You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 

6490 lines
195 KiB

  1. <?php
  2. /**
  3. * XML-RPC protocol support for WordPress
  4. *
  5. * @package WordPress
  6. * @subpackage Publishing
  7. */
  8. /**
  9. * WordPress XMLRPC server implementation.
  10. *
  11. * Implements compatibility for Blogger API, MetaWeblog API, MovableType, and
  12. * pingback. Additional WordPress API for managing comments, pages, posts,
  13. * options, etc.
  14. *
  15. * As of WordPress 3.5.0, XML-RPC is enabled by default. It can be disabled
  16. * via the {@see 'xmlrpc_enabled'} filter found in wp_xmlrpc_server::login().
  17. *
  18. * @package WordPress
  19. * @subpackage Publishing
  20. * @since 1.5.0
  21. */
  22. class wp_xmlrpc_server extends IXR_Server {
  23. /**
  24. * Methods.
  25. *
  26. * @access public
  27. * @var array
  28. */
  29. public $methods;
  30. /**
  31. * Blog options.
  32. *
  33. * @access public
  34. * @var array
  35. */
  36. public $blog_options;
  37. /**
  38. * IXR_Error instance.
  39. *
  40. * @access public
  41. * @var IXR_Error
  42. */
  43. public $error;
  44. /**
  45. * Flags that the user authentication has failed in this instance of wp_xmlrpc_server.
  46. *
  47. * @access protected
  48. * @var bool
  49. */
  50. protected $auth_failed = false;
  51. /**
  52. * Registers all of the XMLRPC methods that XMLRPC server understands.
  53. *
  54. * Sets up server and method property. Passes XMLRPC
  55. * methods through the {@see 'xmlrpc_methods'} filter to allow plugins to extend
  56. * or replace XML-RPC methods.
  57. *
  58. * @since 1.5.0
  59. */
  60. public function __construct() {
  61. $this->methods = array(
  62. // WordPress API
  63. 'wp.getUsersBlogs' => 'this:wp_getUsersBlogs',
  64. 'wp.newPost' => 'this:wp_newPost',
  65. 'wp.editPost' => 'this:wp_editPost',
  66. 'wp.deletePost' => 'this:wp_deletePost',
  67. 'wp.getPost' => 'this:wp_getPost',
  68. 'wp.getPosts' => 'this:wp_getPosts',
  69. 'wp.newTerm' => 'this:wp_newTerm',
  70. 'wp.editTerm' => 'this:wp_editTerm',
  71. 'wp.deleteTerm' => 'this:wp_deleteTerm',
  72. 'wp.getTerm' => 'this:wp_getTerm',
  73. 'wp.getTerms' => 'this:wp_getTerms',
  74. 'wp.getTaxonomy' => 'this:wp_getTaxonomy',
  75. 'wp.getTaxonomies' => 'this:wp_getTaxonomies',
  76. 'wp.getUser' => 'this:wp_getUser',
  77. 'wp.getUsers' => 'this:wp_getUsers',
  78. 'wp.getProfile' => 'this:wp_getProfile',
  79. 'wp.editProfile' => 'this:wp_editProfile',
  80. 'wp.getPage' => 'this:wp_getPage',
  81. 'wp.getPages' => 'this:wp_getPages',
  82. 'wp.newPage' => 'this:wp_newPage',
  83. 'wp.deletePage' => 'this:wp_deletePage',
  84. 'wp.editPage' => 'this:wp_editPage',
  85. 'wp.getPageList' => 'this:wp_getPageList',
  86. 'wp.getAuthors' => 'this:wp_getAuthors',
  87. 'wp.getCategories' => 'this:mw_getCategories', // Alias
  88. 'wp.getTags' => 'this:wp_getTags',
  89. 'wp.newCategory' => 'this:wp_newCategory',
  90. 'wp.deleteCategory' => 'this:wp_deleteCategory',
  91. 'wp.suggestCategories' => 'this:wp_suggestCategories',
  92. 'wp.uploadFile' => 'this:mw_newMediaObject', // Alias
  93. 'wp.deleteFile' => 'this:wp_deletePost', // Alias
  94. 'wp.getCommentCount' => 'this:wp_getCommentCount',
  95. 'wp.getPostStatusList' => 'this:wp_getPostStatusList',
  96. 'wp.getPageStatusList' => 'this:wp_getPageStatusList',
  97. 'wp.getPageTemplates' => 'this:wp_getPageTemplates',
  98. 'wp.getOptions' => 'this:wp_getOptions',
  99. 'wp.setOptions' => 'this:wp_setOptions',
  100. 'wp.getComment' => 'this:wp_getComment',
  101. 'wp.getComments' => 'this:wp_getComments',
  102. 'wp.deleteComment' => 'this:wp_deleteComment',
  103. 'wp.editComment' => 'this:wp_editComment',
  104. 'wp.newComment' => 'this:wp_newComment',
  105. 'wp.getCommentStatusList' => 'this:wp_getCommentStatusList',
  106. 'wp.getMediaItem' => 'this:wp_getMediaItem',
  107. 'wp.getMediaLibrary' => 'this:wp_getMediaLibrary',
  108. 'wp.getPostFormats' => 'this:wp_getPostFormats',
  109. 'wp.getPostType' => 'this:wp_getPostType',
  110. 'wp.getPostTypes' => 'this:wp_getPostTypes',
  111. 'wp.getRevisions' => 'this:wp_getRevisions',
  112. 'wp.restoreRevision' => 'this:wp_restoreRevision',
  113. // Blogger API
  114. 'blogger.getUsersBlogs' => 'this:blogger_getUsersBlogs',
  115. 'blogger.getUserInfo' => 'this:blogger_getUserInfo',
  116. 'blogger.getPost' => 'this:blogger_getPost',
  117. 'blogger.getRecentPosts' => 'this:blogger_getRecentPosts',
  118. 'blogger.newPost' => 'this:blogger_newPost',
  119. 'blogger.editPost' => 'this:blogger_editPost',
  120. 'blogger.deletePost' => 'this:blogger_deletePost',
  121. // MetaWeblog API (with MT extensions to structs)
  122. 'metaWeblog.newPost' => 'this:mw_newPost',
  123. 'metaWeblog.editPost' => 'this:mw_editPost',
  124. 'metaWeblog.getPost' => 'this:mw_getPost',
  125. 'metaWeblog.getRecentPosts' => 'this:mw_getRecentPosts',
  126. 'metaWeblog.getCategories' => 'this:mw_getCategories',
  127. 'metaWeblog.newMediaObject' => 'this:mw_newMediaObject',
  128. // MetaWeblog API aliases for Blogger API
  129. // see http://www.xmlrpc.com/stories/storyReader$2460
  130. 'metaWeblog.deletePost' => 'this:blogger_deletePost',
  131. 'metaWeblog.getUsersBlogs' => 'this:blogger_getUsersBlogs',
  132. // MovableType API
  133. 'mt.getCategoryList' => 'this:mt_getCategoryList',
  134. 'mt.getRecentPostTitles' => 'this:mt_getRecentPostTitles',
  135. 'mt.getPostCategories' => 'this:mt_getPostCategories',
  136. 'mt.setPostCategories' => 'this:mt_setPostCategories',
  137. 'mt.supportedMethods' => 'this:mt_supportedMethods',
  138. 'mt.supportedTextFilters' => 'this:mt_supportedTextFilters',
  139. 'mt.getTrackbackPings' => 'this:mt_getTrackbackPings',
  140. 'mt.publishPost' => 'this:mt_publishPost',
  141. // PingBack
  142. 'pingback.ping' => 'this:pingback_ping',
  143. 'pingback.extensions.getPingbacks' => 'this:pingback_extensions_getPingbacks',
  144. 'demo.sayHello' => 'this:sayHello',
  145. 'demo.addTwoNumbers' => 'this:addTwoNumbers'
  146. );
  147. $this->initialise_blog_option_info();
  148. /**
  149. * Filters the methods exposed by the XML-RPC server.
  150. *
  151. * This filter can be used to add new methods, and remove built-in methods.
  152. *
  153. * @since 1.5.0
  154. *
  155. * @param array $methods An array of XML-RPC methods.
  156. */
  157. $this->methods = apply_filters( 'xmlrpc_methods', $this->methods );
  158. }
  159. /**
  160. * Make private/protected methods readable for backward compatibility.
