageTemplates( $args ) {
  3591. $this->escape( $args );
  3592. $username = $args[1];
  3593. $password = $args[2];
  3594. $user = $this->login( $username, $password );
  3595. if ( ! $user ) {
  3596. return $this->error;
  3597. }
  3598. if ( ! current_user_can( 'edit_pages' ) ) {
  3599. return new IXR_Error( 403, __( 'Sorry, you are not allowed to access details about this site.' ) );
  3600. }
  3601. $templates = get_page_templates();
  3602. $templates['Default'] = 'default';
  3603. return $templates;
  3604. }
  3605. /**
  3606. * Retrieve blog options.
  3607. *
  3608. * @since 2.6.0
  3609. *
  3610. * @param array $args {
  3611. * Method arguments. Note: arguments must be ordered as documented.
  3612. *
  3613. * @type int $0 Blog ID (unused).
  3614. * @type string $1 Username.
  3615. * @type string $2 Password.
  3616. * @type array $3 Optional. Options.
  3617. * }
  3618. * @return array|IXR_Error
  3619. */
  3620. public function wp_getOptions( $args ) {
  3621. $this->escape( $args );
  3622. $username = $args[1];
  3623. $password = $args[2];
  3624. $options = isset( $args[3] ) ? (array) $args[3] : array();
  3625. $user = $this->login( $username, $password );
  3626. if ( ! $user ) {
  3627. return $this->error;
  3628. }
  3629. // If no specific options where asked for, return all of them.
  3630. if ( count( $options ) == 0 ) {
  3631. $options = array_keys( $this->blog_options );
  3632. }
  3633. return $this->_getOptions( $options );
  3634. }
  3635. /**
  3636. * Retrieve blog options value from list.
  3637. *
  3638. * @since 2.6.0
  3639. *
  3640. * @param array $options Options to retrieve.
  3641. * @return array
  3642. */
  3643. public function _getOptions( $options ) {
  3644. $data = array();
  3645. $can_manage = current_user_can( 'manage_options' );
  3646. foreach ( $options as $option ) {
  3647. if ( array_key_exists( $option, $this->blog_options ) ) {
  3648. $data[ $option ] = $this->blog_options[ $option ];
  3649. // Is the value static or dynamic?
  3650. if ( isset( $data[ $option ]['option'] ) ) {
  3651. $data[ $option ]['value'] = get_option( $data[ $option ]['option'] );
  3652. unset( $data[ $option ]['option'] );
  3653. }
  3654. if ( ! $can_manage ) {
  3655. $data[ $option ]['readonly'] = true;
  3656. }
  3657. }
  3658. }
  3659. return $data;
  3660. }
  3661. /**
  3662. * Update blog options.
  3663. *
  3664. * @since 2.6.0
  3665. *
  3666. * @param array $args {
  3667. * Method arguments. Note: arguments must be ordered as documented.
  3668. *
  3669. * @type int $0 Blog ID (unused).
  3670. * @type string $1 Username.
  3671. * @type string $2 Password.
  3672. * @type array $3 Options.
  3673. * }
  3674. * @return array|IXR_Error
  3675. */
  3676. public function wp_setOptions( $args ) {
  3677. $this->escape( $args );
  3678. $username = $args[1];
  3679. $password = $args[2];
  3680. $options = (array) $args[3];
  3681. $user = $this->login( $username, $password );
  3682. if ( ! $user ) {
  3683. return $this->error;
  3684. }
  3685. if ( ! current_user_can( 'manage_options' ) ) {
  3686. return new IXR_Error( 403, __( 'Sorry, you are not allowed to update options.' ) );
  3687. }
  3688. $option_names = array();
  3689. foreach ( $options as $o_name => $o_value ) {
  3690. $option_names[] = $o_name;
  3691. if ( ! array_key_exists( $o_name, $this->blog_options ) ) {
  3692. continue;
  3693. }
  3694. if ( true == $this->blog_options[ $o_name ]['readonly'] ) {
  3695. continue;
  3696. }
  3697. update_option( $this->blog_options[ $o_name ]['option'], wp_unslash( $o_value ) );
  3698. }
  3699. // Now return the updated values.
  3700. return $this->_getOptions( $option_names );
  3701. }
  3702. /**
  3703. * Retrieve a media item by ID
  3704. *
  3705. * @since 3.1.0
  3706. *
  3707. * @param array $args {
  3708. * Method arguments. Note: arguments must be ordered as documented.
  3709. *
  3710. * @type int $0 Blog ID (unused).
  3711. * @type string $1 Username.
  3712. * @type string $2 Password.
  3713. * @type int $3 Attachment ID.
  3714. * }
  3715. * @return array|IXR_Error Associative array contains:
  3716. * - 'date_created_gmt'
  3717. * - 'parent'
  3718. * - 'link'
  3719. * - 'thumbnail'
  3720. * - 'title'
  3721. * - 'caption'
  3722. * - 'description'
  3723. * - 'metadata'
  3724. */
  3725. public function wp_getMediaItem( $args ) {
  3726. $this->escape( $args );
  3727. $username = $args[1];
  3728. $password = $args[2];
  3729. $attachment_id = (int) $args[3];
  3730. $user = $this->login( $username, $password );
  3731. if ( ! $user ) {
  3732. return $this->error;
  3733. }
  3734. if ( ! current_user_can( 'upload_files' ) ) {
  3735. return new IXR_Error( 403, __( 'Sorry, you are not allowed to upload files.' ) );
  3736. }
  3737. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3738. do_action( 'xmlrpc_call', 'wp.getMediaItem', $args, $this );
  3739. $attachment = get_post( $attachment_id );
  3740. if ( ! $attachment || 'attachment' !== $attachment->post_type ) {
  3741. return new IXR_Error( 404, __( 'Invalid attachment ID.' ) );
  3742. }
  3743. return $this->_prepare_media_item( $attachment );
  3744. }
  3745. /**
  3746. * Retrieves a collection of media library items (or attachments)
  3747. *
  3748. * Besides the common blog_id (unused), username, and password arguments, it takes a filter
  3749. * array as last argument.
  3750. *
  3751. * Accepted 'filter' keys are 'parent_id', 'mime_type', 'offset', and 'number'.
  3752. *
  3753. * The defaults are as follows:
  3754. * - 'number' - Default is 5. Total number of media items to retrieve.
  3755. * - 'offset' - Default is 0. See WP_Query::query() for more.
  3756. * - 'parent_id' - Default is ''. The post where the media item is attached. Empty string shows all media items. 0 shows unattached media items.
  3757. * - 'mime_type' - Default is ''. Filter by mime type (e.g., 'image/jpeg', 'application/pdf')
  3758. *
  3759. * @since 3.1.0
  3760. *
  3761. * @param array $args {
  3762. * Method arguments. Note: arguments must be ordered as documented.
  3763. *
  3764. * @type int $0 Blog ID (unused).
  3765. * @type string $1 Username.
  3766. * @type string $2 Password.
  3767. * @type array $3 Query arguments.
  3768. * }
  3769. * @return array|IXR_Error Contains a collection of media items. See wp_xmlrpc_server::wp_getMediaItem() for a description of each item contents
  3770. */
  3771. public function wp_getMediaLibrary( $args ) {
  3772. $this->escape( $args );
  3773. $username = $args[1];
  3774. $password = $args[2];
  3775. $struct = isset( $args[3] ) ? $args[3] : array();
  3776. $user = $this->login( $username, $password );
  3777. if ( ! $user ) {
  3778. return $this->error;
  3779. }
  3780. if ( ! current_user_can( 'upload_files' ) ) {
  3781. return new IXR_Error( 401, __( 'Sorry, you are not allowed to upload files.' ) );
  3782. }
  3783. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3784. do_action( 'xmlrpc_call', 'wp.getMediaLibrary', $args, $this );
  3785. $parent_id = ( isset( $struct['parent_id'] ) ) ? absint( $struct['parent_id'] ) : '';
  3786. $mime_type = ( isset( $struct['mime_type'] ) ) ? $struct['mime_type'] : '';
  3787. $offset = ( isset( $struct['offset'] ) ) ? absint( $struct['offset'] ) : 0;
  3788. $number = ( isset( $struct['number'] ) ) ? absint( $struct['number'] ) : -1;
  3789. $attachments = get_posts(
  3790. array(
  3791. 'post_type' => 'attachment',
  3792. 'post_parent' => $parent_id,
  3793. 'offset' => $offset,
  3794. 'numberposts' => $number,
  3795. 'post_mime_type' => $mime_type,
  3796. )
  3797. );
  3798. $attachments_struct = array();
  3799. foreach ( $attachments as $attachment ) {
  3800. $attachments_struct[] = $this->_prepare_media_item( $attachment );
  3801. }
  3802. return $attachments_struct;
  3803. }
  3804. /**
  3805. * Retrieves a list of post formats used by the site.
  3806. *
  3807. * @since 3.1.0
  3808. *
  3809. * @param array $args {
  3810. * Method arguments. Note: arguments must be ordered as documented.
  3811. *
  3812. * @type int $0 Blog ID (unused).
  3813. * @type string $1 Username.
  3814. * @type string $2 Password.
  3815. * }
  3816. * @return array|IXR_Error List of post formats, otherwise IXR_Error object.
  3817. */
  3818. public function wp_getPostFormats( $args ) {
  3819. $this->escape( $args );
  3820. $username = $args[1];
  3821. $password = $args[2];
  3822. $user = $this->login( $username, $password );
  3823. if ( ! $user ) {
  3824. return $this->error;
  3825. }
  3826. if ( ! current_user_can( 'edit_posts' ) ) {
  3827. return new IXR_Error( 403, __( 'Sorry, you are not allowed to access details about this site.' ) );
  3828. }
  3829. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3830. do_action( 'xmlrpc_call', 'wp.getPostFormats', $args, $this );
  3831. $formats = get_post_format_strings();
  3832. // Find out if they want a list of currently supports formats.
  3833. if ( isset( $args[3] ) && is_array( $args[3] ) ) {
  3834. if ( $args[3]['show-supported'] ) {
  3835. if ( current_theme_supports( 'post-formats' ) ) {
  3836. $supported = get_theme_support( 'post-formats' );
  3837. $data = array();
  3838. $data['all'] = $formats;
  3839. $data['supported'] = $supported[0];
  3840. $formats = $data;
  3841. }
  3842. }
  3843. }
  3844. return $formats;
  3845. }
  3846. /**
  3847. * Retrieves a post type
  3848. *
  3849. * @since 3.4.0
  3850. *
  3851. * @see get_post_type_object()
  3852. *
  3853. * @param array $args {
  3854. * Method arguments. Note: arguments must be ordered as documented.
  3855. *
  3856. * @type int $0 Blog ID (unused).
  3857. * @type string $1 Username.
  3858. * @type string $2 Password.
  3859. * @type string $3 Post type name.
  3860. * @type array $4 Optional. Fields to fetch.
  3861. * }
  3862. * @return array|IXR_Error Array contains:
  3863. * - 'labels'
  3864. * - 'description'
  3865. * - 'capability_type'
  3866. * - 'cap'
  3867. * - 'map_meta_cap'
  3868. * - 'hierarchical'
  3869. * - 'menu_position'
  3870. * - 'taxonomies'
  3871. * - 'supports'
  3872. */
  3873. public function wp_getPostType( $args ) {
  3874. if ( ! $this->minimum_args( $args, 4 ) ) {
  3875. return $this->error;
  3876. }
  3877. $this->escape( $args );
  3878. $username = $args[1];
  3879. $password = $args[2];
  3880. $post_type_name = $args[3];
  3881. if ( isset( $args[4] ) ) {
  3882. $fields = $args[4];
  3883. } else {
  3884. /**
  3885. * Filters the default query fields used by the given XML-RPC method.
  3886. *
  3887. * @since 3.4.0
  3888. *
  3889. * @param array $fields An array of post type query fields for the given method.
  3890. * @param string $method The method name.
  3891. */
  3892. $fields = apply_filters( 'xmlrpc_default_posttype_fields', array( 'labels', 'cap', 'taxonomies' ), 'wp.getPostType' );
  3893. }
  3894. $user = $this->login( $username, $password );
  3895. if ( ! $user ) {
  3896. return $this->error;
  3897. }
  3898. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3899. do_action( 'xmlrpc_call', 'wp.getPostType', $args, $this );
  3900. if ( ! post_type_exists( $post_type_name ) ) {
  3901. return new IXR_Error( 403, __( 'Invalid post type.' ) );
  3902. }
  3903. $post_type = get_post_type_object( $post_type_name );
  3904. if ( ! current_user_can( $post_type->cap->edit_posts ) ) {
  3905. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts in this post type.' ) );
  3906. }
  3907. return $this->_prepare_post_type( $post_type, $fields );
  3908. }
  3909. /**
  3910. * Retrieves a post types
  3911. *
  3912. * @since 3.4.0
  3913. *
  3914. * @see get_post_types()
  3915. *
  3916. * @param array $args {
  3917. * Method arguments. Note: arguments must be ordered as documented.
  3918. *
  3919. * @type int $0 Blog ID (unused).
  3920. * @type string $1 Username.
  3921. * @type string $2 Password.
  3922. * @type array $3 Optional. Query arguments.
  3923. * @type array $4 Optional. Fields to fetch.