  161. *
  162. * @since 4.0.0
  163. * @access public
  164. *
  165. * @param callable $name Method to call.
  166. * @param array $arguments Arguments to pass when calling.
  167. * @return array|IXR_Error|false Return value of the callback, false otherwise.
  168. */
  169. public function __call( $name, $arguments ) {
  170. if ( '_multisite_getUsersBlogs' === $name ) {
  171. return call_user_func_array( array( $this, $name ), $arguments );
  172. }
  173. return false;
  174. }
  175. /**
  176. * Serves the XML-RPC request.
  177. *
  178. * @since 2.9.0
  179. * @access public
  180. */
  181. public function serve_request() {
  182. $this->IXR_Server($this->methods);
  183. }
  184. /**
  185. * Test XMLRPC API by saying, "Hello!" to client.
  186. *
  187. * @since 1.5.0
  188. *
  189. * @return string Hello string response.
  190. */
  191. public function sayHello() {
  192. return 'Hello!';
  193. }
  194. /**
  195. * Test XMLRPC API by adding two numbers for client.
  196. *
  197. * @since 1.5.0
  198. *
  199. * @param array $args {
  200. * Method arguments. Note: arguments must be ordered as documented.
  201. *
  202. * @type int $number1 A number to add.
  203. * @type int $number2 A second number to add.
  204. * }
  205. * @return int Sum of the two given numbers.
  206. */
  207. public function addTwoNumbers( $args ) {
  208. $number1 = $args[0];
  209. $number2 = $args[1];
  210. return $number1 + $number2;
  211. }
  212. /**
  213. * Log user in.
  214. *
  215. * @since 2.8.0
  216. *
  217. * @param string $username User's username.
  218. * @param string $password User's password.
  219. * @return WP_User|bool WP_User object if authentication passed, false otherwise
  220. */
  221. public function login( $username, $password ) {
  222. /*
  223. * Respect old get_option() filters left for back-compat when the 'enable_xmlrpc'
  224. * option was deprecated in 3.5.0. Use the 'xmlrpc_enabled' hook instead.
  225. */
  226. $enabled = apply_filters( 'pre_option_enable_xmlrpc', false );
  227. if ( false === $enabled ) {
  228. $enabled = apply_filters( 'option_enable_xmlrpc', true );
  229. }
  230. /**
  231. * Filters whether XML-RPC methods requiring authentication are enabled.
  232. *
  233. * Contrary to the way it's named, this filter does not control whether XML-RPC is *fully*
  234. * enabled, rather, it only controls whether XML-RPC methods requiring authentication - such
  235. * as for publishing purposes - are enabled.
  236. *
  237. * Further, the filter does not control whether pingbacks or other custom endpoints that don't
  238. * require authentication are enabled. This behavior is expected, and due to how parity was matched
  239. * with the `enable_xmlrpc` UI option the filter replaced when it was introduced in 3.5.
  240. *
  241. * To disable XML-RPC methods that require authentication, use:
  242. *
  243. * add_filter( 'xmlrpc_enabled', '__return_false' );
  244. *
  245. * For more granular control over all XML-RPC methods and requests, see the {@see 'xmlrpc_methods'}
  246. * and {@see 'xmlrpc_element_limit'} hooks.
  247. *
  248. * @since 3.5.0
  249. *
  250. * @param bool $enabled Whether XML-RPC is enabled. Default true.
  251. */
  252. $enabled = apply_filters( 'xmlrpc_enabled', $enabled );
  253. if ( ! $enabled ) {
  254. $this->error = new IXR_Error( 405, sprintf( __( 'XML-RPC services are disabled on this site.' ) ) );
  255. return false;
  256. }
  257. if ( $this->auth_failed ) {
  258. $user = new WP_Error( 'login_prevented' );
  259. } else {
  260. $user = wp_authenticate( $username, $password );
  261. }
  262. if ( is_wp_error( $user ) ) {
  263. $this->error = new IXR_Error( 403, __( 'Incorrect username or password.' ) );
  264. // Flag that authentication has failed once on this wp_xmlrpc_server instance
  265. $this->auth_failed = true;
  266. /**
  267. * Filters the XML-RPC user login error message.
  268. *
  269. * @since 3.5.0
  270. *
  271. * @param string $error The XML-RPC error message.
  272. * @param WP_User $user WP_User object.
  273. */
  274. $this->error = apply_filters( 'xmlrpc_login_error', $this->error, $user );
  275. return false;
  276. }
  277. wp_set_current_user( $user->ID );
  278. return $user;
  279. }
  280. /**
  281. * Check user's credentials. Deprecated.
  282. *
  283. * @since 1.5.0
  284. * @deprecated 2.8.0 Use wp_xmlrpc_server::login()
  285. * @see wp_xmlrpc_server::login()
  286. *
  287. * @param string $username User's username.
  288. * @param string $password User's password.
  289. * @return bool Whether authentication passed.
  290. */
  291. public function login_pass_ok( $username, $password ) {
  292. return (bool) $this->login( $username, $password );
  293. }
  294. /**
  295. * Escape string or array of strings for database.
  296. *
  297. * @since 1.5.2
  298. *
  299. * @param string|array $data Escape single string or array of strings.
  300. * @return string|void Returns with string is passed, alters by-reference
  301. * when array is passed.
  302. */
  303. public function escape( &$data ) {
  304. if ( ! is_array( $data ) )
  305. return wp_slash( $data );
  306. foreach ( $data as &$v ) {
  307. if ( is_array( $v ) )
  308. $this->escape( $v );
  309. elseif ( ! is_object( $v ) )
  310. $v = wp_slash( $v );
  311. }
  312. }
  313. /**
  314. * Retrieve custom fields for post.
  315. *
  316. * @since 2.5.0
  317. *
  318. * @param int $post_id Post ID.
  319. * @return array Custom fields, if exist.
  320. */
  321. public function get_custom_fields($post_id) {
  322. $post_id = (int) $post_id;
  323. $custom_fields = array();
  324. foreach ( (array) has_meta($post_id) as $meta ) {
  325. // Don't expose protected fields.
  326. if ( ! current_user_can( 'edit_post_meta', $post_id , $meta['meta_key'] ) )
  327. continue;
  328. $custom_fields[] = array(
  329. "id" => $meta['meta_id'],
  330. "key" => $meta['meta_key'],
  331. "value" => $meta['meta_value']
  332. );
  333. }
  334. return $custom_fields;
  335. }
  336. /**
  337. * Set custom fields for post.
  338. *
  339. * @since 2.5.0
  340. *
  341. * @param int $post_id Post ID.
  342. * @param array $fields Custom fields.
  343. */
  344. public function set_custom_fields($post_id, $fields) {
  345. $post_id = (int) $post_id;
  346. foreach ( (array) $fields as $meta ) {
  347. if ( isset($meta['id']) ) {
  348. $meta['id'] = (int) $meta['id'];
  349. $pmeta = get_metadata_by_mid( 'post', $meta['id'] );
  350. if ( isset($meta['key']) ) {
  351. $meta['key'] = wp_unslash( $meta['key'] );
  352. if ( $meta['key'] !== $pmeta->meta_key )
  353. continue;
  354. $meta['value'] = wp_unslash( $meta['value'] );
  355. if ( current_user_can( 'edit_post_meta', $post_id, $meta['key'] ) )
  356. update_metadata_by_mid( 'post', $meta['id'], $meta['value'] );
  357. } elseif ( current_user_can( 'delete_post_meta', $post_id, $pmeta->meta_key ) ) {
  358. delete_metadata_by_mid( 'post', $meta['id'] );
  359. }
  360. } elseif ( current_user_can( 'add_post_meta', $post_id, wp_unslash( $meta['key'] ) ) ) {
  361. add_post_meta( $post_id, $meta['key'], $meta['value'] );
  362. }
  363. }
  364. }
  365. /**
  366. * Set up blog options property.
  367. *
  368. * Passes property through {@see 'xmlrpc_blog_options'} filter.
  369. *
  370. * @since 2.6.0
  371. */
  372. public function initialise_blog_option_info() {
  373. $this->blog_options = array(
  374. // Read only options
  375. 'software_name' => array(
  376. 'desc' => __( 'Software Name' ),
  377. 'readonly' => true,
  378. 'value' => 'WordPress'
  379. ),
  380. 'software_version' => array(
  381. 'desc' => __( 'Software Version' ),
  382. 'readonly' => true,
  383. 'value' => get_bloginfo( 'version' )
  384. ),
  385. 'blog_url' => array(
  386. 'desc' => __( 'WordPress Address (URL)' ),
  387. 'readonly' => true,
  388. 'option' => 'siteurl'
  389. ),
  390. 'home_url' => array(
  391. 'desc' => __( 'Site Address (URL)' ),
  392. 'readonly' => true,
  393. 'option' => 'home'
  394. ),
  395. 'login_url' => array(
  396. 'desc' => __( 'Login Address (URL)' ),
  397. 'readonly' => true,
  398. 'value' => wp_login_url( )
  399. ),
  400. 'admin_url' => array(
  401. 'desc' => __( 'The URL to the admin area' ),
  402. 'readonly' => true,
  403. 'value' => get_admin_url( )
  404. ),
  405. 'image_default_link_type' => array(
  406. 'desc' => __( 'Image default link type' ),
  407. 'readonly' => true,
  408. 'option' => 'image_default_link_type'
  409. ),
  410. 'image_default_size' => array(
  411. 'desc' => __( 'Image default size' ),
  412. 'readonly' => true,
  413. 'option' => 'image_default_size'
  414. ),
  415. 'image_default_align' => array(
  416. 'desc' => __( 'Image default align' ),
  417. 'readonly' => true,
  418. 'option' => 'image_default_align'
  419. ),
  420. 'template' => array(
  421. 'desc' => __( 'Template' ),
  422. 'readonly' => true,
  423. 'option' => 'template'
  424. ),
  425. 'stylesheet' => array(
  426. 'desc' => __( 'Stylesheet' ),
  427. 'readonly' => true,
  428. 'option' => 'stylesheet'
  429. ),
  430. 'post_thumbnail' => array(
  431. 'desc' => __('Post Thumbnail'),
  432. 'readonly' => true,
  433. 'value' => current_theme_supports( 'post-thumbnails' )
  434. ),
  435. // Updatable options
  436. 'time_zone' => array(
  437. 'desc' => __( 'Time Zone' ),
  438. 'readonly' => false,
  439. 'option' => 'gmt_offset'
  440. ),
  441. 'blog_title' => array(
  442. 'desc' => __( 'Site Title' ),
  443. 'readonly' => false,
  444. 'option' => 'blogname'
  445. ),
  446. 'blog_tagline' => array(
  447. 'desc' => __( 'Site Tagline' ),
  448. 'readonly' => false,
  449. 'option' => 'blogdescription'
  450. ),
  451. 'date_format' => array(
  452. 'desc' => __( 'Date Format' ),
  453. 'readonly' => false,
  454. 'option' => 'date_format'
  455. ),
  456. 'time_format' => array(
  457. 'desc' => __( 'Time Format' ),
  458. 'readonly' => false,
  459. 'option' => 'time_format'
  460. ),
  461. 'users_can_register' => array(
  462. 'desc' => __( 'Allow new users to sign up' ),
  463. 'readonly' => false,
  464. 'option' => 'users_can_register'
  465. ),
  466. 'thumbnail_size_w' => array(
  467. 'desc' => __( 'Thumbnail Width' ),
  468. 'readonly' => false,
  469. 'option' => 'thumbnail_size_w'
  470. ),
  471. 'thumbnail_size_h' => array(
  472. 'desc' => __( 'Thumbnail Height' ),
  473. 'readonly' => false,
  474. 'option' => 'thumbnail_size_h'
  475. ),
  476. 'thumbnail_crop' => array(
  477. 'desc' => __( 'Crop thumbnail to exact dimensions' ),
  478. 'readonly' => false,
  479. 'option' => 'thumbnail_crop'
  480. ),
  481. 'medium_size_w' => array(
  482. 'desc' => __( 'Medium size image width' ),
  483. 'readonly' => false,
  484. 'option' => 'medium_size_w'
  485. ),
  486. 'medium_size_h' => array(
  487. 'desc' => __( 'Medium size image height' ),
  488. 'readonly' => false,
  489. 'option' => 'medium_size_h'
  490. ),
  491. 'medium_large_size_w' => array(
  492. 'desc' => __( 'Medium-Large size image width' ),
  493. 'readonly' => false,
  494. 'option' => 'medium_large_size_w'
  495. ),
  496. 'medium_large_size_h' => array(
  497. 'desc' => __( 'Medium-Large size image height' ),
  498. 'readonly' => false,
  499. 'option' => 'medium_large_size_h'
  500. ),
  501. 'large_size_w' => array(
  502. 'desc' => __( 'Large size image width' ),
  503. 'readonly' => false,
  504. 'option' => 'large_size_w'
  505. ),
  506. 'large_size_h' => array(
  507. 'desc' => __( 'Large size image height' ),
  508. 'readonly' => false,
  509. 'option' => 'large_size_h'
  510. ),
  511. 'default_comment_status' => array(
  512. 'desc' => __( 'Allow people to post comments on new articles' ),
  513. 'readonly' => false,
  514. 'option' => 'default_comment_status'
  515. ),
  516. 'default_ping_status' => array(
  517. 'desc' => __( 'Allow link notifications from other blogs (pingbacks and trackbacks) on new articles' ),
  518. 'readonly' => false,
  519. 'option' => 'default_ping_status'
  520. )
  521. );
  522. /**
  523. * Filters the XML-RPC blog options property.
  524. *
  525. * @since 2.6.0
  526. *
  527. * @param array $blog_options An array of XML-RPC blog options.
  528. */
  529. $this->blog_options = apply_filters( 'xmlrpc_blog_options', $this->blog_options );
  530. }
  531. /**
  532. * Retrieve the blogs of the user.
  533. *
  534. * @since 2.6.0
  535. *
  536. * @param array $args {
  537. * Method arguments. Note: arguments must be ordered as documented.
  538. *
  539. * @type string $username Username.
  540. * @type string $password Password.
  541. * }
  542. * @return array|IXR_Error Array contains:
  543. * - 'isAdmin'
  544. * - 'isPrimary' - whether the blog is the user's primary blog
  545. * - 'url'
  546. * - 'blogid'
  547. * - 'blogName'
  548. * - 'xmlrpc' - url of xmlrpc endpoint
  549. */
  550. public function wp_getUsersBlogs( $args ) {
  551. if ( ! $this->minimum_args( $args, 2 ) ) {
  552. return $this->error;
  553. }
  554. // If this isn't on WPMU then just use blogger_getUsersBlogs
  555. if ( !is_multisite() ) {
  556. array_unshift( $args, 1 );
  557. return $this->blogger_getUsersBlogs( $args );
  558. }
  559. $this->escape( $args );
  560. $username = $args[0];
  561. $password = $args[1];
  562. if ( !$user = $this->login($username, $password) )
  563. return $this->error;
  564. /**
  565. * Fires after the XML-RPC user has been authenticated but before the rest of
  566. * the method logic begins.
  567. *
  568. * All built-in XML-RPC methods use the action xmlrpc_call, with a parameter
  569. * equal to the method's name, e.g., wp.getUsersBlogs, wp.newPost, etc.
  570. *
  571. * @since 2.5.0
  572. *
  573. * @param string $name The method name.
  574. */
  575. do_action( 'xmlrpc_call', 'wp.getUsersBlogs' );
  576. $blogs = (array) get_blogs_of_user( $user->ID );
  577. $struct = array();
  578. $primary_blog_id = 0;
  579. $active_blog = get_active_blog_for_user( $user->ID );
  580. if ( $active_blog ) {
  581. $primary_blog_id = (int) $active_blog->blog_id;
  582. }
  583. foreach ( $blogs as $blog ) {
  584. // Don't include blogs that aren't hosted at this site.
  585. if ( $blog->site_id != get_current_network_id() )
  586. continue;
  587. $blog_id = $blog->userblog_id;
  588. switch_to_blog( $blog_id );
  589. $is_admin = current_user_can( 'manage_options' );
  590. $is_primary = ( (int) $blog_id === $primary_blog_id );
  591. $struct[] = array(
  592. 'isAdmin' => $is_admin,
  593. 'isPrimary' => $is_primary,
  594. 'url' => home_url( '/' ),
  595. 'blogid' => (string) $blog_id,
  596. 'blogName' => get_option( 'blogname' ),
  597. 'xmlrpc' => site_url( 'xmlrpc.php', 'rpc' ),
  598. );
  599. restore_current_blog();
  600. }
  601. return $struct;
  602. }
  603. /**
  604. * Checks if the method received at least the minimum number of arguments.