  3924. * }
  3925. * @return array|IXR_Error
  3926. */
  3927. public function wp_getPostTypes( $args ) {
  3928. if ( ! $this->minimum_args( $args, 3 ) ) {
  3929. return $this->error;
  3930. }
  3931. $this->escape( $args );
  3932. $username = $args[1];
  3933. $password = $args[2];
  3934. $filter = isset( $args[3] ) ? $args[3] : array( 'public' => true );
  3935. if ( isset( $args[4] ) ) {
  3936. $fields = $args[4];
  3937. } else {
  3938. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3939. $fields = apply_filters( 'xmlrpc_default_posttype_fields', array( 'labels', 'cap', 'taxonomies' ), 'wp.getPostTypes' );
  3940. }
  3941. $user = $this->login( $username, $password );
  3942. if ( ! $user ) {
  3943. return $this->error;
  3944. }
  3945. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3946. do_action( 'xmlrpc_call', 'wp.getPostTypes', $args, $this );
  3947. $post_types = get_post_types( $filter, 'objects' );
  3948. $struct = array();
  3949. foreach ( $post_types as $post_type ) {
  3950. if ( ! current_user_can( $post_type->cap->edit_posts ) ) {
  3951. continue;
  3952. }
  3953. $struct[ $post_type->name ] = $this->_prepare_post_type( $post_type, $fields );
  3954. }
  3955. return $struct;
  3956. }
  3957. /**
  3958. * Retrieve revisions for a specific post.
  3959. *
  3960. * @since 3.5.0
  3961. *
  3962. * The optional $fields parameter specifies what fields will be included
  3963. * in the response array.
  3964. *
  3965. * @uses wp_get_post_revisions()
  3966. * @see wp_getPost() for more on $fields
  3967. *
  3968. * @param array $args {
  3969. * Method arguments. Note: arguments must be ordered as documented.
  3970. *
  3971. * @type int $0 Blog ID (unused).
  3972. * @type string $1 Username.
  3973. * @type string $2 Password.
  3974. * @type int $3 Post ID.
  3975. * @type array $4 Optional. Fields to fetch.
  3976. * }
  3977. * @return array|IXR_Error contains a collection of posts.
  3978. */
  3979. public function wp_getRevisions( $args ) {
  3980. if ( ! $this->minimum_args( $args, 4 ) ) {
  3981. return $this->error;
  3982. }
  3983. $this->escape( $args );
  3984. $username = $args[1];
  3985. $password = $args[2];
  3986. $post_id = (int) $args[3];
  3987. if ( isset( $args[4] ) ) {
  3988. $fields = $args[4];
  3989. } else {
  3990. /**
  3991. * Filters the default revision query fields used by the given XML-RPC method.
  3992. *
  3993. * @since 3.5.0
  3994. *
  3995. * @param array $field An array of revision query fields.
  3996. * @param string $method The method name.
  3997. */
  3998. $fields = apply_filters( 'xmlrpc_default_revision_fields', array( 'post_date', 'post_date_gmt' ), 'wp.getRevisions' );
  3999. }
  4000. $user = $this->login( $username, $password );
  4001. if ( ! $user ) {
  4002. return $this->error;
  4003. }
  4004. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4005. do_action( 'xmlrpc_call', 'wp.getRevisions', $args, $this );
  4006. $post = get_post( $post_id );
  4007. if ( ! $post ) {
  4008. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  4009. }
  4010. if ( ! current_user_can( 'edit_post', $post_id ) ) {
  4011. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts.' ) );
  4012. }
  4013. // Check if revisions are enabled.
  4014. if ( ! wp_revisions_enabled( $post ) ) {
  4015. return new IXR_Error( 401, __( 'Sorry, revisions are disabled.' ) );
  4016. }
  4017. $revisions = wp_get_post_revisions( $post_id );
  4018. if ( ! $revisions ) {
  4019. return array();
  4020. }
  4021. $struct = array();
  4022. foreach ( $revisions as $revision ) {
  4023. if ( ! current_user_can( 'read_post', $revision->ID ) ) {
  4024. continue;
  4025. }
  4026. // Skip autosaves.
  4027. if ( wp_is_post_autosave( $revision ) ) {
  4028. continue;
  4029. }
  4030. $struct[] = $this->_prepare_post( get_object_vars( $revision ), $fields );
  4031. }
  4032. return $struct;
  4033. }
  4034. /**
  4035. * Restore a post revision
  4036. *
  4037. * @since 3.5.0
  4038. *
  4039. * @uses wp_restore_post_revision()
  4040. *
  4041. * @param array $args {
  4042. * Method arguments. Note: arguments must be ordered as documented.
  4043. *
  4044. * @type int $0 Blog ID (unused).
  4045. * @type string $1 Username.
  4046. * @type string $2 Password.
  4047. * @type int $3 Revision ID.
  4048. * }
  4049. * @return bool|IXR_Error false if there was an error restoring, true if success.
  4050. */
  4051. public function wp_restoreRevision( $args ) {
  4052. if ( ! $this->minimum_args( $args, 3 ) ) {
  4053. return $this->error;
  4054. }
  4055. $this->escape( $args );
  4056. $username = $args[1];
  4057. $password = $args[2];
  4058. $revision_id = (int) $args[3];
  4059. $user = $this->login( $username, $password );
  4060. if ( ! $user ) {
  4061. return $this->error;
  4062. }
  4063. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4064. do_action( 'xmlrpc_call', 'wp.restoreRevision', $args, $this );
  4065. $revision = wp_get_post_revision( $revision_id );
  4066. if ( ! $revision ) {
  4067. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  4068. }
  4069. if ( wp_is_post_autosave( $revision ) ) {
  4070. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  4071. }
  4072. $post = get_post( $revision->post_parent );
  4073. if ( ! $post ) {
  4074. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  4075. }
  4076. if ( ! current_user_can( 'edit_post', $revision->post_parent ) ) {
  4077. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  4078. }
  4079. // Check if revisions are disabled.
  4080. if ( ! wp_revisions_enabled( $post ) ) {
  4081. return new IXR_Error( 401, __( 'Sorry, revisions are disabled.' ) );
  4082. }
  4083. $post = wp_restore_post_revision( $revision_id );
  4084. return (bool) $post;
  4085. }
  4086. /*
  4087. * Blogger API functions.
  4088. * Specs on http://plant.blogger.com/api and https://groups.yahoo.com/group/bloggerDev/
  4089. */
  4090. /**
  4091. * Retrieve blogs that user owns.
  4092. *
  4093. * Will make more sense once we support multiple blogs.
  4094. *
  4095. * @since 1.5.0
  4096. *
  4097. * @param array $args {
  4098. * Method arguments. Note: arguments must be ordered as documented.
  4099. *
  4100. * @type int $0 Blog ID (unused).
  4101. * @type string $1 Username.
  4102. * @type string $2 Password.
  4103. * }
  4104. * @return array|IXR_Error
  4105. */
  4106. public function blogger_getUsersBlogs( $args ) {
  4107. if ( ! $this->minimum_args( $args, 3 ) ) {
  4108. return $this->error;
  4109. }
  4110. if ( is_multisite() ) {
  4111. return $this->_multisite_getUsersBlogs( $args );
  4112. }
  4113. $this->escape( $args );
  4114. $username = $args[1];
  4115. $password = $args[2];
  4116. $user = $this->login( $username, $password );
  4117. if ( ! $user ) {
  4118. return $this->error;
  4119. }
  4120. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4121. do_action( 'xmlrpc_call', 'blogger.getUsersBlogs', $args, $this );
  4122. $is_admin = current_user_can( 'manage_options' );
  4123. $struct = array(
  4124. 'isAdmin' => $is_admin,
  4125. 'url' => get_option( 'home' ) . '/',
  4126. 'blogid' => '1',
  4127. 'blogName' => get_option( 'blogname' ),
  4128. 'xmlrpc' => site_url( 'xmlrpc.php', 'rpc' ),
  4129. );
  4130. return array( $struct );
  4131. }
  4132. /**
  4133. * Private function for retrieving a users blogs for multisite setups
  4134. *
  4135. * @since 3.0.0
  4136. *
  4137. * @param array $args {
  4138. * Method arguments. Note: arguments must be ordered as documented.
  4139. *
  4140. * @type int $0 Blog ID (unused).
  4141. * @type string $1 Username.
  4142. * @type string $2 Password.
  4143. * }
  4144. * @return array|IXR_Error
  4145. */
  4146. protected function _multisite_getUsersBlogs( $args ) {
  4147. $current_blog = get_site();
  4148. $domain = $current_blog->domain;
  4149. $path = $current_blog->path . 'xmlrpc.php';
  4150. $blogs = $this->wp_getUsersBlogs( $args );
  4151. if ( $blogs instanceof IXR_Error ) {
  4152. return $blogs;
  4153. }
  4154. if ( $_SERVER['HTTP_HOST'] == $domain && $_SERVER['REQUEST_URI'] == $path ) {
  4155. return $blogs;
  4156. } else {
  4157. foreach ( (array) $blogs as $blog ) {
  4158. if ( strpos( $blog['url'], $_SERVER['HTTP_HOST'] ) ) {
  4159. return array( $blog );
  4160. }
  4161. }
  4162. return array();
  4163. }
  4164. }
  4165. /**
  4166. * Retrieve user's data.
  4167. *
  4168. * Gives your client some info about you, so you don't have to.
  4169. *
  4170. * @since 1.5.0
  4171. *
  4172. * @param array $args {
  4173. * Method arguments. Note: arguments must be ordered as documented.
  4174. *
  4175. * @type int $0 Blog ID (unused).
  4176. * @type string $1 Username.
  4177. * @type string $2 Password.
  4178. * }
  4179. * @return array|IXR_Error
  4180. */
  4181. public function blogger_getUserInfo( $args ) {
  4182. $this->escape( $args );
  4183. $username = $args[1];
  4184. $password = $args[2];
  4185. $user = $this->login( $username, $password );
  4186. if ( ! $user ) {
  4187. return $this->error;
  4188. }
  4189. if ( ! current_user_can( 'edit_posts' ) ) {
  4190. return new IXR_Error( 401, __( 'Sorry, you are not allowed to access user data on this site.' ) );
  4191. }
  4192. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4193. do_action( 'xmlrpc_call', 'blogger.getUserInfo', $args, $this );
  4194. $struct = array(
  4195. 'nickname' => $user->nickname,
  4196. 'userid' => $user->ID,
  4197. 'url' => $user->user_url,
  4198. 'lastname' => $user->last_name,
  4199. 'firstname' => $user->first_name,
  4200. );
  4201. return $struct;
  4202. }
  4203. /**
  4204. * Retrieve post.
  4205. *
  4206. * @since 1.5.0
  4207. *
  4208. * @param array $args {
  4209. * Method arguments. Note: arguments must be ordered as documented.
  4210. *
  4211. * @type int $0 Blog ID (unused).
  4212. * @type int $1 Post ID.
  4213. * @type string $2 Username.
  4214. * @type string $3 Password.
  4215. * }
  4216. * @return array|IXR_Error
  4217. */
  4218. public function blogger_getPost( $args ) {
  4219. $this->escape( $args );
  4220. $post_ID = (int) $args[1];
  4221. $username = $args[2];
  4222. $password = $args[3];
  4223. $user = $this->login( $username, $password );
  4224. if ( ! $user ) {
  4225. return $this->error;
  4226. }
  4227. $post_data = get_post( $post_ID, ARRAY_A );
  4228. if ( ! $post_data ) {
  4229. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  4230. }
  4231. if ( ! current_user_can( 'edit_post', $post_ID ) ) {
  4232. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  4233. }
  4234. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4235. do_action( 'xmlrpc_call', 'blogger.getPost', $args, $this );
  4236. $categories = implode( ',', wp_get_post_categories( $post_ID ) );
  4237. $content = '<title>' . wp_unslash( $post_data['post_title'] ) . '</title>';
  4238. $content .= '<category>' . $categories . '</category>';
  4239. $content .= wp_unslash( $post_data['post_content'] );
  4240. $struct = array(
  4241. 'userid' => $post_data['post_author'],
  4242. 'dateCreated' => $this->_convert_date( $post_data['post_date'] ),
  4243. 'content' => $content,
  4244. 'postid' => (string) $post_data['ID'],
  4245. );
  4246. return $struct;
  4247. }
  4248. /**
  4249. * Retrieve list of recent posts.
  4250. *
  4251. * @since 1.5.0
  4252. *
  4253. * @param array $args {
  4254. * Method arguments. Note: arguments must be ordered as documented.
  4255. *
  4256. * @type string $0 App key (unused).
  4257. * @type int $1 Blog ID (unused).
  4258. * @type string $2 Username.
  4259. * @type string $3 Password.
  4260. * @type int $4 Optional. Number of posts.
  4261. * }
  4262. * @return array|IXR_Error
  4263. */
  4264. public function blogger_getRecentPosts( $args ) {
  4265. $this->escape( $args );
  4266. // $args[0] = appkey - ignored.