  605. *
  606. * @since 3.4.0
  607. * @access protected
  608. *
  609. * @param string|array $args Sanitize single string or array of strings.
  610. * @param int $count Minimum number of arguments.
  611. * @return bool if `$args` contains at least $count arguments.
  612. */
  613. protected function minimum_args( $args, $count ) {
  614. if ( count( $args ) < $count ) {
  615. $this->error = new IXR_Error( 400, __( 'Insufficient arguments passed to this XML-RPC method.' ) );
  616. return false;
  617. }
  618. return true;
  619. }
  620. /**
  621. * Prepares taxonomy data for return in an XML-RPC object.
  622. *
  623. * @access protected
  624. *
  625. * @param object $taxonomy The unprepared taxonomy data.
  626. * @param array $fields The subset of taxonomy fields to return.
  627. * @return array The prepared taxonomy data.
  628. */
  629. protected function _prepare_taxonomy( $taxonomy, $fields ) {
  630. $_taxonomy = array(
  631. 'name' => $taxonomy->name,
  632. 'label' => $taxonomy->label,
  633. 'hierarchical' => (bool) $taxonomy->hierarchical,
  634. 'public' => (bool) $taxonomy->public,
  635. 'show_ui' => (bool) $taxonomy->show_ui,
  636. '_builtin' => (bool) $taxonomy->_builtin,
  637. );
  638. if ( in_array( 'labels', $fields ) )
  639. $_taxonomy['labels'] = (array) $taxonomy->labels;
  640. if ( in_array( 'cap', $fields ) )
  641. $_taxonomy['cap'] = (array) $taxonomy->cap;
  642. if ( in_array( 'menu', $fields ) )
  643. $_taxonomy['show_in_menu'] = (bool) $_taxonomy->show_in_menu;
  644. if ( in_array( 'object_type', $fields ) )
  645. $_taxonomy['object_type'] = array_unique( (array) $taxonomy->object_type );
  646. /**
  647. * Filters XML-RPC-prepared data for the given taxonomy.
  648. *
  649. * @since 3.4.0
  650. *
  651. * @param array $_taxonomy An array of taxonomy data.
  652. * @param WP_Taxonomy $taxonomy Taxonomy object.
  653. * @param array $fields The subset of taxonomy fields to return.
  654. */
  655. return apply_filters( 'xmlrpc_prepare_taxonomy', $_taxonomy, $taxonomy, $fields );
  656. }
  657. /**
  658. * Prepares term data for return in an XML-RPC object.
  659. *
  660. * @access protected
  661. *
  662. * @param array|object $term The unprepared term data.
  663. * @return array The prepared term data.
  664. */
  665. protected function _prepare_term( $term ) {
  666. $_term = $term;
  667. if ( ! is_array( $_term ) )
  668. $_term = get_object_vars( $_term );
  669. // For integers which may be larger than XML-RPC supports ensure we return strings.
  670. $_term['term_id'] = strval( $_term['term_id'] );
  671. $_term['term_group'] = strval( $_term['term_group'] );
  672. $_term['term_taxonomy_id'] = strval( $_term['term_taxonomy_id'] );
  673. $_term['parent'] = strval( $_term['parent'] );
  674. // Count we are happy to return as an integer because people really shouldn't use terms that much.
  675. $_term['count'] = intval( $_term['count'] );
  676. /**
  677. * Filters XML-RPC-prepared data for the given term.
  678. *
  679. * @since 3.4.0
  680. *
  681. * @param array $_term An array of term data.
  682. * @param array|object $term Term object or array.
  683. */
  684. return apply_filters( 'xmlrpc_prepare_term', $_term, $term );
  685. }
  686. /**
  687. * Convert a WordPress date string to an IXR_Date object.
  688. *
  689. * @access protected
  690. *
  691. * @param string $date Date string to convert.
  692. * @return IXR_Date IXR_Date object.
  693. */
  694. protected function _convert_date( $date ) {
  695. if ( $date === '0000-00-00 00:00:00' ) {
  696. return new IXR_Date( '00000000T00:00:00Z' );
  697. }
  698. return new IXR_Date( mysql2date( 'Ymd\TH:i:s', $date, false ) );
  699. }
  700. /**
  701. * Convert a WordPress GMT date string to an IXR_Date object.
  702. *
  703. * @access protected
  704. *
  705. * @param string $date_gmt WordPress GMT date string.
  706. * @param string $date Date string.
  707. * @return IXR_Date IXR_Date object.
  708. */
  709. protected function _convert_date_gmt( $date_gmt, $date ) {
  710. if ( $date !== '0000-00-00 00:00:00' && $date_gmt === '0000-00-00 00:00:00' ) {
  711. return new IXR_Date( get_gmt_from_date( mysql2date( 'Y-m-d H:i:s', $date, false ), 'Ymd\TH:i:s' ) );
  712. }
  713. return $this->_convert_date( $date_gmt );
  714. }
  715. /**
  716. * Prepares post data for return in an XML-RPC object.
  717. *
  718. * @access protected
  719. *
  720. * @param array $post The unprepared post data.
  721. * @param array $fields The subset of post type fields to return.
  722. * @return array The prepared post data.
  723. */
  724. protected function _prepare_post( $post, $fields ) {
  725. // Holds the data for this post. built up based on $fields.
  726. $_post = array( 'post_id' => strval( $post['ID'] ) );
  727. // Prepare common post fields.
  728. $post_fields = array(
  729. 'post_title' => $post['post_title'],
  730. 'post_date' => $this->_convert_date( $post['post_date'] ),
  731. 'post_date_gmt' => $this->_convert_date_gmt( $post['post_date_gmt'], $post['post_date'] ),
  732. 'post_modified' => $this->_convert_date( $post['post_modified'] ),
  733. 'post_modified_gmt' => $this->_convert_date_gmt( $post['post_modified_gmt'], $post['post_modified'] ),
  734. 'post_status' => $post['post_status'],
  735. 'post_type' => $post['post_type'],
  736. 'post_name' => $post['post_name'],
  737. 'post_author' => $post['post_author'],
  738. 'post_password' => $post['post_password'],
  739. 'post_excerpt' => $post['post_excerpt'],
  740. 'post_content' => $post['post_content'],
  741. 'post_parent' => strval( $post['post_parent'] ),
  742. 'post_mime_type' => $post['post_mime_type'],
  743. 'link' => get_permalink( $post['ID'] ),
  744. 'guid' => $post['guid'],
  745. 'menu_order' => intval( $post['menu_order'] ),
  746. 'comment_status' => $post['comment_status'],
  747. 'ping_status' => $post['ping_status'],
  748. 'sticky' => ( $post['post_type'] === 'post' && is_sticky( $post['ID'] ) ),
  749. );
  750. // Thumbnail.
  751. $post_fields['post_thumbnail'] = array();
  752. $thumbnail_id = get_post_thumbnail_id( $post['ID'] );
  753. if ( $thumbnail_id ) {
  754. $thumbnail_size = current_theme_supports('post-thumbnail') ? 'post-thumbnail' : 'thumbnail';
  755. $post_fields['post_thumbnail'] = $this->_prepare_media_item( get_post( $thumbnail_id ), $thumbnail_size );
  756. }
  757. // Consider future posts as published.
  758. if ( $post_fields['post_status'] === 'future' )
  759. $post_fields['post_status'] = 'publish';
  760. // Fill in blank post format.
  761. $post_fields['post_format'] = get_post_format( $post['ID'] );
  762. if ( empty( $post_fields['post_format'] ) )
  763. $post_fields['post_format'] = 'standard';
  764. // Merge requested $post_fields fields into $_post.