  4267. $username = $args[2];
  4268. $password = $args[3];
  4269. if ( isset( $args[4] ) ) {
  4270. $query = array( 'numberposts' => absint( $args[4] ) );
  4271. } else {
  4272. $query = array();
  4273. }
  4274. $user = $this->login( $username, $password );
  4275. if ( ! $user ) {
  4276. return $this->error;
  4277. }
  4278. if ( ! current_user_can( 'edit_posts' ) ) {
  4279. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts.' ) );
  4280. }
  4281. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4282. do_action( 'xmlrpc_call', 'blogger.getRecentPosts', $args, $this );
  4283. $posts_list = wp_get_recent_posts( $query );
  4284. if ( ! $posts_list ) {
  4285. $this->error = new IXR_Error( 500, __( 'Either there are no posts, or something went wrong.' ) );
  4286. return $this->error;
  4287. }
  4288. $recent_posts = array();
  4289. foreach ( $posts_list as $entry ) {
  4290. if ( ! current_user_can( 'edit_post', $entry['ID'] ) ) {
  4291. continue;
  4292. }
  4293. $post_date = $this->_convert_date( $entry['post_date'] );
  4294. $categories = implode( ',', wp_get_post_categories( $entry['ID'] ) );
  4295. $content = '<title>' . wp_unslash( $entry['post_title'] ) . '</title>';
  4296. $content .= '<category>' . $categories . '</category>';
  4297. $content .= wp_unslash( $entry['post_content'] );
  4298. $recent_posts[] = array(
  4299. 'userid' => $entry['post_author'],
  4300. 'dateCreated' => $post_date,
  4301. 'content' => $content,
  4302. 'postid' => (string) $entry['ID'],
  4303. );
  4304. }
  4305. return $recent_posts;
  4306. }
  4307. /**
  4308. * Deprecated.
  4309. *
  4310. * @since 1.5.0
  4311. * @deprecated 3.5.0
  4312. *
  4313. * @param array $args Unused.
  4314. * @return IXR_Error Error object.
  4315. */
  4316. public function blogger_getTemplate( $args ) {
  4317. return new IXR_Error( 403, __( 'Sorry, this method is not supported.' ) );
  4318. }
  4319. /**
  4320. * Deprecated.
  4321. *
  4322. * @since 1.5.0
  4323. * @deprecated 3.5.0
  4324. *
  4325. * @param array $args Unused.
  4326. * @return IXR_Error Error object.
  4327. */
  4328. public function blogger_setTemplate( $args ) {
  4329. return new IXR_Error( 403, __( 'Sorry, this method is not supported.' ) );
  4330. }
  4331. /**
  4332. * Creates new post.
  4333. *
  4334. * @since 1.5.0
  4335. *
  4336. * @param array $args {
  4337. * Method arguments. Note: arguments must be ordered as documented.
  4338. *
  4339. * @type string $0 App key (unused).
  4340. * @type int $1 Blog ID (unused).
  4341. * @type string $2 Username.
  4342. * @type string $3 Password.
  4343. * @type string $4 Content.
  4344. * @type int $5 Publish flag. 0 for draft, 1 for publish.
  4345. * }
  4346. * @return int|IXR_Error
  4347. */
  4348. public function blogger_newPost( $args ) {
  4349. $this->escape( $args );
  4350. $username = $args[2];
  4351. $password = $args[3];
  4352. $content = $args[4];
  4353. $publish = $args[5];
  4354. $user = $this->login( $username, $password );
  4355. if ( ! $user ) {
  4356. return $this->error;
  4357. }
  4358. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4359. do_action( 'xmlrpc_call', 'blogger.newPost', $args, $this );
  4360. $cap = ( $publish ) ? 'publish_posts' : 'edit_posts';
  4361. if ( ! current_user_can( get_post_type_object( 'post' )->cap->create_posts ) || ! current_user_can( $cap ) ) {
  4362. return new IXR_Error( 401, __( 'Sorry, you are not allowed to post on this site.' ) );
  4363. }
  4364. $post_status = ( $publish ) ? 'publish' : 'draft';
  4365. $post_author = $user->ID;
  4366. $post_title = xmlrpc_getposttitle( $content );
  4367. $post_category = xmlrpc_getpostcategory( $content );
  4368. $post_content = xmlrpc_removepostdata( $content );
  4369. $post_date = current_time( 'mysql' );
  4370. $post_date_gmt = current_time( 'mysql', 1 );
  4371. $post_data = compact( 'post_author', 'post_date', 'post_date_gmt', 'post_content', 'post_title', 'post_category', 'post_status' );
  4372. $post_ID = wp_insert_post( $post_data );
  4373. if ( is_wp_error( $post_ID ) ) {
  4374. return new IXR_Error( 500, $post_ID->get_error_message() );
  4375. }
  4376. if ( ! $post_ID ) {
  4377. return new IXR_Error( 500, __( 'Sorry, the post could not be created.' ) );
  4378. }
  4379. $this->attach_uploads( $post_ID, $post_content );
  4380. /**
  4381. * Fires after a new post has been successfully created via the XML-RPC Blogger API.
  4382. *
  4383. * @since 3.4.0
  4384. *
  4385. * @param int $post_ID ID of the new post.
  4386. * @param array $args An array of new post arguments.
  4387. */
  4388. do_action( 'xmlrpc_call_success_blogger_newPost', $post_ID, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  4389. return $post_ID;
  4390. }
  4391. /**
  4392. * Edit a post.
  4393. *
  4394. * @since 1.5.0
  4395. *
  4396. * @param array $args {
  4397. * Method arguments. Note: arguments must be ordered as documented.
  4398. *
  4399. * @type int $0 Blog ID (unused).
  4400. * @type int $1 Post ID.
  4401. * @type string $2 Username.
  4402. * @type string $3 Password.
  4403. * @type string $4 Content
  4404. * @type int $5 Publish flag. 0 for draft, 1 for publish.
  4405. * }
  4406. * @return true|IXR_Error true when done.
  4407. */
  4408. public function blogger_editPost( $args ) {
  4409. $this->escape( $args );
  4410. $post_ID = (int) $args[1];
  4411. $username = $args[2];
  4412. $password = $args[3];
  4413. $content = $args[4];
  4414. $publish = $args[5];
  4415. $user = $this->login( $username, $password );
  4416. if ( ! $user ) {
  4417. return $this->error;
  4418. }
  4419. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4420. do_action( 'xmlrpc_call', 'blogger.editPost', $args, $this );
  4421. $actual_post = get_post( $post_ID, ARRAY_A );
  4422. if ( ! $actual_post || 'post' !== $actual_post['post_type'] ) {
  4423. return new IXR_Error( 404, __( 'Sorry, no such post.' ) );
  4424. }
  4425. $this->escape( $actual_post );
  4426. if ( ! current_user_can( 'edit_post', $post_ID ) ) {
  4427. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  4428. }
  4429. if ( 'publish' === $actual_post['post_status'] && ! current_user_can( 'publish_posts' ) ) {
  4430. return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish this post.' ) );
  4431. }
  4432. $postdata = array();
  4433. $postdata['ID'] = $actual_post['ID'];
  4434. $postdata['post_content'] = xmlrpc_removepostdata( $content );
  4435. $postdata['post_title'] = xmlrpc_getposttitle( $content );
  4436. $postdata['post_category'] = xmlrpc_getpostcategory( $content );
  4437. $postdata['post_status'] = $actual_post['post_status'];
  4438. $postdata['post_excerpt'] = $actual_post['post_excerpt'];
  4439. $postdata['post_status'] = $publish ? 'publish' : 'draft';
  4440. $result = wp_update_post( $postdata );
  4441. if ( ! $result ) {
  4442. return new IXR_Error( 500, __( 'Sorry, the post could not be updated.' ) );
  4443. }
  4444. $this->attach_uploads( $actual_post['ID'], $postdata['post_content'] );
  4445. /**
  4446. * Fires after a post has been successfully updated via the XML-RPC Blogger API.
  4447. *
  4448. * @since 3.4.0
  4449. *
  4450. * @param int $post_ID ID of the updated post.
  4451. * @param array $args An array of arguments for the post to edit.
  4452. */
  4453. do_action( 'xmlrpc_call_success_blogger_editPost', $post_ID, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  4454. return true;
  4455. }
  4456. /**
  4457. * Remove a post.
  4458. *
  4459. * @since 1.5.0
  4460. *
  4461. * @param array $args {
  4462. * Method arguments. Note: arguments must be ordered as documented.
  4463. *
  4464. * @type int $0 Blog ID (unused).
  4465. * @type int $1 Post ID.
  4466. * @type string $2 Username.
  4467. * @type string $3 Password.
  4468. * }
  4469. * @return true|IXR_Error True when post is deleted.
  4470. */
  4471. public function blogger_deletePost( $args ) {
  4472. $this->escape( $args );
  4473. $post_ID = (int) $args[1];
  4474. $username = $args[2];
  4475. $password = $args[3];
  4476. $user = $this->login( $username, $password );
  4477. if ( ! $user ) {
  4478. return $this->error;
  4479. }
  4480. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4481. do_action( 'xmlrpc_call', 'blogger.deletePost', $args, $this );
  4482. $actual_post = get_post( $post_ID, ARRAY_A );
  4483. if ( ! $actual_post || 'post' !== $actual_post['post_type'] ) {
  4484. return new IXR_Error( 404, __( 'Sorry, no such post.' ) );
  4485. }
  4486. if ( ! current_user_can( 'delete_post', $post_ID ) ) {
  4487. return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this post.' ) );
  4488. }
  4489. $result = wp_delete_post( $post_ID );
  4490. if ( ! $result ) {
  4491. return new IXR_Error( 500, __( 'Sorry, the post could not be deleted.' ) );
  4492. }
  4493. /**
  4494. * Fires after a post has been successfully deleted via the XML-RPC Blogger API.
  4495. *
  4496. * @since 3.4.0
  4497. *
  4498. * @param int $post_ID ID of the deleted post.
  4499. * @param array $args An array of arguments to delete the post.
  4500. */
  4501. do_action( 'xmlrpc_call_success_blogger_deletePost', $post_ID, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  4502. return true;
  4503. }
  4504. /*
  4505. * MetaWeblog API functions.
  4506. * Specs on wherever Dave Winer wants them to be.
  4507. */
  4508. /**
  4509. * Create a new post.
  4510. *
  4511. * The 'content_struct' argument must contain:
  4512. * - title
  4513. * - description
  4514. * - mt_excerpt
  4515. * - mt_text_more
  4516. * - mt_keywords
  4517. * - mt_tb_ping_urls
  4518. * - categories
  4519. *
  4520. * Also, it can optionally contain:
  4521. * - wp_slug
  4522. * - wp_password
  4523. * - wp_page_parent_id
  4524. * - wp_page_order
  4525. * - wp_author_id
  4526. * - post_status | page_status - can be 'draft', 'private', 'publish', or 'pending'
  4527. * - mt_allow_comments - can be 'open' or 'closed'
  4528. * - mt_allow_pings - can be 'open' or 'closed'
  4529. * - date_created_gmt
  4530. * - dateCreated
  4531. * - wp_post_thumbnail
  4532. *
  4533. * @since 1.5.0
  4534. *
  4535. * @param array $args {
  4536. * Method arguments. Note: arguments must be ordered as documented.
  4537. *
  4538. * @type int $0 Blog ID (unused).
  4539. * @type string $1 Username.
  4540. * @type string $2 Password.
  4541. * @type array $3 Content structure.
  4542. * @type int $4 Optional. Publish flag. 0 for draft, 1 for publish. Default 0.
  4543. * }
  4544. * @return int|IXR_Error
  4545. */
  4546. public function mw_newPost( $args ) {
  4547. $this->escape( $args );
  4548. $username = $args[1];
  4549. $password = $args[2];
  4550. $content_struct = $args[3];
  4551. $publish = isset( $args[4] ) ? $args[4] : 0;
  4552. $user = $this->login( $username, $password );
  4553. if ( ! $user ) {
  4554. return $this->error;
  4555. }
  4556. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4557. do_action( 'xmlrpc_call', 'metaWeblog.newPost', $args, $this );
  4558. $page_template = '';
  4559. if ( ! empty( $content_struct['post_type'] ) ) {
  4560. if ( 'page' === $content_struct['post_type'] ) {
  4561. if ( $publish ) {
  4562. $cap = 'publish_pages';
  4563. } elseif ( isset( $content_struct['page_status'] ) && 'publish' === $content_struct['page_status'] ) {
  4564. $cap = 'publish_pages';
  4565. } else {
  4566. $cap = 'edit_pages';
  4567. }
  4568. $error_message = __( 'Sorry, you are not allowed to publish pages on this site.' );
  4569. $post_type = 'page';
  4570. if ( ! empty( $content_struct['wp_page_template'] ) ) {
  4571. $page_template = $content_struct['wp_page_template'];
  4572. }
  4573. } elseif ( 'post' === $content_struct['post_type'] ) {
  4574. if ( $publish ) {
  4575. $cap = 'publish_posts';
  4576. } elseif ( isset( $content_struct['post_status'] ) && 'publish' === $content_struct['post_status'] ) {
  4577. $cap = 'publish_posts';
  4578. } else {
  4579. $cap = 'edit_posts';
  4580. }
  4581. $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
  4582. $post_type = 'post';
  4583. } else {
  4584. // No other 'post_type' values are allowed here.
  4585. return new IXR_Error( 401, __( 'Invalid post type.' ) );
  4586. }
  4587. } else {
  4588. if ( $publish ) {
  4589. $cap = 'publish_posts';
  4590. } elseif ( isset( $content_struct['post_status'] ) && 'publish' === $content_struct['post_status'] ) {
  4591. $cap = 'publish_posts';
  4592. } else {
  4593. $cap = 'edit_posts';
  4594. }
  4595. $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
  4596. $post_type = 'post';
  4597. }
  4598. if ( ! current_user_can( get_post_type_object( $post_type )->cap->create_posts ) ) {
  4599. return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish posts on this site.' ) );
  4600. }
  4601. if ( ! current_user_can( $cap ) ) {
  4602. return new IXR_Error( 401, $error_message );
  4603. }
  4604. // Check for a valid post format if one was given.
  4605. if ( isset( $content_struct['wp_post_format'] ) ) {
  4606. $content_struct['wp_post_format'] = sanitize_key( $content_struct['wp_post_format'] );
  4607. if ( ! array_key_exists( $content_struct['wp_post_format'], get_post_format_strings() ) ) {
  4608. return new IXR_Error( 404, __( 'Invalid post format.' ) );
  4609. }
  4610. }
  4611. // Let WordPress generate the 'post_name' (slug) unless
  4612. // one has been provided.
  4613. $post_name = null;
  4614. if ( isset( $content_struct['wp_slug'] ) ) {
  4615. $post_name = $content_struct['wp_slug'];
  4616. }
  4617. // Only use a password if one was given.
  4618. $post_password = '';
  4619. if ( isset( $content_struct['wp_password'] ) ) {
  4620. $post_password = $content_struct['wp_password'];
  4621. }
  4622. // Only set a post parent if one was given.
  4623. $post_parent = 0;
  4624. if ( isset( $content_struct['wp_page_parent_id'] ) ) {
  4625. $post_parent = $content_struct['wp_page_parent_id'];
  4626. }
  4627. // Only set the 'menu_order' if it was given.
  4628. $menu_order = 0;
  4629. if ( isset( $content_struct['wp_page_order'] ) ) {
  4630. $menu_order = $content_struct['wp_page_order'];
  4631. }
  4632. $post_author = $user->ID;
  4633. // If an author id was provided then use it instead.
  4634. if ( isset( $content_struct['wp_author_id'] ) && ( $user->ID != $content_struct['wp_author_id'] ) ) {
  4635. switch ( $post_type ) {
  4636. case 'post':
  4637. if ( ! current_user_can( 'edit_others_posts' ) ) {
  4638. return new IXR_Error( 401, __( 'Sorry, you are not allowed to create posts as this user.' ) );
  4639. }
  4640. break;
  4641. case 'page':
  4642. if ( ! current_user_can( 'edit_others_pages' ) ) {
  4643. return new IXR_Error( 401, __( 'Sorry, you are not allowed to create pages as this user.' ) );
  4644. }
  4645. break;
  4646. default:
  4647. return new IXR_Error( 401, __( 'Invalid post type.' ) );
  4648. }
  4649. $author = get_userdata( $content_struct['wp_author_id'] );
  4650. if ( ! $author ) {
  4651. return new IXR_Error( 404, __( 'Invalid author ID.' ) );
  4652. }
  4653. $post_author = $content_struct['wp_author_id'];
  4654. }
  4655. $post_title = isset( $content_struct['title'] ) ? $content_struct['title'] : '';
  4656. $post_content = isset( $content_struct['description'] ) ? $content_struct['description'] : '';
  4657. $post_status = $publish ? 'publish' : 'draft';
  4658. if ( isset( $content_struct[ "{$post_type}_status" ] ) ) {
  4659. switch ( $content_struct[ "{$post_type}_status" ] ) {
  4660. case 'draft':
  4661. case 'pending':
  4662. case 'private':
  4663. case 'publish':
  4664. $post_status = $content_struct[ "{$post_type}_status" ];
  4665. break;
  4666. default:
  4667. // Deliberably left empty.
  4668. break;
  4669. }
  4670. }
  4671. $post_excerpt = isset( $content_struct['mt_excerpt'] ) ? $content_struct['mt_excerpt'] : '';
  4672. $post_more = isset( $content_struct['mt_text_more'] ) ? $content_struct['mt_text_more'] : '';
  4673. $tags_input = isset( $content_struct['mt_keywords'] ) ? $content_struct['mt_keywords'] : array();
  4674. if ( isset( $content_struct['mt_allow_comments'] ) ) {
  4675. if ( ! is_numeric( $content_struct['mt_allow_comments'] ) ) {
  4676. switch ( $content_struct['mt_allow_comments'] ) {
  4677. case 'closed':
  4678. $comment_status = 'closed';
  4679. break;
  4680. case 'open':
  4681. $comment_status = 'open';
  4682. break;
  4683. default:
  4684. $comment_status = get_default_comment_status( $post_type );
  4685. break;
  4686. }
  4687. } else {
  4688. switch ( (int) $content_struct['mt_allow_comments'] ) {
  4689. case 0:
  4690. case 2:
  4691. $comment_status = 'closed';
  4692. break;
  4693. case 1:
  4694. $comment_status = 'open';
  4695. break;
  4696. default:
  4697. $comment_status = get_default_comment_status( $post_type );
  4698. break;
  4699. }
  4700. }
  4701. } else {
  4702. $comment_status = get_default_comment_status( $post_type );
  4703. }
  4704. if ( isset( $content_struct['mt_allow_pings'] ) ) {
  4705. if ( ! is_numeric( $content_struct['mt_allow_pings'] ) ) {
  4706. switch ( $content_struct['mt_allow_pings'] ) {
  4707. case 'closed':
  4708. $ping_status = 'closed';
  4709. break;
  4710. case 'open':
  4711. $ping_status = 'open';
  4712. break;
  4713. default:
  4714. $ping_status = get_default_comment_status( $post_type, 'pingback' );
  4715. break;
  4716. }
  4717. } else {
  4718. switch ( (int) $content_struct['mt_allow_pings'] ) {
  4719. case 0:
  4720. $ping_status = 'closed';
  4721. break;
  4722. case 1:
  4723. $ping_status = 'open';
  4724. break;
  4725. default:
  4726. $ping_status = get_default_comment_status( $post_type, 'pingback' );
  4727. break;
  4728. }
  4729. }
  4730. } else {
  4731. $ping_status = get_default_comment_status( $post_type, 'pingback' );
  4732. }
  4733. if ( $post_more ) {
  4734. $post_content .= '<!--more-->' . $post_more;
  4735. }
  4736. $to_ping = '';
  4737. if ( isset( $content_struct['mt_tb_ping_urls'] ) ) {
  4738. $to_ping = $content_struct['mt_tb_ping_urls'];
  4739. if ( is_array( $to_ping ) ) {
  4740. $to_ping = implode( ' ', $to_ping );
  4741. }
  4742. }
  4743. // Do some timestamp voodoo.
  4744. if ( ! empty( $content_struct['date_created_gmt'] ) ) {
  4745. // We know this is supposed to be GMT, so we're going to slap that Z on there by force.
  4746. $dateCreated = rtrim( $content_struct['date_created_gmt']->getIso(), 'Z' ) . 'Z';
  4747. } elseif ( ! empty( $content_struct['dateCreated'] ) ) {
  4748. $dateCreated = $content_struct['dateCreated']->getIso();
  4749. }
  4750. $post_date = '';
  4751. $post_date_gmt = '';
  4752. if ( ! empty( $dateCreated ) ) {
  4753. $post_date = iso8601_to_datetime( $dateCreated );
  4754. $post_date_gmt = iso8601_to_datetime( $dateCreated, 'gmt' );
  4755. }
  4756. $post_category = array();
  4757. if ( isset( $content_struct['categories'] ) ) {
  4758. $catnames = $content_struct['categories'];
  4759. if ( is_array( $catnames ) ) {
  4760. foreach ( $catnames as $cat ) {
  4761. $post_category[] = get_cat_ID( $cat );
  4762. }
  4763. }
  4764. }
  4765. $postdata = compact( 'post_author', 'post_date', 'post_date_gmt', 'post_content', 'post_title', 'post_category', 'post_status', 'post_excerpt', 'comment_status', 'ping_status', 'to_ping', 'post_type', 'post_name', 'post_password', 'post_parent', 'menu_order', 'tags_input', 'page_template' );
  4766. $post_ID = get_default_post_to_edit( $post_type, true )->ID;
  4767. $postdata['ID'] = $post_ID;
  4768. // Only posts can be sticky.
  4769. if ( 'post' === $post_type && isset( $content_struct['sticky'] ) ) {
  4770. $data = $postdata;
  4771. $data['sticky'] = $content_struct['sticky'];
  4772. $error = $this->_toggle_sticky( $data );
  4773. if ( $error ) {
  4774. return $error;
  4775. }
  4776. }
  4777. if ( isset( $content_struct['custom_fields'] ) ) {
  4778. $this->set_custom_fields( $post_ID, $content_struct['custom_fields'] );
  4779. }
  4780. if ( isset( $content_struct['wp_post_thumbnail'] ) ) {
  4781. if ( set_post_thumbnail( $post_ID, $content_struct['wp_post_thumbnail'] ) === false ) {
  4782. return new IXR_Error( 404, __( 'Invalid attachment ID.' ) );
  4783. }
  4784. unset( $content_struct['wp_post_thumbnail'] );
  4785. }
  4786. // Handle enclosures.
  4787. $thisEnclosure = isset( $content_struct['enclosure'] ) ? $content_struct['enclosure'] : null;
  4788. $this->add_enclosure_if_new( $post_ID, $thisEnclosure );
  4789. $this->attach_uploads( $post_ID, $post_content );
  4790. // Handle post formats if assigned, value is validated earlier
  4791. // in this function.
  4792. if ( isset( $content_struct['wp_post_format'] ) ) {
  4793. set_post_format( $post_ID, $content_struct['wp_post_format'] );
  4794. }
  4795. $post_ID = wp_insert_post( $postdata, true );
  4796. if ( is_wp_error( $post_ID ) ) {
  4797. return new IXR_Error( 500, $post_ID->get_error_message() );
  4798. }
  4799. if ( ! $post_ID ) {
  4800. return new IXR_Error( 500, __( 'Sorry, the post could not be created.' ) );
  4801. }
  4802. /**
  4803. * Fires after a new post has been successfully created via the XML-RPC MovableType API.
  4804. *
  4805. * @since 3.4.0
  4806. *
  4807. * @param int $post_ID ID of the new post.
  4808. * @param array $args An array of arguments to create the new post.
  4809. */
  4810. do_action( 'xmlrpc_call_success_mw_newPost', $post_ID, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  4811. return (string) $post_ID;
  4812. }
  4813. /**
  4814. * Adds an enclosure to a post if it's new.
  4815. *
  4816. * @since 2.8.0
  4817. *
  4818. * @param int $post_ID Post ID.
  4819. * @param array $enclosure Enclosure data.
  4820. */
  4821. public function add_enclosure_if_new( $post_ID, $enclosure ) {
  4822. if ( is_array( $enclosure ) && isset( $enclosure['url'] ) && isset( $enclosure['length'] ) && isset( $enclosure['type'] ) ) {
  4823. $encstring = $enclosure['url'] . "\n" . $enclosure['length'] . "\n" . $enclosure['type'] . "\n";
  4824. $found = false;
  4825. $enclosures = get_post_meta( $post_ID, 'enclosure' );
  4826. if ( $enclosures ) {
  4827. foreach ( $enclosures as $enc ) {
  4828. // This method used to omit the trailing new line. #23219
  4829. if ( rtrim( $enc, "\n" ) == rtrim( $encstring, "\n" ) ) {
  4830. $found = true;
  4831. break;
  4832. }
  4833. }
  4834. }
  4835. if ( ! $found ) {
  4836. add_post_meta( $post_ID, 'enclosure', $encstring );
  4837. }
  4838. }
  4839. }
  4840. /**
  4841. * Attach upload to a post.
  4842. *
  4843. * @since 2.1.0
  4844. *
  4845. * @global wpdb $wpdb WordPress database abstraction object.
  4846. *
  4847. * @param int $post_ID Post ID.
  4848. * @param string $post_content Post Content for attachment.
  4849. */
  4850. public function attach_uploads( $post_ID, $post_content ) {
  4851. global $wpdb;
  4852. // Find any unattached files.
  4853. $attachments = $wpdb->get_results( "SELECT ID, guid FROM {$wpdb->posts} WHERE post_parent = '0' AND post_type = 'attachment'" );
  4854. if ( is_array( $attachments ) ) {
  4855. foreach ( $attachments as $file ) {
  4856. if ( ! empty( $file->guid ) && strpos( $post_content, $file->guid ) !== false ) {
  4857. $wpdb->update( $wpdb->posts, array( 'post_parent' => $post_ID ), array( 'ID' => $file->ID ) );
  4858. }
  4859. }
  4860. }
  4861. }
  4862. /**
  4863. * Edit a post.
  4864. *
  4865. * @since 1.5.0
  4866. *
  4867. * @param array $args {
  4868. * Method arguments. Note: arguments must be ordered as documented.
  4869. *
  4870. * @type int $0 Post ID.
  4871. * @type string $1 Username.
  4872. * @type string $2 Password.
  4873. * @type array $3 Content structure.
  4874. * @type int $4 Optional. Publish flag. 0 for draft, 1 for publish. Default 0.
  4875. * }
  4876. * @return true|IXR_Error True on success.
  4877. */
  4878. public function mw_editPost( $args ) {
  4879. $this->escape( $args );
  4880. $post_ID = (int) $args[0];
  4881. $username = $args[1];
  4882. $password = $args[2];
  4883. $content_struct = $args[3];
  4884. $publish = isset( $args[4] ) ? $args[4] : 0;
  4885. $user = $this->login( $username, $password );
  4886. if ( ! $user ) {
  4887. return $this->error;
  4888. }
  4889. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4890. do_action( 'xmlrpc_call', 'metaWeblog.editPost', $args, $this );
  4891. $postdata = get_post( $post_ID, ARRAY_A );
  4892. /*
  4893. * If there is no post data for the give post ID, stop now and return an error.