  765. if ( in_array( 'post', $fields ) ) {
  766. $_post = array_merge( $_post, $post_fields );
  767. } else {
  768. $requested_fields = array_intersect_key( $post_fields, array_flip( $fields ) );
  769. $_post = array_merge( $_post, $requested_fields );
  770. }
  771. $all_taxonomy_fields = in_array( 'taxonomies', $fields );
  772. if ( $all_taxonomy_fields || in_array( 'terms', $fields ) ) {
  773. $post_type_taxonomies = get_object_taxonomies( $post['post_type'], 'names' );
  774. $terms = wp_get_object_terms( $post['ID'], $post_type_taxonomies );
  775. $_post['terms'] = array();
  776. foreach ( $terms as $term ) {
  777. $_post['terms'][] = $this->_prepare_term( $term );
  778. }
  779. }
  780. if ( in_array( 'custom_fields', $fields ) )
  781. $_post['custom_fields'] = $this->get_custom_fields( $post['ID'] );
  782. if ( in_array( 'enclosure', $fields ) ) {
  783. $_post['enclosure'] = array();
  784. $enclosures = (array) get_post_meta( $post['ID'], 'enclosure' );
  785. if ( ! empty( $enclosures ) ) {
  786. $encdata = explode( "\n", $enclosures[0] );
  787. $_post['enclosure']['url'] = trim( htmlspecialchars( $encdata[0] ) );
  788. $_post['enclosure']['length'] = (int) trim( $encdata[1] );
  789. $_post['enclosure']['type'] = trim( $encdata[2] );
  790. }
  791. }
  792. /**
  793. * Filters XML-RPC-prepared date for the given post.
  794. *
  795. * @since 3.4.0
  796. *
  797. * @param array $_post An array of modified post data.
  798. * @param array $post An array of post data.
  799. * @param array $fields An array of post fields.
  800. */
  801. return apply_filters( 'xmlrpc_prepare_post', $_post, $post, $fields );
  802. }
  803. /**
  804. * Prepares post data for return in an XML-RPC object.
  805. *
  806. * @since 3.4.0
  807. * @since 4.6.0 Converted the `$post_type` parameter to accept a WP_Post_Type object.
  808. * @access protected
  809. *
  810. * @param WP_Post_Type $post_type Post type object.
  811. * @param array $fields The subset of post fields to return.
  812. * @return array The prepared post type data.
  813. */
  814. protected function _prepare_post_type( $post_type, $fields ) {
  815. $_post_type = array(
  816. 'name' => $post_type->name,
  817. 'label' => $post_type->label,
  818. 'hierarchical' => (bool) $post_type->hierarchical,
  819. 'public' => (bool) $post_type->public,
  820. 'show_ui' => (bool) $post_type->show_ui,
  821. '_builtin' => (bool) $post_type->_builtin,
  822. 'has_archive' => (bool) $post_type->has_archive,
  823. 'supports' => get_all_post_type_supports( $post_type->name ),
  824. );
  825. if ( in_array( 'labels', $fields ) ) {
  826. $_post_type['labels'] = (array) $post_type->labels;
  827. }
  828. if ( in_array( 'cap', $fields ) ) {
  829. $_post_type['cap'] = (array) $post_type->cap;
  830. $_post_type['map_meta_cap'] = (bool) $post_type->map_meta_cap;
  831. }
  832. if ( in_array( 'menu', $fields ) ) {
  833. $_post_type['menu_position'] = (int) $post_type->menu_position;
  834. $_post_type['menu_icon'] = $post_type->menu_icon;
  835. $_post_type['show_in_menu'] = (bool) $post_type->show_in_menu;
  836. }
  837. if ( in_array( 'taxonomies', $fields ) )
  838. $_post_type['taxonomies'] = get_object_taxonomies( $post_type->name, 'names' );
  839. /**
  840. * Filters XML-RPC-prepared date for the given post type.
  841. *
  842. * @since 3.4.0
  843. * @since 4.6.0 Converted the `$post_type` parameter to accept a WP_Post_Type object.
  844. *
  845. * @param array $_post_type An array of post type data.
  846. * @param WP_Post_Type $post_type Post type object.
  847. */
  848. return apply_filters( 'xmlrpc_prepare_post_type', $_post_type, $post_type );
  849. }
  850. /**
  851. * Prepares media item data for return in an XML-RPC object.
  852. *
  853. * @access protected
  854. *
  855. * @param object $media_item The unprepared media item data.
  856. * @param string $thumbnail_size The image size to use for the thumbnail URL.
  857. * @return array The prepared media item data.
  858. */
  859. protected function _prepare_media_item( $media_item, $thumbnail_size = 'thumbnail' ) {
  860. $_media_item = array(
  861. 'attachment_id' => strval( $media_item->ID ),
  862. 'date_created_gmt' => $this->_convert_date_gmt( $media_item->post_date_gmt, $media_item->post_date ),
  863. 'parent' => $media_item->post_parent,
  864. 'link' => wp_get_attachment_url( $media_item->ID ),
  865. 'title' => $media_item->post_title,
  866. 'caption' => $media_item->post_excerpt,
  867. 'description' => $media_item->post_content,
  868. 'metadata' => wp_get_attachment_metadata( $media_item->ID ),
  869. 'type' => $media_item->post_mime_type
  870. );
  871. $thumbnail_src = image_downsize( $media_item->ID, $thumbnail_size );
  872. if ( $thumbnail_src )
  873. $_media_item['thumbnail'] = $thumbnail_src[0];
  874. else
  875. $_media_item['thumbnail'] = $_media_item['link'];
  876. /**
  877. * Filters XML-RPC-prepared data for the given media item.
  878. *
  879. * @since 3.4.0
  880. *
  881. * @param array $_media_item An array of media item data.
  882. * @param object $media_item Media item object.
  883. * @param string $thumbnail_size Image size.
  884. */
  885. return apply_filters( 'xmlrpc_prepare_media_item', $_media_item, $media_item, $thumbnail_size );
  886. }
  887. /**
  888. * Prepares page data for return in an XML-RPC object.
  889. *
  890. * @access protected
  891. *
  892. * @param object $page The unprepared page data.
  893. * @return array The prepared page data.
  894. */
  895. protected function _prepare_page( $page ) {
  896. // Get all of the page content and link.
  897. $full_page = get_extended( $page->post_content );
  898. $link = get_permalink( $page->ID );
  899. // Get info the page parent if there is one.
  900. $parent_title = "";
  901. if ( ! empty( $page->post_parent ) ) {
  902. $parent = get_post( $page->post_parent );
  903. $parent_title = $parent->post_title;
  904. }
  905. // Determine comment and ping settings.
  906. $allow_comments = comments_open( $page->ID ) ? 1 : 0;
  907. $allow_pings = pings_open( $page->ID ) ? 1 : 0;
  908. // Format page date.
  909. $page_date = $this->_convert_date( $page->post_date );
  910. $page_date_gmt = $this->_convert_date_gmt( $page->post_date_gmt, $page->post_date );
  911. // Pull the categories info together.
  912. $categories = array();
  913. if ( is_object_in_taxonomy( 'page', 'category' ) ) {
  914. foreach ( wp_get_post_categories( $page->ID ) as $cat_id ) {
  915. $categories[] = get_cat_name( $cat_id );
  916. }
  917. }
  918. // Get the author info.
  919. $author = get_userdata( $page->post_author );
  920. $page_template = get_page_template_slug( $page->ID );
  921. if ( empty( $page_template ) )
  922. $page_template = 'default';
  923. $_page = array(
  924. 'dateCreated' => $page_date,
  925. 'userid' => $page->post_author,
  926. 'page_id' => $page->ID,
  927. 'page_status' => $page->post_status,
  928. 'description' => $full_page['main'],
  929. 'title' => $page->post_title,
  930. 'link' => $link,
  931. 'permaLink' => $link,
  932. 'categories' => $categories,
  933. 'excerpt' => $page->post_excerpt,
  934. 'text_more' => $full_page['extended'],
  935. 'mt_allow_comments' => $allow_comments,
  936. 'mt_allow_pings' => $allow_pings,
  937. 'wp_slug' => $page->post_name,
  938. 'wp_password' => $page->post_password,
  939. 'wp_author' => $author->display_name,
  940. 'wp_page_parent_id' => $page->post_parent,
  941. 'wp_page_parent_title' => $parent_title,
  942. 'wp_page_order' => $page->menu_order,
  943. 'wp_author_id' => (string) $author->ID,
  944. 'wp_author_display_name' => $author->display_name,
  945. 'date_created_gmt' => $page_date_gmt,
  946. 'custom_fields' => $this->get_custom_fields( $page->ID ),
  947. 'wp_page_template' => $page_template
  948. );
  949. /**
  950. * Filters XML-RPC-prepared data for the given page.
  951. *
  952. * @since 3.4.0
  953. *
  954. * @param array $_page An array of page data.
  955. * @param WP_Post $page Page object.
  956. */
  957. return apply_filters( 'xmlrpc_prepare_page', $_page, $page );
  958. }
  959. /**
  960. * Prepares comment data for return in an XML-RPC object.
  961. *
  962. * @access protected
  963. *
  964. * @param object $comment The unprepared comment data.
  965. * @return array The prepared comment data.
  966. */
  967. protected function _prepare_comment( $comment ) {
  968. // Format page date.
  969. $comment_date_gmt = $this->_convert_date_gmt( $comment->comment_date_gmt, $comment->comment_date );
  970. if ( '0' == $comment->comment_approved ) {
  971. $comment_status = 'hold';
  972. } elseif ( 'spam' == $comment->comment_approved ) {
  973. $comment_status = 'spam';
  974. } elseif ( '1' == $comment->comment_approved ) {
  975. $comment_status = 'approve';
  976. } else {
  977. $comment_status = $comment->comment_approved;
  978. }
  979. $_comment = array(
  980. 'date_created_gmt' => $comment_date_gmt,
  981. 'user_id' => $comment->user_id,
  982. 'comment_id' => $comment->comment_ID,
  983. 'parent' => $comment->comment_parent,
  984. 'status' => $comment_status,
  985. 'content' => $comment->comment_content,
  986. 'link' => get_comment_link($comment),
  987. 'post_id' => $comment->comment_post_ID,
  988. 'post_title' => get_the_title($comment->comment_post_ID),
  989. 'author' => $comment->comment_author,
  990. 'author_url' => $comment->comment_author_url,
  991. 'author_email' => $comment->comment_author_email,
  992. 'author_ip' => $comment->comment_author_IP,
  993. 'type' => $comment->comment_type,
  994. );
  995. /**
  996. * Filters XML-RPC-prepared data for the given comment.
  997. *
  998. * @since 3.4.0
  999. *
  1000. * @param array $_comment An array of prepared comment data.
  1001. * @param WP_Comment $comment Comment object.
  1002. */
  1003. return apply_filters( 'xmlrpc_prepare_comment', $_comment, $comment );
  1004. }
  1005. /**
  1006. * Prepares user data for return in an XML-RPC object.
  1007. *
  1008. * @access protected
  1009. *
  1010. * @param WP_User $user The unprepared user object.
  1011. * @param array $fields The subset of user fields to return.
  1012. * @return array The prepared user data.
  1013. */
  1014. protected function _prepare_user( $user, $fields ) {
  1015. $_user = array( 'user_id' => strval( $user->ID ) );
  1016. $user_fields = array(
  1017. 'username' => $user->user_login,
  1018. 'first_name' => $user->user_firstname,
  1019. 'last_name' => $user->user_lastname,
  1020. 'registered' => $this->_convert_date( $user->user_registered ),
  1021. 'bio' => $user->user_description,
  1022. 'email' => $user->user_email,
  1023. 'nickname' => $user->nickname,
  1024. 'nicename' => $user->user_nicename,
  1025. 'url' => $user->user_url,
  1026. 'display_name' => $user->display_name,
  1027. 'roles' => $user->roles,
  1028. );
  1029. if ( in_array( 'all', $fields ) ) {
  1030. $_user = array_merge( $_user, $user_fields );
  1031. } else {
  1032. if ( in_array( 'basic', $fields ) ) {
  1033. $basic_fields = array( 'username', 'email', 'registered', 'display_name', 'nicename' );
  1034. $fields = array_merge( $fields, $basic_fields );
  1035. }
  1036. $requested_fields = array_intersect_key( $user_fields, array_flip( $fields ) );
  1037. $_user = array_merge( $_user, $requested_fields );
  1038. }
  1039. /**
  1040. * Filters XML-RPC-prepared data for the given user.
  1041. *
  1042. * @since 3.5.0
  1043. *
  1044. * @param array $_user An array of user data.
  1045. * @param WP_User $user User object.
  1046. * @param array $fields An array of user fields.
  1047. */
  1048. return apply_filters( 'xmlrpc_prepare_user', $_user, $user, $fields );
  1049. }
  1050. /**
  1051. * Create a new post for any registered post type.
  1052. *
  1053. * @since 3.4.0
  1054. *
  1055. * @link https://en.wikipedia.org/wiki/RSS_enclosure for information on RSS enclosures.
  1056. *
  1057. * @param array $args {
  1058. * Method arguments. Note: top-level arguments must be ordered as documented.
  1059. *
  1060. * @type int $blog_id Blog ID (unused).
  1061. * @type string $username Username.
  1062. * @type string $password Password.
  1063. * @type array $content_struct {
  1064. * Content struct for adding a new post. See wp_insert_post() for information on
  1065. * additional post fields
  1066. *
  1067. * @type string $post_type Post type. Default 'post'.
  1068. * @type string $post_status Post status. Default 'draft'
  1069. * @type string $post_title Post title.
  1070. * @type int $post_author Post author ID.
  1071. * @type string $post_excerpt Post excerpt.
  1072. * @type string $post_content Post content.
  1073. * @type string $post_date_gmt Post date in GMT.
  1074. * @type string $post_date Post date.
  1075. * @type string $post_password Post password (20-character limit).
  1076. * @type string $comment_status Post comment enabled status. Accepts 'open' or 'closed'.
  1077. * @type string $ping_status Post ping status. Accepts 'open' or 'closed'.
  1078. * @type bool $sticky Whether the post should be sticky. Automatically false if
  1079. * `$post_status` is 'private'.
  1080. * @type int $post_thumbnail ID of an image to use as the post thumbnail/featured image.
  1081. * @type array $custom_fields Array of meta key/value pairs to add to the post.
  1082. * @type array $terms Associative array with taxonomy names as keys and arrays
  1083. * of term IDs as values.
  1084. * @type array $terms_names Associative array with taxonomy names as keys and arrays
  1085. * of term names as values.
  1086. * @type array $enclosure {
  1087. * Array of feed enclosure data to add to post meta.
  1088. *
  1089. * @type string $url URL for the feed enclosure.
  1090. * @type int $length Size in bytes of the enclosure.
  1091. * @type string $type Mime-type for the enclosure.
  1092. * }
  1093. * }
  1094. * }
  1095. * @return int|IXR_Error Post ID on success, IXR_Error instance otherwise.
  1096. */
  1097. public function wp_newPost( $args ) {
  1098. if ( ! $this->minimum_args( $args, 4 ) )
  1099. return $this->error;
  1100. $this->escape( $args );
  1101. $username = $args[1];
  1102. $password = $args[2];
  1103. $content_struct = $args[3];
  1104. if ( ! $user = $this->login( $username, $password ) )
  1105. return $this->error;
  1106. // convert the date field back to IXR form
  1107. if ( isset( $content_struct['post_date'] ) && ! ( $content_struct['post_date'] instanceof IXR_Date ) ) {
  1108. $content_struct['post_date'] = $this->_convert_date( $content_struct['post_date'] );
  1109. }
  1110. // ignore the existing GMT date if it is empty or a non-GMT date was supplied in $content_struct,
  1111. // since _insert_post will ignore the non-GMT date if the GMT date is set
  1112. if ( isset( $content_struct['post_date_gmt'] ) && ! ( $content_struct['post_date_gmt'] instanceof IXR_Date ) ) {
  1113. if ( $content_struct['post_date_gmt'] == '0000-00-00 00:00:00' || isset( $content_struct['post_date'] ) ) {
  1114. unset( $content_struct['post_date_gmt'] );
  1115. } else {
  1116. $content_struct['post_date_gmt'] = $this->_convert_date( $content_struct['post_date_gmt'] );
  1117. }
  1118. }
  1119. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1120. do_action( 'xmlrpc_call', 'wp.newPost' );
  1121. unset( $content_struct['ID'] );
  1122. return $this->_insert_post( $user, $content_struct );
  1123. }
  1124. /**
  1125. * Helper method for filtering out elements from an array.
  1126. *
  1127. * @since 3.4.0
  1128. *
  1129. * @param int $count Number to compare to one.
  1130. */
  1131. private function _is_greater_than_one( $count ) {
  1132. return $count > 1;
  1133. }
  1134. /**
  1135. * Encapsulate the logic for sticking a post
  1136. * and determining if the user has permission to do so
  1137. *
  1138. * @since 4.3.0
  1139. * @access private
  1140. *
  1141. * @param array $post_data
  1142. * @param bool $update
  1143. * @return void|IXR_Error
  1144. */
  1145. private function _toggle_sticky( $post_data, $update = false ) {
  1146. $post_type = get_post_type_object( $post_data['post_type'] );
  1147. // Private and password-protected posts cannot be stickied.