  4894. * Otherwise a new post will be created (which was the old behavior).
  4895. */
  4896. if ( ! $postdata || empty( $postdata['ID'] ) ) {
  4897. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  4898. }
  4899. if ( ! current_user_can( 'edit_post', $post_ID ) ) {
  4900. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  4901. }
  4902. // Use wp.editPost to edit post types other than post and page.
  4903. if ( ! in_array( $postdata['post_type'], array( 'post', 'page' ), true ) ) {
  4904. return new IXR_Error( 401, __( 'Invalid post type.' ) );
  4905. }
  4906. // Thwart attempt to change the post type.
  4907. if ( ! empty( $content_struct['post_type'] ) && ( $content_struct['post_type'] != $postdata['post_type'] ) ) {
  4908. return new IXR_Error( 401, __( 'The post type may not be changed.' ) );
  4909. }
  4910. // Check for a valid post format if one was given.
  4911. if ( isset( $content_struct['wp_post_format'] ) ) {
  4912. $content_struct['wp_post_format'] = sanitize_key( $content_struct['wp_post_format'] );
  4913. if ( ! array_key_exists( $content_struct['wp_post_format'], get_post_format_strings() ) ) {
  4914. return new IXR_Error( 404, __( 'Invalid post format.' ) );
  4915. }
  4916. }
  4917. $this->escape( $postdata );
  4918. $ID = $postdata['ID'];
  4919. $post_content = $postdata['post_content'];
  4920. $post_title = $postdata['post_title'];
  4921. $post_excerpt = $postdata['post_excerpt'];
  4922. $post_password = $postdata['post_password'];
  4923. $post_parent = $postdata['post_parent'];
  4924. $post_type = $postdata['post_type'];
  4925. $menu_order = $postdata['menu_order'];
  4926. $ping_status = $postdata['ping_status'];
  4927. $comment_status = $postdata['comment_status'];
  4928. // Let WordPress manage slug if none was provided.
  4929. $post_name = $postdata['post_name'];
  4930. if ( isset( $content_struct['wp_slug'] ) ) {
  4931. $post_name = $content_struct['wp_slug'];
  4932. }
  4933. // Only use a password if one was given.
  4934. if ( isset( $content_struct['wp_password'] ) ) {
  4935. $post_password = $content_struct['wp_password'];
  4936. }
  4937. // Only set a post parent if one was given.
  4938. if ( isset( $content_struct['wp_page_parent_id'] ) ) {
  4939. $post_parent = $content_struct['wp_page_parent_id'];
  4940. }
  4941. // Only set the 'menu_order' if it was given.
  4942. if ( isset( $content_struct['wp_page_order'] ) ) {
  4943. $menu_order = $content_struct['wp_page_order'];
  4944. }
  4945. $page_template = '';
  4946. if ( ! empty( $content_struct['wp_page_template'] ) && 'page' === $post_type ) {
  4947. $page_template = $content_struct['wp_page_template'];
  4948. }
  4949. $post_author = $postdata['post_author'];
  4950. // If an author id was provided then use it instead.
  4951. if ( isset( $content_struct['wp_author_id'] ) ) {
  4952. // Check permissions if attempting to switch author to or from another user.
  4953. if ( $user->ID != $content_struct['wp_author_id'] || $user->ID != $post_author ) {
  4954. switch ( $post_type ) {
  4955. case 'post':
  4956. if ( ! current_user_can( 'edit_others_posts' ) ) {
  4957. return new IXR_Error( 401, __( 'Sorry, you are not allowed to change the post author as this user.' ) );
  4958. }
  4959. break;
  4960. case 'page':
  4961. if ( ! current_user_can( 'edit_others_pages' ) ) {
  4962. return new IXR_Error( 401, __( 'Sorry, you are not allowed to change the page author as this user.' ) );
  4963. }
  4964. break;
  4965. default:
  4966. return new IXR_Error( 401, __( 'Invalid post type.' ) );
  4967. }
  4968. $post_author = $content_struct['wp_author_id'];
  4969. }
  4970. }
  4971. if ( isset( $content_struct['mt_allow_comments'] ) ) {
  4972. if ( ! is_numeric( $content_struct['mt_allow_comments'] ) ) {
  4973. switch ( $content_struct['mt_allow_comments'] ) {
  4974. case 'closed':
  4975. $comment_status = 'closed';
  4976. break;
  4977. case 'open':
  4978. $comment_status = 'open';
  4979. break;
  4980. default:
  4981. $comment_status = get_default_comment_status( $post_type );
  4982. break;
  4983. }
  4984. } else {
  4985. switch ( (int) $content_struct['mt_allow_comments'] ) {
  4986. case 0:
  4987. case 2:
  4988. $comment_status = 'closed';
  4989. break;
  4990. case 1:
  4991. $comment_status = 'open';
  4992. break;
  4993. default:
  4994. $comment_status = get_default_comment_status( $post_type );
  4995. break;
  4996. }
  4997. }
  4998. }
  4999. if ( isset( $content_struct['mt_allow_pings'] ) ) {
  5000. if ( ! is_numeric( $content_struct['mt_allow_pings'] ) ) {
  5001. switch ( $content_struct['mt_allow_pings'] ) {
  5002. case 'closed':
  5003. $ping_status = 'closed';
  5004. break;
  5005. case 'open':
  5006. $ping_status = 'open';
  5007. break;
  5008. default:
  5009. $ping_status = get_default_comment_status( $post_type, 'pingback' );
  5010. break;
  5011. }
  5012. } else {
  5013. switch ( (int) $content_struct['mt_allow_pings'] ) {
  5014. case 0:
  5015. $ping_status = 'closed';
  5016. break;
  5017. case 1:
  5018. $ping_status = 'open';
  5019. break;
  5020. default:
  5021. $ping_status = get_default_comment_status( $post_type, 'pingback' );
  5022. break;
  5023. }
  5024. }
  5025. }
  5026. if ( isset( $content_struct['title'] ) ) {
  5027. $post_title = $content_struct['title'];
  5028. }
  5029. if ( isset( $content_struct['description'] ) ) {
  5030. $post_content = $content_struct['description'];
  5031. }
  5032. $post_category = array();
  5033. if ( isset( $content_struct['categories'] ) ) {
  5034. $catnames = $content_struct['categories'];
  5035. if ( is_array( $catnames ) ) {
  5036. foreach ( $catnames as $cat ) {
  5037. $post_category[] = get_cat_ID( $cat );
  5038. }
  5039. }
  5040. }
  5041. if ( isset( $content_struct['mt_excerpt'] ) ) {
  5042. $post_excerpt = $content_struct['mt_excerpt'];
  5043. }
  5044. $post_more = isset( $content_struct['mt_text_more'] ) ? $content_struct['mt_text_more'] : '';
  5045. $post_status = $publish ? 'publish' : 'draft';
  5046. if ( isset( $content_struct[ "{$post_type}_status" ] ) ) {
  5047. switch ( $content_struct[ "{$post_type}_status" ] ) {
  5048. case 'draft':
  5049. case 'pending':
  5050. case 'private':
  5051. case 'publish':
  5052. $post_status = $content_struct[ "{$post_type}_status" ];
  5053. break;
  5054. default:
  5055. $post_status = $publish ? 'publish' : 'draft';
  5056. break;
  5057. }
  5058. }
  5059. $tags_input = isset( $content_struct['mt_keywords'] ) ? $content_struct['mt_keywords'] : array();
  5060. if ( 'publish' === $post_status || 'private' === $post_status ) {
  5061. if ( 'page' === $post_type && ! current_user_can( 'publish_pages' ) ) {
  5062. return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish this page.' ) );
  5063. } elseif ( ! current_user_can( 'publish_posts' ) ) {
  5064. return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish this post.' ) );
  5065. }
  5066. }
  5067. if ( $post_more ) {
  5068. $post_content = $post_content . '<!--more-->' . $post_more;
  5069. }
  5070. $to_ping = '';
  5071. if ( isset( $content_struct['mt_tb_ping_urls'] ) ) {
  5072. $to_ping = $content_struct['mt_tb_ping_urls'];
  5073. if ( is_array( $to_ping ) ) {
  5074. $to_ping = implode( ' ', $to_ping );
  5075. }
  5076. }
  5077. // Do some timestamp voodoo.
  5078. if ( ! empty( $content_struct['date_created_gmt'] ) ) {
  5079. // We know this is supposed to be GMT, so we're going to slap that Z on there by force.
  5080. $dateCreated = rtrim( $content_struct['date_created_gmt']->getIso(), 'Z' ) . 'Z';
  5081. } elseif ( ! empty( $content_struct['dateCreated'] ) ) {
  5082. $dateCreated = $content_struct['dateCreated']->getIso();
  5083. }
  5084. // Default to not flagging the post date to be edited unless it's intentional.
  5085. $edit_date = false;
  5086. if ( ! empty( $dateCreated ) ) {
  5087. $post_date = iso8601_to_datetime( $dateCreated );
  5088. $post_date_gmt = iso8601_to_datetime( $dateCreated, 'gmt' );
  5089. // Flag the post date to be edited.
  5090. $edit_date = true;
  5091. } else {
  5092. $post_date = $postdata['post_date'];
  5093. $post_date_gmt = $postdata['post_date_gmt'];
  5094. }
  5095. // We've got all the data -- post it.
  5096. $newpost = compact( 'ID', 'post_content', 'post_title', 'post_category', 'post_status', 'post_excerpt', 'comment_status', 'ping_status', 'edit_date', 'post_date', 'post_date_gmt', 'to_ping', 'post_name', 'post_password', 'post_parent', 'menu_order', 'post_author', 'tags_input', 'page_template' );
  5097. $result = wp_update_post( $newpost, true );
  5098. if ( is_wp_error( $result ) ) {
  5099. return new IXR_Error( 500, $result->get_error_message() );
  5100. }
  5101. if ( ! $result ) {
  5102. return new IXR_Error( 500, __( 'Sorry, the post could not be updated.' ) );
  5103. }
  5104. // Only posts can be sticky.
  5105. if ( 'post' === $post_type && isset( $content_struct['sticky'] ) ) {
  5106. $data = $newpost;
  5107. $data['sticky'] = $content_struct['sticky'];
  5108. $data['post_type'] = 'post';
  5109. $error = $this->_toggle_sticky( $data, true );
  5110. if ( $error ) {
  5111. return $error;
  5112. }
  5113. }
  5114. if ( isset( $content_struct['custom_fields'] ) ) {
  5115. $this->set_custom_fields( $post_ID, $content_struct['custom_fields'] );
  5116. }
  5117. if ( isset( $content_struct['wp_post_thumbnail'] ) ) {
  5118. // Empty value deletes, non-empty value adds/updates.
  5119. if ( empty( $content_struct['wp_post_thumbnail'] ) ) {
  5120. delete_post_thumbnail( $post_ID );
  5121. } else {
  5122. if ( set_post_thumbnail( $post_ID, $content_struct['wp_post_thumbnail'] ) === false ) {
  5123. return new IXR_Error( 404, __( 'Invalid attachment ID.' ) );
  5124. }
  5125. }
  5126. unset( $content_struct['wp_post_thumbnail'] );
  5127. }
  5128. // Handle enclosures.
  5129. $thisEnclosure = isset( $content_struct['enclosure'] ) ? $content_struct['enclosure'] : null;
  5130. $this->add_enclosure_if_new( $post_ID, $thisEnclosure );
  5131. $this->attach_uploads( $ID, $post_content );
  5132. // Handle post formats if assigned, validation is handled earlier in this function.
  5133. if ( isset( $content_struct['wp_post_format'] ) ) {
  5134. set_post_format( $post_ID, $content_struct['wp_post_format'] );
  5135. }
  5136. /**
  5137. * Fires after a post has been successfully updated via the XML-RPC MovableType API.
  5138. *
  5139. * @since 3.4.0
  5140. *
  5141. * @param int $post_ID ID of the updated post.
  5142. * @param array $args An array of arguments to update the post.
  5143. */
  5144. do_action( 'xmlrpc_call_success_mw_editPost', $post_ID, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  5145. return true;
  5146. }
  5147. /**
  5148. * Retrieve post.
  5149. *
  5150. * @since 1.5.0
  5151. *
  5152. * @param array $args {
  5153. * Method arguments. Note: arguments must be ordered as documented.
  5154. *
  5155. * @type int $0 Post ID.
  5156. * @type string $1 Username.
  5157. * @type string $2 Password.
  5158. * }
  5159. * @return array|IXR_Error
  5160. */
  5161. public function mw_getPost( $args ) {
  5162. $this->escape( $args );
  5163. $post_ID = (int) $args[0];
  5164. $username = $args[1];
  5165. $password = $args[2];
  5166. $user = $this->login( $username, $password );
  5167. if ( ! $user ) {
  5168. return $this->error;
  5169. }
  5170. $postdata = get_post( $post_ID, ARRAY_A );
  5171. if ( ! $postdata ) {
  5172. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  5173. }
  5174. if ( ! current_user_can( 'edit_post', $post_ID ) ) {
  5175. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  5176. }
  5177. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5178. do_action( 'xmlrpc_call', 'metaWeblog.getPost', $args, $this );
  5179. if ( '' !== $postdata['post_date'] ) {
  5180. $post_date = $this->_convert_date( $postdata['post_date'] );
  5181. $post_date_gmt = $this->_convert_date_gmt( $postdata['post_date_gmt'], $postdata['post_date'] );
  5182. $post_modified = $this->_convert_date( $postdata['post_modified'] );
  5183. $post_modified_gmt = $this->_convert_date_gmt( $postdata['post_modified_gmt'], $postdata['post_modified'] );
  5184. $categories = array();
  5185. $catids = wp_get_post_categories( $post_ID );
  5186. foreach ( $catids as $catid ) {
  5187. $categories[] = get_cat_name( $catid );
  5188. }
  5189. $tagnames = array();
  5190. $tags = wp_get_post_tags( $post_ID );
  5191. if ( ! empty( $tags ) ) {
  5192. foreach ( $tags as $tag ) {
  5193. $tagnames[] = $tag->name;
  5194. }
  5195. $tagnames = implode( ', ', $tagnames );
  5196. } else {
  5197. $tagnames = '';
  5198. }
  5199. $post = get_extended( $postdata['post_content'] );
  5200. $link = get_permalink( $postdata['ID'] );
  5201. // Get the author info.
  5202. $author = get_userdata( $postdata['post_author'] );
  5203. $allow_comments = ( 'open' === $postdata['comment_status'] ) ? 1 : 0;
  5204. $allow_pings = ( 'open' === $postdata['ping_status'] ) ? 1 : 0;
  5205. // Consider future posts as published.
  5206. if ( 'future' === $postdata['post_status'] ) {
  5207. $postdata['post_status'] = 'publish';
  5208. }
  5209. // Get post format.
  5210. $post_format = get_post_format( $post_ID );
  5211. if ( empty( $post_format ) ) {
  5212. $post_format = 'standard';
  5213. }
  5214. $sticky = false;
  5215. if ( is_sticky( $post_ID ) ) {
  5216. $sticky = true;
  5217. }
  5218. $enclosure = array();
  5219. foreach ( (array) get_post_custom( $post_ID ) as $key => $val ) {
  5220. if ( 'enclosure' === $key ) {
  5221. foreach ( (array) $val as $enc ) {
  5222. $encdata = explode( "\n", $enc );
  5223. $enclosure['url'] = trim( htmlspecialchars( $encdata[0] ) );
  5224. $enclosure['length'] = (int) trim( $encdata[1] );
  5225. $enclosure['type'] = trim( $encdata[2] );
  5226. break 2;
  5227. }
  5228. }
  5229. }
  5230. $resp = array(
  5231. 'dateCreated' => $post_date,
  5232. 'userid' => $postdata['post_author'],
  5233. 'postid' => $postdata['ID'],
  5234. 'description' => $post['main'],
  5235. 'title' => $postdata['post_title'],
  5236. 'link' => $link,
  5237. 'permaLink' => $link,
  5238. // Commented out because no other tool seems to use this.
  5239. // 'content' => $entry['post_content'],
  5240. 'categories' => $categories,
  5241. 'mt_excerpt' => $postdata['post_excerpt'],
  5242. 'mt_text_more' => $post['extended'],
  5243. 'wp_more_text' => $post['more_text'],
  5244. 'mt_allow_comments' => $allow_comments,
  5245. 'mt_allow_pings' => $allow_pings,
  5246. 'mt_keywords' => $tagnames,
  5247. 'wp_slug' => $postdata['post_name'],
  5248. 'wp_password' => $postdata['post_password'],
  5249. 'wp_author_id' => (string) $author->ID,
  5250. 'wp_author_display_name' => $author->display_name,
  5251. 'date_created_gmt' => $post_date_gmt,
  5252. 'post_status' => $postdata['post_status'],
  5253. 'custom_fields' => $this->get_custom_fields( $post_ID ),
  5254. 'wp_post_format' => $post_format,
  5255. 'sticky' => $sticky,
  5256. 'date_modified' => $post_modified,
  5257. 'date_modified_gmt' => $post_modified_gmt,
  5258. );
  5259. if ( ! empty( $enclosure ) ) {
  5260. $resp['enclosure'] = $enclosure;
  5261. }
  5262. $resp['wp_post_thumbnail'] = get_post_thumbnail_id( $postdata['ID'] );
  5263. return $resp;
  5264. } else {
  5265. return new IXR_Error( 404, __( 'Sorry, no such post.' ) );
  5266. }
  5267. }
  5268. /**
  5269. * Retrieve list of recent posts.
  5270. *
  5271. * @since 1.5.0
  5272. *
  5273. * @param array $args {
  5274. * Method arguments. Note: arguments must be ordered as documented.
  5275. *
  5276. * @type int $0 Blog ID (unused).
  5277. * @type string $1 Username.
  5278. * @type string $2 Password.
  5279. * @type int $3 Optional. Number of posts.
  5280. * }
  5281. * @return array|IXR_Error
  5282. */
  5283. public function mw_getRecentPosts( $args ) {
  5284. $this->escape( $args );
  5285. $username = $args[1];
  5286. $password = $args[2];
  5287. if ( isset( $args[3] ) ) {
  5288. $query = array( 'numberposts' => absint( $args[3] ) );
  5289. } else {
  5290. $query = array();
  5291. }
  5292. $user = $this->login( $username, $password );
  5293. if ( ! $user ) {
  5294. return $this->error;
  5295. }
  5296. if ( ! current_user_can( 'edit_posts' ) ) {
  5297. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts.' ) );
  5298. }
  5299. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5300. do_action( 'xmlrpc_call', 'metaWeblog.getRecentPosts', $args, $this );
  5301. $posts_list = wp_get_recent_posts( $query );
  5302. if ( ! $posts_list ) {
  5303. return array();
  5304. }
  5305. $recent_posts = array();
  5306. foreach ( $posts_list as $entry ) {
  5307. if ( ! current_user_can( 'edit_post', $entry['ID'] ) ) {
  5308. continue;
  5309. }
  5310. $post_date = $this->_convert_date( $entry['post_date'] );
  5311. $post_date_gmt = $this->_convert_date_gmt( $entry['post_date_gmt'], $entry['post_date'] );
  5312. $post_modified = $this->_convert_date( $entry['post_modified'] );
  5313. $post_modified_gmt = $this->_convert_date_gmt( $entry['post_modified_gmt'], $entry['post_modified'] );
  5314. $categories = array();
  5315. $catids = wp_get_post_categories( $entry['ID'] );
  5316. foreach ( $catids as $catid ) {
  5317. $categories[] = get_cat_name( $catid );
  5318. }
  5319. $tagnames = array();
  5320. $tags = wp_get_post_tags( $entry['ID'] );
  5321. if ( ! empty( $tags ) ) {
  5322. foreach ( $tags as $tag ) {
  5323. $tagnames[] = $tag->name;
  5324. }
  5325. $tagnames = implode( ', ', $tagnames );
  5326. } else {
  5327. $tagnames = '';
  5328. }
  5329. $post = get_extended( $entry['post_content'] );
  5330. $link = get_permalink( $entry['ID'] );
  5331. // Get the post author info.
  5332. $author = get_userdata( $entry['post_author'] );
  5333. $allow_comments = ( 'open' === $entry['comment_status'] ) ? 1 : 0;
  5334. $allow_pings = ( 'open' === $entry['ping_status'] ) ? 1 : 0;
  5335. // Consider future posts as published.
  5336. if ( 'future' === $entry['post_status'] ) {
  5337. $entry['post_status'] = 'publish';
  5338. }
  5339. // Get post format.
  5340. $post_format = get_post_format( $entry['ID'] );
  5341. if ( empty( $post_format ) ) {
  5342. $post_format = 'standard';
  5343. }
  5344. $recent_posts[] = array(
  5345. 'dateCreated' => $post_date,
  5346. 'userid' => $entry['post_author'],
  5347. 'postid' => (string) $entry['ID'],
  5348. 'description' => $post['main'],
  5349. 'title' => $entry['post_title'],
  5350. 'link' => $link,
  5351. 'permaLink' => $link,
  5352. // Commented out because no other tool seems to use this.
  5353. // 'content' => $entry['post_content'],
  5354. 'categories' => $categories,
  5355. 'mt_excerpt' => $entry['post_excerpt'],
  5356. 'mt_text_more' => $post['extended'],
  5357. 'wp_more_text' => $post['more_text'],
  5358. 'mt_allow_comments' => $allow_comments,
  5359. 'mt_allow_pings' => $allow_pings,
  5360. 'mt_keywords' => $tagnames,
  5361. 'wp_slug' => $entry['post_name'],
  5362. 'wp_password' => $entry['post_password'],
  5363. 'wp_author_id' => (string) $author->ID,
  5364. 'wp_author_display_name' => $author->display_name,
  5365. 'date_created_gmt' => $post_date_gmt,
  5366. 'post_status' => $entry['post_status'],
  5367. 'custom_fields' => $this->get_custom_fields( $entry['ID'] ),
  5368. 'wp_post_format' => $post_format,
  5369. 'date_modified' => $post_modified,
  5370. 'date_modified_gmt' => $post_modified_gmt,
  5371. 'sticky' => ( 'post' === $entry['post_type'] && is_sticky( $entry['ID'] ) ),
  5372. 'wp_post_thumbnail' => get_post_thumbnail_id( $entry['ID'] ),
  5373. );
  5374. }
  5375. return $recent_posts;
  5376. }
  5377. /**
  5378. * Retrieve the list of categories on a given blog.
  5379. *
  5380. * @since 1.5.0
  5381. *
  5382. * @param array $args {
  5383. * Method arguments. Note: arguments must be ordered as documented.
  5384. *
  5385. * @type int $0 Blog ID (unused).
  5386. * @type string $1 Username.
  5387. * @type string $2 Password.
  5388. * }
  5389. * @return array|IXR_Error
  5390. */
  5391. public function mw_getCategories( $args ) {
  5392. $this->escape( $args );
  5393. $username = $args[1];
  5394. $password = $args[2];
  5395. $user = $this->login( $username, $password );
  5396. if ( ! $user ) {
  5397. return $this->error;
  5398. }
  5399. if ( ! current_user_can( 'edit_posts' ) ) {
  5400. return new IXR_Error( 401, __( 'Sorry, you must be able to edit posts on this site in order to view categories.' ) );
  5401. }
  5402. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5403. do_action( 'xmlrpc_call', 'metaWeblog.getCategories', $args, $this );
  5404. $categories_struct = array();
  5405. $cats = get_categories( array( 'get' => 'all' ) );
  5406. if ( $cats ) {
  5407. foreach ( $cats as $cat ) {
  5408. $struct = array();
  5409. $struct['categoryId'] = $cat->term_id;
  5410. $struct['parentId'] = $cat->parent;
  5411. $struct['description'] = $cat->name;
  5412. $struct['categoryDescription'] = $cat->description;
  5413. $struct['categoryName'] = $cat->name;
  5414. $struct['htmlUrl'] = esc_html( get_category_link( $cat->term_id ) );
  5415. $struct['rssUrl'] = esc_html( get_category_feed_link( $cat->term_id, 'rss2' ) );
  5416. $categories_struct[] = $struct;
  5417. }
  5418. }
  5419. return $categories_struct;
  5420. }
  5421. /**
  5422. * Uploads a file, following your settings.
  5423. *
  5424. * Adapted from a patch by Johann Richard.
  5425. *
  5426. * @link http://mycvs.org/archives/2004/06/30/file-upload-to-wordpress-in-ecto/
  5427. *
  5428. * @since 1.5.0
  5429. *
  5430. * @global wpdb $wpdb WordPress database abstraction object.
  5431. *
  5432. * @param array $args {
  5433. * Method arguments. Note: arguments must be ordered as documented.
  5434. *
  5435. * @type int $0 Blog ID (unused).
  5436. * @type string $1 Username.
  5437. * @type string $2 Password.
  5438. * @type array $3 Data.
  5439. * }
  5440. * @return array|IXR_Error
  5441. */
  5442. public function mw_newMediaObject( $args ) {
  5443. global $wpdb;
  5444. $username = $this->escape( $args[1] );
  5445. $password = $this->escape( $args[2] );
  5446. $data = $args[3];
  5447. $name = sanitize_file_name( $data['name'] );
  5448. $type = $data['type'];
  5449. $bits = $data['bits'];
  5450. $user = $this->login( $username, $password );
  5451. if ( ! $user ) {
  5452. return $this->error;
  5453. }
  5454. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5455. do_action( 'xmlrpc_call', 'metaWeblog.newMediaObject', $args, $this );
  5456. if ( ! current_user_can( 'upload_files' ) ) {
  5457. $this->error = new IXR_Error( 401, __( 'Sorry, you are not allowed to upload files.' ) );
  5458. return $this->error;
  5459. }
  5460. if ( is_multisite() && upload_is_user_over_quota( false ) ) {
  5461. $this->error = new IXR_Error(
  5462. 401,
  5463. sprintf(
  5464. /* translators: %s: Allowed space allocation. */
  5465. __( 'Sorry, you have used your space allocation of %s. Please delete some files to upload more files.' ),
  5466. size_format( get_space_allowed() * MB_IN_BYTES )
  5467. )
  5468. );
  5469. return $this->error;
  5470. }
  5471. /**
  5472. * Filters whether to preempt the XML-RPC media upload.
  5473. *
  5474. * Returning a truthy value will effectively short-circuit the media upload,
  5475. * returning that value as a 500 error instead.
  5476. *
  5477. * @since 2.1.0
  5478. *
  5479. * @param bool $error Whether to pre-empt the media upload. Default false.