  1148. if ( 'private' === $post_data['post_status'] || ! empty( $post_data['post_password'] ) ) {
  1149. // Error if the client tried to stick the post, otherwise, silently unstick.
  1150. if ( ! empty( $post_data['sticky'] ) ) {
  1151. return new IXR_Error( 401, __( 'Sorry, you cannot stick a private post.' ) );
  1152. }
  1153. if ( $update ) {
  1154. unstick_post( $post_data['ID'] );
  1155. }
  1156. } elseif ( isset( $post_data['sticky'] ) ) {
  1157. if ( ! current_user_can( $post_type->cap->edit_others_posts ) ) {
  1158. return new IXR_Error( 401, __( 'Sorry, you are not allowed to make posts sticky.' ) );
  1159. }
  1160. $sticky = wp_validate_boolean( $post_data['sticky'] );
  1161. if ( $sticky ) {
  1162. stick_post( $post_data['ID'] );
  1163. } else {
  1164. unstick_post( $post_data['ID'] );
  1165. }
  1166. }
  1167. }
  1168. /**
  1169. * Helper method for wp_newPost() and wp_editPost(), containing shared logic.
  1170. *
  1171. * @since 3.4.0
  1172. * @access protected
  1173. *
  1174. * @see wp_insert_post()
  1175. *
  1176. * @param WP_User $user The post author if post_author isn't set in $content_struct.
  1177. * @param array|IXR_Error $content_struct Post data to insert.
  1178. * @return IXR_Error|string
  1179. */
  1180. protected function _insert_post( $user, $content_struct ) {
  1181. $defaults = array( 'post_status' => 'draft', 'post_type' => 'post', 'post_author' => 0,
  1182. 'post_password' => '', 'post_excerpt' => '', 'post_content' => '', 'post_title' => '' );
  1183. $post_data = wp_parse_args( $content_struct, $defaults );
  1184. $post_type = get_post_type_object( $post_data['post_type'] );
  1185. if ( ! $post_type )
  1186. return new IXR_Error( 403, __( 'Invalid post type.' ) );
  1187. $update = ! empty( $post_data['ID'] );
  1188. if ( $update ) {
  1189. if ( ! get_post( $post_data['ID'] ) )
  1190. return new IXR_Error( 401, __( 'Invalid post ID.' ) );
  1191. if ( ! current_user_can( 'edit_post', $post_data['ID'] ) )
  1192. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  1193. if ( $post_data['post_type'] != get_post_type( $post_data['ID'] ) )
  1194. return new IXR_Error( 401, __( 'The post type may not be changed.' ) );
  1195. } else {
  1196. if ( ! current_user_can( $post_type->cap->create_posts ) || ! current_user_can( $post_type->cap->edit_posts ) )
  1197. return new IXR_Error( 401, __( 'Sorry, you are not allowed to post on this site.' ) );
  1198. }
  1199. switch ( $post_data['post_status'] ) {
  1200. case 'draft':
  1201. case 'pending':
  1202. break;
  1203. case 'private':
  1204. if ( ! current_user_can( $post_type->cap->publish_posts ) )
  1205. return new IXR_Error( 401, __( 'Sorry, you are not allowed to create private posts in this post type.' ) );
  1206. break;
  1207. case 'publish':
  1208. case 'future':
  1209. if ( ! current_user_can( $post_type->cap->publish_posts ) )
  1210. return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish posts in this post type.' ) );
  1211. break;
  1212. default:
  1213. if ( ! get_post_status_object( $post_data['post_status'] ) )
  1214. $post_data['post_status'] = 'draft';
  1215. break;
  1216. }
  1217. if ( ! empty( $post_data['post_password'] ) && ! current_user_can( $post_type->cap->publish_posts ) )
  1218. return new IXR_Error( 401, __( 'Sorry, you are not allowed to create password protected posts in this post type.' ) );
  1219. $post_data['post_author'] = absint( $post_data['post_author'] );
  1220. if ( ! empty( $post_data['post_author'] ) && $post_data['post_author'] != $user->ID ) {
  1221. if ( ! current_user_can( $post_type->cap->edit_others_posts ) )
  1222. return new IXR_Error( 401, __( 'Sorry, you are not allowed to create posts as this user.' ) );
  1223. $author = get_userdata( $post_data['post_author'] );
  1224. if ( ! $author )
  1225. return new IXR_Error( 404, __( 'Invalid author ID.' ) );
  1226. } else {
  1227. $post_data['post_author'] = $user->ID;
  1228. }
  1229. if ( isset( $post_data['comment_status'] ) && $post_data['comment_status'] != 'open' && $post_data['comment_status'] != 'closed' )
  1230. unset( $post_data['comment_status'] );
  1231. if ( isset( $post_data['ping_status'] ) && $post_data['ping_status'] != 'open' && $post_data['ping_status'] != 'closed' )
  1232. unset( $post_data['ping_status'] );
  1233. // Do some timestamp voodoo.
  1234. if ( ! empty( $post_data['post_date_gmt'] ) ) {
  1235. // We know this is supposed to be GMT, so we're going to slap that Z on there by force.
  1236. $dateCreated = rtrim( $post_data['post_date_gmt']->getIso(), 'Z' ) . 'Z';
  1237. } elseif ( ! empty( $post_data['post_date'] ) ) {
  1238. $dateCreated = $post_data['post_date']->getIso();
  1239. }
  1240. // Default to not flagging the post date to be edited unless it's intentional.
  1241. $post_data['edit_date'] = false;
  1242. if ( ! empty( $dateCreated ) ) {
  1243. $post_data['post_date'] = get_date_from_gmt( iso8601_to_datetime( $dateCreated ) );
  1244. $post_data['post_date_gmt'] = iso8601_to_datetime( $dateCreated, 'GMT' );
  1245. // Flag the post date to be edited.
  1246. $post_data['edit_date'] = true;
  1247. }
  1248. if ( ! isset( $post_data['ID'] ) )
  1249. $post_data['ID'] = get_default_post_to_edit( $post_data['post_type'], true )->ID;
  1250. $post_ID = $post_data['ID'];
  1251. if ( $post_data['post_type'] == 'post' ) {
  1252. $error = $this->_toggle_sticky( $post_data, $update );
  1253. if ( $error ) {
  1254. return $error;
  1255. }
  1256. }
  1257. if ( isset( $post_data['post_thumbnail'] ) ) {
  1258. // empty value deletes, non-empty value adds/updates.
  1259. if ( ! $post_data['post_thumbnail'] )
  1260. delete_post_thumbnail( $post_ID );
  1261. elseif ( ! get_post( absint( $post_data['post_thumbnail'] ) ) )
  1262. return new IXR_Error( 404, __( 'Invalid attachment ID.' ) );
  1263. set_post_thumbnail( $post_ID, $post_data['post_thumbnail'] );
  1264. unset( $content_struct['post_thumbnail'] );
  1265. }
  1266. if ( isset( $post_data['custom_fields'] ) )
  1267. $this->set_custom_fields( $post_ID, $post_data['custom_fields'] );
  1268. if ( isset( $post_data['terms'] ) || isset( $post_data['terms_names'] ) ) {
  1269. $post_type_taxonomies = get_object_taxonomies( $post_data['post_type'], 'objects' );
  1270. // Accumulate term IDs from terms and terms_names.
  1271. $terms = array();
  1272. // First validate the terms specified by ID.
  1273. if ( isset( $post_data['terms'] ) && is_array( $post_data['terms'] ) ) {
  1274. $taxonomies = array_keys( $post_data['terms'] );
  1275. // Validating term ids.
  1276. foreach ( $taxonomies as $taxonomy ) {
  1277. if ( ! array_key_exists( $taxonomy , $post_type_taxonomies ) )
  1278. return new IXR_Error( 401, __( 'Sorry, one of the given taxonomies is not supported by the post type.' ) );
  1279. if ( ! current_user_can( $post_type_taxonomies[$taxonomy]->cap->assign_terms ) )
  1280. return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign a term to one of the given taxonomies.' ) );
  1281. $term_ids = $post_data['terms'][$taxonomy];
  1282. $terms[ $taxonomy ] = array();
  1283. foreach ( $term_ids as $term_id ) {
  1284. $term = get_term_by( 'id', $term_id, $taxonomy );
  1285. if ( ! $term )
  1286. return new IXR_Error( 403, __( 'Invalid term ID.' ) );
  1287. $terms[$taxonomy][] = (int) $term_id;
  1288. }
  1289. }
  1290. }
  1291. // Now validate terms specified by name.