  5480. */
  5481. $upload_err = apply_filters( 'pre_upload_error', false );
  5482. if ( $upload_err ) {
  5483. return new IXR_Error( 500, $upload_err );
  5484. }
  5485. $upload = wp_upload_bits( $name, null, $bits );
  5486. if ( ! empty( $upload['error'] ) ) {
  5487. /* translators: 1: File name, 2: Error message. */
  5488. $errorString = sprintf( __( 'Could not write file %1$s (%2$s).' ), $name, $upload['error'] );
  5489. return new IXR_Error( 500, $errorString );
  5490. }
  5491. // Construct the attachment array.
  5492. $post_id = 0;
  5493. if ( ! empty( $data['post_id'] ) ) {
  5494. $post_id = (int) $data['post_id'];
  5495. if ( ! current_user_can( 'edit_post', $post_id ) ) {
  5496. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  5497. }
  5498. }
  5499. $attachment = array(
  5500. 'post_title' => $name,
  5501. 'post_content' => '',
  5502. 'post_type' => 'attachment',
  5503. 'post_parent' => $post_id,
  5504. 'post_mime_type' => $type,
  5505. 'guid' => $upload['url'],
  5506. );
  5507. // Save the data.
  5508. $id = wp_insert_attachment( $attachment, $upload['file'], $post_id );
  5509. wp_update_attachment_metadata( $id, wp_generate_attachment_metadata( $id, $upload['file'] ) );
  5510. /**
  5511. * Fires after a new attachment has been added via the XML-RPC MovableType API.
  5512. *
  5513. * @since 3.4.0
  5514. *
  5515. * @param int $id ID of the new attachment.
  5516. * @param array $args An array of arguments to add the attachment.
  5517. */
  5518. do_action( 'xmlrpc_call_success_mw_newMediaObject', $id, $args ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.NotLowercase
  5519. $struct = $this->_prepare_media_item( get_post( $id ) );
  5520. // Deprecated values.
  5521. $struct['id'] = $struct['attachment_id'];
  5522. $struct['file'] = $struct['title'];
  5523. $struct['url'] = $struct['link'];
  5524. return $struct;
  5525. }
  5526. /*
  5527. * MovableType API functions.
  5528. * Specs on http://www.movabletype.org/docs/mtmanual_programmatic.html
  5529. */
  5530. /**
  5531. * Retrieve the post titles of recent posts.
  5532. *
  5533. * @since 1.5.0
  5534. *
  5535. * @param array $args {
  5536. * Method arguments. Note: arguments must be ordered as documented.
  5537. *
  5538. * @type int $0 Blog ID (unused).
  5539. * @type string $1 Username.
  5540. * @type string $2 Password.
  5541. * @type int $3 Optional. Number of posts.
  5542. * }
  5543. * @return array|IXR_Error
  5544. */
  5545. public function mt_getRecentPostTitles( $args ) {
  5546. $this->escape( $args );
  5547. $username = $args[1];
  5548. $password = $args[2];
  5549. if ( isset( $args[3] ) ) {
  5550. $query = array( 'numberposts' => absint( $args[3] ) );
  5551. } else {
  5552. $query = array();
  5553. }
  5554. $user = $this->login( $username, $password );
  5555. if ( ! $user ) {
  5556. return $this->error;
  5557. }
  5558. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5559. do_action( 'xmlrpc_call', 'mt.getRecentPostTitles', $args, $this );
  5560. $posts_list = wp_get_recent_posts( $query );
  5561. if ( ! $posts_list ) {
  5562. $this->error = new IXR_Error( 500, __( 'Either there are no posts, or something went wrong.' ) );
  5563. return $this->error;
  5564. }
  5565. $recent_posts = array();
  5566. foreach ( $posts_list as $entry ) {
  5567. if ( ! current_user_can( 'edit_post', $entry['ID'] ) ) {
  5568. continue;
  5569. }
  5570. $post_date = $this->_convert_date( $entry['post_date'] );
  5571. $post_date_gmt = $this->_convert_date_gmt( $entry['post_date_gmt'], $entry['post_date'] );
  5572. $recent_posts[] = array(
  5573. 'dateCreated' => $post_date,
  5574. 'userid' => $entry['post_author'],
  5575. 'postid' => (string) $entry['ID'],
  5576. 'title' => $entry['post_title'],
  5577. 'post_status' => $entry['post_status'],
  5578. 'date_created_gmt' => $post_date_gmt,
  5579. );
  5580. }
  5581. return $recent_posts;
  5582. }
  5583. /**
  5584. * Retrieve list of all categories on blog.
  5585. *
  5586. * @since 1.5.0
  5587. *
  5588. * @param array $args {
  5589. * Method arguments. Note: arguments must be ordered as documented.
  5590. *
  5591. * @type int $0 Blog ID (unused).
  5592. * @type string $1 Username.
  5593. * @type string $2 Password.
  5594. * }
  5595. * @return array|IXR_Error
  5596. */
  5597. public function mt_getCategoryList( $args ) {
  5598. $this->escape( $args );
  5599. $username = $args[1];
  5600. $password = $args[2];
  5601. $user = $this->login( $username, $password );
  5602. if ( ! $user ) {
  5603. return $this->error;
  5604. }
  5605. if ( ! current_user_can( 'edit_posts' ) ) {
  5606. return new IXR_Error( 401, __( 'Sorry, you must be able to edit posts on this site in order to view categories.' ) );
  5607. }
  5608. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5609. do_action( 'xmlrpc_call', 'mt.getCategoryList', $args, $this );
  5610. $categories_struct = array();
  5611. $cats = get_categories(
  5612. array(
  5613. 'hide_empty' => 0,
  5614. 'hierarchical' => 0,
  5615. )
  5616. );
  5617. if ( $cats ) {
  5618. foreach ( $cats as $cat ) {
  5619. $struct = array();
  5620. $struct['categoryId'] = $cat->term_id;
  5621. $struct['categoryName'] = $cat->name;
  5622. $categories_struct[] = $struct;
  5623. }
  5624. }
  5625. return $categories_struct;
  5626. }
  5627. /**
  5628. * Retrieve post categories.
  5629. *
  5630. * @since 1.5.0
  5631. *
  5632. * @param array $args {
  5633. * Method arguments. Note: arguments must be ordered as documented.
  5634. *
  5635. * @type int $0 Post ID.
  5636. * @type string $1 Username.
  5637. * @type string $2 Password.
  5638. * }
  5639. * @return array|IXR_Error
  5640. */
  5641. public function mt_getPostCategories( $args ) {
  5642. $this->escape( $args );
  5643. $post_ID = (int) $args[0];
  5644. $username = $args[1];
  5645. $password = $args[2];
  5646. $user = $this->login( $username, $password );
  5647. if ( ! $user ) {
  5648. return $this->error;
  5649. }
  5650. if ( ! get_post( $post_ID ) ) {
  5651. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  5652. }
  5653. if ( ! current_user_can( 'edit_post', $post_ID ) ) {
  5654. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  5655. }
  5656. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5657. do_action( 'xmlrpc_call', 'mt.getPostCategories', $args, $this );
  5658. $categories = array();
  5659. $catids = wp_get_post_categories( (int) $post_ID );
  5660. // First listed category will be the primary category.
  5661. $isPrimary = true;
  5662. foreach ( $catids as $catid ) {
  5663. $categories[] = array(
  5664. 'categoryName' => get_cat_name( $catid ),
  5665. 'categoryId' => (string) $catid,
  5666. 'isPrimary' => $isPrimary,
  5667. );
  5668. $isPrimary = false;
  5669. }
  5670. return $categories;
  5671. }
  5672. /**
  5673. * Sets categories for a post.
  5674. *
  5675. * @since 1.5.0
  5676. *
  5677. * @param array $args {
  5678. * Method arguments. Note: arguments must be ordered as documented.
  5679. *
  5680. * @type int $0 Post ID.
  5681. * @type string $1 Username.
  5682. * @type string $2 Password.
  5683. * @type array $3 Categories.
  5684. * }
  5685. * @return true|IXR_Error True on success.
  5686. */
  5687. public function mt_setPostCategories( $args ) {
  5688. $this->escape( $args );
  5689. $post_ID = (int) $args[0];
  5690. $username = $args[1];
  5691. $password = $args[2];
  5692. $categories = $args[3];
  5693. $user = $this->login( $username, $password );
  5694. if ( ! $user ) {
  5695. return $this->error;
  5696. }
  5697. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5698. do_action( 'xmlrpc_call', 'mt.setPostCategories', $args, $this );
  5699. if ( ! get_post( $post_ID ) ) {
  5700. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  5701. }
  5702. if ( ! current_user_can( 'edit_post', $post_ID ) ) {
  5703. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  5704. }
  5705. $catids = array();
  5706. foreach ( $categories as $cat ) {
  5707. $catids[] = $cat['categoryId'];
  5708. }
  5709. wp_set_post_categories( $post_ID, $catids );
  5710. return true;
  5711. }
  5712. /**
  5713. * Retrieve an array of methods supported by this server.
  5714. *
  5715. * @since 1.5.0
  5716. *
  5717. * @return array
  5718. */
  5719. public function mt_supportedMethods() {
  5720. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5721. do_action( 'xmlrpc_call', 'mt.supportedMethods', array(), $this );
  5722. return array_keys( $this->methods );
  5723. }
  5724. /**
  5725. * Retrieve an empty array because we don't support per-post text filters.
  5726. *
  5727. * @since 1.5.0
  5728. */
  5729. public function mt_supportedTextFilters() {
  5730. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5731. do_action( 'xmlrpc_call', 'mt.supportedTextFilters', array(), $this );
  5732. /**
  5733. * Filters the MoveableType text filters list for XML-RPC.
  5734. *
  5735. * @since 2.2.0
  5736. *
  5737. * @param array $filters An array of text filters.
  5738. */
  5739. return apply_filters( 'xmlrpc_text_filters', array() );
  5740. }
  5741. /**
  5742. * Retrieve trackbacks sent to a given post.
  5743. *
  5744. * @since 1.5.0
  5745. *
  5746. * @global wpdb $wpdb WordPress database abstraction object.
  5747. *
  5748. * @param int $post_ID
  5749. * @return array|IXR_Error
  5750. */
  5751. public function mt_getTrackbackPings( $post_ID ) {
  5752. global $wpdb;
  5753. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5754. do_action( 'xmlrpc_call', 'mt.getTrackbackPings', $post_ID, $this );
  5755. $actual_post = get_post( $post_ID, ARRAY_A );
  5756. if ( ! $actual_post ) {
  5757. return new IXR_Error( 404, __( 'Sorry, no such post.' ) );
  5758. }
  5759. $comments = $wpdb->get_results( $wpdb->prepare( "SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID ) );
  5760. if ( ! $comments ) {
  5761. return array();
  5762. }
  5763. $trackback_pings = array();
  5764. foreach ( $comments as $comment ) {
  5765. if ( 'trackback' === $comment->comment_type ) {
  5766. $content = $comment->comment_content;
  5767. $title = substr( $content, 8, ( strpos( $content, '</strong>' ) - 8 ) );
  5768. $trackback_pings[] = array(
  5769. 'pingTitle' => $title,
  5770. 'pingURL' => $comment->comment_author_url,
  5771. 'pingIP' => $comment->comment_author_IP,
  5772. );
  5773. }
  5774. }
  5775. return $trackback_pings;
  5776. }
  5777. /**
  5778. * Sets a post's publish status to 'publish'.
  5779. *
  5780. * @since 1.5.0
  5781. *
  5782. * @param array $args {
  5783. * Method arguments. Note: arguments must be ordered as documented.
  5784. *
  5785. * @type int $0 Post ID.
  5786. * @type string $1 Username.
  5787. * @type string $2 Password.
  5788. * }
  5789. * @return int|IXR_Error
  5790. */
  5791. public function mt_publishPost( $args ) {
  5792. $this->escape( $args );
  5793. $post_ID = (int) $args[0];
  5794. $username = $args[1];
  5795. $password = $args[2];
  5796. $user = $this->login( $username, $password );
  5797. if ( ! $user ) {
  5798. return $this->error;
  5799. }
  5800. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5801. do_action( 'xmlrpc_call', 'mt.publishPost', $args, $this );
  5802. $postdata = get_post( $post_ID, ARRAY_A );
  5803. if ( ! $postdata ) {
  5804. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  5805. }
  5806. if ( ! current_user_can( 'publish_posts' ) || ! current_user_can( 'edit_post', $post_ID ) ) {
  5807. return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish this post.' ) );
  5808. }
  5809. $postdata['post_status'] = 'publish';
  5810. // Retain old categories.
  5811. $postdata['post_category'] = wp_get_post_categories( $post_ID );
  5812. $this->escape( $postdata );
  5813. return wp_update_post( $postdata );
  5814. }
  5815. /*
  5816. * Pingback functions.
  5817. * Specs on www.hixie.ch/specs/pingback/pingback
  5818. */
  5819. /**
  5820. * Retrieves a pingback and registers it.
  5821. *
  5822. * @since 1.5.0
  5823. *
  5824. * @param array $args {
  5825. * Method arguments. Note: arguments must be ordered as documented.
  5826. *
  5827. * @type string $0 URL of page linked from.
  5828. * @type string $1 URL of page linked to.
  5829. * }
  5830. * @return string|IXR_Error
  5831. */
  5832. public function pingback_ping( $args ) {
  5833. global $wpdb;
  5834. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5835. do_action( 'xmlrpc_call', 'pingback.ping', $args, $this );
  5836. $this->escape( $args );
  5837. $pagelinkedfrom = str_replace( '&amp;', '&', $args[0] );
  5838. $pagelinkedto = str_replace( '&amp;', '&', $args[1] );
  5839. $pagelinkedto = str_replace( '&', '&amp;', $pagelinkedto );
  5840. /**
  5841. * Filters the pingback source URI.
  5842. *
  5843. * @since 3.6.0
  5844. *
  5845. * @param string $pagelinkedfrom URI of the page linked from.
  5846. * @param string $pagelinkedto URI of the page linked to.
  5847. */
  5848. $pagelinkedfrom = apply_filters( 'pingback_ping_source_uri', $pagelinkedfrom, $pagelinkedto );
  5849. if ( ! $pagelinkedfrom ) {
  5850. return $this->pingback_error( 0, __( 'A valid URL was not provided.' ) );
  5851. }
  5852. // Check if the page linked to is on our site.
  5853. $pos1 = strpos( $pagelinkedto, str_replace( array( 'http://www.', 'http://', 'https://www.', 'https://' ), '', get_option( 'home' ) ) );
  5854. if ( ! $pos1 ) {
  5855. return $this->pingback_error( 0, __( 'Is there no link to us?' ) );
  5856. }
  5857. /*
  5858. * Let's find which post is linked to.
  5859. * FIXME: Does url_to_postid() cover all these cases already?
  5860. * If so, then let's use it and drop the old code.
  5861. */
  5862. $urltest = parse_url( $pagelinkedto );
  5863. $post_ID = url_to_postid( $pagelinkedto );
  5864. if ( $post_ID ) {
  5865. // $way
  5866. } elseif ( isset( $urltest['path'] ) && preg_match( '#p/[0-9]{1,}#', $urltest['path'], $match ) ) {
  5867. // The path defines the post_ID (archives/p/XXXX).
  5868. $blah = explode( '/', $match[0] );
  5869. $post_ID = (int) $blah[1];
  5870. } elseif ( isset( $urltest['query'] ) && preg_match( '#p=[0-9]{1,}#', $urltest['query'], $match ) ) {
  5871. // The query string defines the post_ID (?p=XXXX).
  5872. $blah = explode( '=', $match[0] );
  5873. $post_ID = (int) $blah[1];
  5874. } elseif ( isset( $urltest['fragment'] ) ) {
  5875. // An #anchor is there, it's either...
  5876. if ( (int) $urltest['fragment'] ) {
  5877. // ...an integer #XXXX (simplest case),
  5878. $post_ID = (int) $urltest['fragment'];
  5879. } elseif ( preg_match( '/post-[0-9]+/', $urltest['fragment'] ) ) {
  5880. // ...a post ID in the form 'post-###',
  5881. $post_ID = preg_replace( '/[^0-9]+/', '', $urltest['fragment'] );
  5882. } elseif ( is_string( $urltest['fragment'] ) ) {
  5883. // ...or a string #title, a little more complicated.
  5884. $title = preg_replace( '/[^a-z0-9]/i', '.', $urltest['fragment'] );
  5885. $sql = $wpdb->prepare( "SELECT ID FROM $wpdb->posts WHERE post_title RLIKE %s", $title );
  5886. $post_ID = $wpdb->get_var( $sql );
  5887. if ( ! $post_ID ) {
  5888. // Returning unknown error '0' is better than die()'ing.
  5889. return $this->pingback_error( 0, '' );
  5890. }
  5891. }
  5892. } else {
  5893. // TODO: Attempt to extract a post ID from the given URL.
  5894. return $this->pingback_error( 33, __( 'The specified target URL cannot be used as a target. It either does not exist, or it is not a pingback-enabled resource.' ) );
  5895. }
  5896. $post_ID = (int) $post_ID;
  5897. $post = get_post( $post_ID );
  5898. if ( ! $post ) { // Post not found.
  5899. return $this->pingback_error( 33, __( 'The specified target URL cannot be used as a target. It either does not exist, or it is not a pingback-enabled resource.' ) );
  5900. }
  5901. if ( url_to_postid( $pagelinkedfrom ) == $post_ID ) {
  5902. return $this->pingback_error( 0, __( 'The source URL and the target URL cannot both point to the same resource.' ) );
  5903. }
  5904. // Check if pings are on.
  5905. if ( ! pings_open( $post ) ) {
  5906. return $this->pingback_error( 33, __( 'The specified target URL cannot be used as a target. It either does not exist, or it is not a pingback-enabled resource.' ) );
  5907. }
  5908. // Let's check that the remote site didn't already pingback this entry.
  5909. if ( $wpdb->get_results( $wpdb->prepare( "SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_author_url = %s", $post_ID, $pagelinkedfrom ) ) ) {
  5910. return $this->pingback_error( 48, __( 'The pingback has already been registered.' ) );
  5911. }
  5912. // Very stupid, but gives time to the 'from' server to publish!
  5913. sleep( 1 );
  5914. $remote_ip = preg_replace( '/[^0-9a-fA-F:., ]/', '', $_SERVER['REMOTE_ADDR'] );
  5915. /** This filter is documented in wp-includes/class-wp-http.php */
  5916. $user_agent = apply_filters( 'http_headers_useragent', 'WordPress/' . get_bloginfo( 'version' ) . '; ' . get_bloginfo( 'url' ), $pagelinkedfrom );
  5917. // Let's check the remote site.
  5918. $http_api_args = array(
  5919. 'timeout' => 10,
  5920. 'redirection' => 0,
  5921. 'limit_response_size' => 153600, // 150 KB
  5922. 'user-agent' => "$user_agent; verifying pingback from $remote_ip",
  5923. 'headers' => array(
  5924. 'X-Pingback-Forwarded-For' => $remote_ip,
  5925. ),
  5926. );
  5927. $request = wp_safe_remote_get( $pagelinkedfrom, $http_api_args );
  5928. $remote_source = wp_remote_retrieve_body( $request );
  5929. $remote_source_original = $remote_source;
  5930. if ( ! $remote_source ) {
  5931. return $this->pingback_error( 16, __( 'The source URL does not exist.' ) );
  5932. }
  5933. /**
  5934. * Filters the pingback remote source.
  5935. *
  5936. * @since 2.5.0
  5937. *
  5938. * @param string $remote_source Response source for the page linked from.
  5939. * @param string $pagelinkedto URL of the page linked to.
  5940. */
  5941. $remote_source = apply_filters( 'pre_remote_source', $remote_source, $pagelinkedto );
  5942. // Work around bug in strip_tags():
  5943. $remote_source = str_replace( '<!DOC', '<DOC', $remote_source );
  5944. $remote_source = preg_replace( '/[\r\n\t ]+/', ' ', $remote_source ); // normalize spaces
  5945. $remote_source = preg_replace( '/<\/*(h1|h2|h3|h4|h5|h6|p|th|td|li|dt|dd|pre|caption|input|textarea|button|body)[^>]*>/', "\n\n", $remote_source );
  5946. preg_match( '|<title>([^<]*?)</title>|is', $remote_source, $matchtitle );
  5947. $title = isset( $matchtitle[1] ) ? $matchtitle[1] : '';
  5948. if ( empty( $title ) ) {
  5949. return $this->pingback_error( 32, __( 'A title on that page cannot be found.' ) );
  5950. }
  5951. // Remove all script and style tags including their content.
  5952. $remote_source = preg_replace( '@<(script|style)[^>]*?>.*?</\\1>@si', '', $remote_source );
  5953. // Just keep the tag we need.
  5954. $remote_source = strip_tags( $remote_source, '<a>' );
  5955. $p = explode( "\n\n", $remote_source );
  5956. $preg_target = preg_quote( $pagelinkedto, '|' );
  5957. foreach ( $p as $para ) {
  5958. if ( strpos( $para, $pagelinkedto ) !== false ) { // It exists, but is it a link?
  5959. preg_match( '|<a[^>]+?' . $preg_target . '[^>]*>([^>]+?)</a>|', $para, $context );
  5960. // If the URL isn't in a link context, keep looking.
  5961. if ( empty( $context ) ) {
  5962. continue;
  5963. }
  5964. // We're going to use this fake tag to mark the context in a bit.
  5965. // The marker is needed in case the link text appears more than once in the paragraph.
  5966. $excerpt = preg_replace( '|\</?wpcontext\>|', '', $para );
  5967. // prevent really long link text
  5968. if ( strlen( $context[1] ) > 100 ) {
  5969. $context[1] = substr( $context[1], 0, 100 ) . '&#8230;';
  5970. }
  5971. $marker = '<wpcontext>' . $context[1] . '</wpcontext>'; // Set up our marker.
  5972. $excerpt = str_replace( $context[0], $marker, $excerpt ); // Swap out the link for our marker.
  5973. $excerpt = strip_tags( $excerpt, '<wpcontext>' ); // Strip all tags but our context marker.
  5974. $excerpt = trim( $excerpt );
  5975. $preg_marker = preg_quote( $marker, '|' );
  5976. $excerpt = preg_replace( "|.*?\s(.{0,100}$preg_marker.{0,100})\s.*|s", '$1', $excerpt );
  5977. $excerpt = strip_tags( $excerpt ); // YES, again, to remove the marker wrapper.
  5978. break;
  5979. }
  5980. }
  5981. if ( empty( $context ) ) { // Link to target not found.
  5982. return $this->pingback_error( 17, __( 'The source URL does not contain a link to the target URL, and so cannot be used as a source.' ) );
  5983. }
  5984. $pagelinkedfrom = str_replace( '&', '&amp;', $pagelinkedfrom );
  5985. $context = '[&#8230;] ' . esc_html( $excerpt ) . ' [&#8230;]';
  5986. $pagelinkedfrom = $this->escape( $pagelinkedfrom );
  5987. $comment_post_id = (int) $post_ID;
  5988. $comment_author = $title;
  5989. $comment_author_email = '';
  5990. $this->escape( $comment_author );
  5991. $comment_author_url = $pagelinkedfrom;
  5992. $comment_content = $context;
  5993. $this->escape( $comment_content );
  5994. $comment_type = 'pingback';
  5995. $commentdata = array(
  5996. 'comment_post_ID' => $comment_post_id,
  5997. );
  5998. $commentdata += compact(
  5999. 'comment_author',
  6000. 'comment_author_url',
  6001. 'comment_author_email',
  6002. 'comment_content',
  6003. 'comment_type',
  6004. 'remote_source',
  6005. 'remote_source_original'
  6006. );
  6007. $comment_ID = wp_new_comment( $commentdata );
  6008. if ( is_wp_error( $comment_ID ) ) {
  6009. return $this->pingback_error( 0, $comment_ID->get_error_message() );
  6010. }
  6011. /**
  6012. * Fires after a post pingback has been sent.
  6013. *
  6014. * @since 0.71
  6015. *
  6016. * @param int $comment_ID Comment ID.
  6017. */
  6018. do_action( 'pingback_post', $comment_ID );
  6019. /* translators: 1: URL of the page linked from, 2: URL of the page linked to. */
  6020. return sprintf( __( 'Pingback from %1$s to %2$s registered. Keep the web talking! :-)' ), $pagelinkedfrom, $pagelinkedto );
  6021. }
  6022. /**
  6023. * Retrieve array of URLs that pingbacked the given URL.
  6024. *
  6025. * Specs on http://www.aquarionics.com/misc/archives/blogite/0198.html
  6026. *
  6027. * @since 1.5.0
  6028. *
  6029. * @global wpdb $wpdb WordPress database abstraction object.
  6030. *
  6031. * @param string $url
  6032. * @return array|IXR_Error
  6033. */
  6034. public function pingback_extensions_getPingbacks( $url ) {
  6035. global $wpdb;
  6036. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  6037. do_action( 'xmlrpc_call', 'pingback.extensions.getPingbacks', $url, $this );
  6038. $url = $this->escape( $url );
  6039. $post_ID = url_to_postid( $url );
  6040. if ( ! $post_ID ) {
  6041. // We aren't sure that the resource is available and/or pingback enabled.
  6042. return $this->pingback_error( 33, __( 'The specified target URL cannot be used as a target. It either does not exist, or it is not a pingback-enabled resource.' ) );
  6043. }
  6044. $actual_post = get_post( $post_ID, ARRAY_A );
  6045. if ( ! $actual_post ) {
  6046. // No such post = resource not found.
  6047. return $this->pingback_error( 32, __( 'The specified target URL does not exist.' ) );
  6048. }
  6049. $comments = $wpdb->get_results( $wpdb->prepare( "SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID ) );
  6050. if ( ! $comments ) {
  6051. return array();
  6052. }
  6053. $pingbacks = array();
  6054. foreach ( $comments as $comment ) {
  6055. if ( 'pingback' === $comment->comment_type ) {
  6056. $pingbacks[] = $comment->comment_author_url;
  6057. }
  6058. }
  6059. return $pingbacks;
  6060. }
  6061. /**
  6062. * Sends a pingback error based on the given error code and message.
  6063. *
  6064. * @since 3.6.0
  6065. *
  6066. * @param int $code Error code.
  6067. * @param string $message Error message.
  6068. * @return IXR_Error Error object.
  6069. */
  6070. protected function pingback_error( $code, $message ) {
  6071. /**
  6072. * Filters the XML-RPC pingback error return.
  6073. *
  6074. * @since 3.5.1
  6075. *
  6076. * @param IXR_Error $error An IXR_Error object containing the error code and message.
  6077. */
  6078. return apply_filters( 'xmlrpc_pingback_error', new IXR_Error( $code, $message ) );
  6079. }
  6080. }