  1292. if ( isset( $post_data['terms_names'] ) && is_array( $post_data['terms_names'] ) ) {
  1293. $taxonomies = array_keys( $post_data['terms_names'] );
  1294. foreach ( $taxonomies as $taxonomy ) {
  1295. if ( ! array_key_exists( $taxonomy , $post_type_taxonomies ) )
  1296. return new IXR_Error( 401, __( 'Sorry, one of the given taxonomies is not supported by the post type.' ) );
  1297. if ( ! current_user_can( $post_type_taxonomies[$taxonomy]->cap->assign_terms ) )
  1298. return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign a term to one of the given taxonomies.' ) );
  1299. /*
  1300. * For hierarchical taxonomies, we can't assign a term when multiple terms
  1301. * in the hierarchy share the same name.
  1302. */
  1303. $ambiguous_terms = array();
  1304. if ( is_taxonomy_hierarchical( $taxonomy ) ) {
  1305. $tax_term_names = get_terms( $taxonomy, array( 'fields' => 'names', 'hide_empty' => false ) );
  1306. // Count the number of terms with the same name.
  1307. $tax_term_names_count = array_count_values( $tax_term_names );
  1308. // Filter out non-ambiguous term names.
  1309. $ambiguous_tax_term_counts = array_filter( $tax_term_names_count, array( $this, '_is_greater_than_one') );
  1310. $ambiguous_terms = array_keys( $ambiguous_tax_term_counts );
  1311. }
  1312. $term_names = $post_data['terms_names'][$taxonomy];
  1313. foreach ( $term_names as $term_name ) {
  1314. if ( in_array( $term_name, $ambiguous_terms ) )
  1315. return new IXR_Error( 401, __( 'Ambiguous term name used in a hierarchical taxonomy. Please use term ID instead.' ) );
  1316. $term = get_term_by( 'name', $term_name, $taxonomy );
  1317. if ( ! $term ) {
  1318. // Term doesn't exist, so check that the user is allowed to create new terms.
  1319. if ( ! current_user_can( $post_type_taxonomies[$taxonomy]->cap->edit_terms ) )
  1320. return new IXR_Error( 401, __( 'Sorry, you are not allowed to add a term to one of the given taxonomies.' ) );
  1321. // Create the new term.
  1322. $term_info = wp_insert_term( $term_name, $taxonomy );
  1323. if ( is_wp_error( $term_info ) )
  1324. return new IXR_Error( 500, $term_info->get_error_message() );
  1325. $terms[$taxonomy][] = (int) $term_info['term_id'];
  1326. } else {
  1327. $terms[$taxonomy][] = (int) $term->term_id;
  1328. }
  1329. }
  1330. }
  1331. }
  1332. $post_data['tax_input'] = $terms;
  1333. unset( $post_data['terms'], $post_data['terms_names'] );
  1334. } else {
  1335. // Do not allow direct submission of 'tax_input', clients must use 'terms' and/or 'terms_names'.
  1336. unset( $post_data['tax_input'], $post_data['post_category'], $post_data['tags_input'] );
  1337. }
  1338. if ( isset( $post_data['post_format'] ) ) {
  1339. $format = set_post_format( $post_ID, $post_data['post_format'] );
  1340. if ( is_wp_error( $format ) )
  1341. return new IXR_Error( 500, $format->get_error_message() );
  1342. unset( $post_data['post_format'] );
  1343. }
  1344. // Handle enclosures.
  1345. $enclosure = isset( $post_data['enclosure'] ) ? $post_data['enclosure'] : null;
  1346. $this->add_enclosure_if_new( $post_ID, $enclosure );
  1347. $this->attach_uploads( $post_ID, $post_data['post_content'] );
  1348. /**
  1349. * Filters post data array to be inserted via XML-RPC.
  1350. *
  1351. * @since 3.4.0
  1352. *
  1353. * @param array $post_data Parsed array of post data.
  1354. * @param array $content_struct Post data array.
  1355. */
  1356. $post_data = apply_filters( 'xmlrpc_wp_insert_post_data', $post_data, $content_struct );
  1357. $post_ID = $update ? wp_update_post( $post_data, true ) : wp_insert_post( $post_data, true );
  1358. if ( is_wp_error( $post_ID ) )
  1359. return new IXR_Error( 500, $post_ID->get_error_message() );
  1360. if ( ! $post_ID )
  1361. return new IXR_Error( 401, __( 'Sorry, your entry could not be posted.' ) );
  1362. return strval( $post_ID );
  1363. }
  1364. /**
  1365. * Edit a post for any registered post type.
  1366. *
  1367. * The $content_struct parameter only needs to contain fields that
  1368. * should be changed. All other fields will retain their existing values.
  1369. *
  1370. * @since 3.4.0
  1371. *
  1372. * @param array $args {
  1373. * Method arguments. Note: arguments must be ordered as documented.
  1374. *
  1375. * @type int $blog_id Blog ID (unused).
  1376. * @type string $username Username.
  1377. * @type string $password Password.
  1378. * @type int $post_id Post ID.
  1379. * @type array $content_struct Extra content arguments.
  1380. * }
  1381. * @return true|IXR_Error True on success, IXR_Error on failure.
  1382. */
  1383. public function wp_editPost( $args ) {
  1384. if ( ! $this->minimum_args( $args, 5 ) )
  1385. return $this->error;
  1386. $this->escape( $args );
  1387. $username = $args[1];
  1388. $password = $args[2];
  1389. $post_id = (int) $args[3];
  1390. $content_struct = $args[4];
  1391. if ( ! $user = $this->login( $username, $password ) )
  1392. return $this->error;
  1393. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1394. do_action( 'xmlrpc_call', 'wp.editPost' );
  1395. $post = get_post( $post_id, ARRAY_A );
  1396. if ( empty( $post['ID'] ) )
  1397. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  1398. if ( isset( $content_struct['if_not_modified_since'] ) ) {
  1399. // If the post has been modified since the date provided, return an error.
  1400. if ( mysql2date( 'U', $post['post_modified_gmt'] ) > $content_struct['if_not_modified_since']->getTimestamp() ) {
  1401. return new IXR_Error( 409, __( 'There is a revision of this post that is more recent.' ) );
  1402. }
  1403. }
  1404. // Convert the date field back to IXR form.
  1405. $post['post_date'] = $this->_convert_date( $post['post_date'] );
  1406. /*
  1407. * Ignore the existing GMT date if it is empty or a non-GMT date was supplied in $content_struct,
  1408. * since _insert_post() will ignore the non-GMT date if the GMT date is set.
  1409. */
  1410. if ( $post['post_date_gmt'] == '0000-00-00 00:00:00' || isset( $content_struct['post_date'] ) )
  1411. unset( $post['post_date_gmt'] );
  1412. else
  1413. $post['post_date_gmt'] = $this->_convert_date( $post['post_date_gmt'] );
  1414. $this->escape( $post );
  1415. $merged_content_struct = array_merge( $post, $content_struct );
  1416. $retval = $this->_insert_post( $user, $merged_content_struct );
  1417. if ( $retval instanceof IXR_Error )
  1418. return $retval;
  1419. return true;
  1420. }
  1421. /**
  1422. * Delete a post for any registered post type.
  1423. *
  1424. * @since 3.4.0
  1425. *
  1426. * @see wp_delete_post()
  1427. *
  1428. * @param array $args {
  1429. * Method arguments. Note: arguments must be ordered as documented.
  1430. *
  1431. * @type int $blog_id Blog ID (unused).
  1432. * @type string $username Username.
  1433. * @type string $password Password.
  1434. * @type int $post_id Post ID.
  1435. * }
  1436. * @return true|IXR_Error True on success, IXR_Error instance on failure.
  1437. */
  1438. public function wp_deletePost( $args ) {
  1439. if ( ! $this->minimum_args( $args, 4 ) )
  1440. return $this->error;
  1441. $this->escape( $args );
  1442. $username = $args[1];
  1443. $password = $args[2];
  1444. $post_id = (int) $args[3];
  1445. if ( ! $user = $this->login( $username, $password ) )
  1446. return $this->error;
  1447. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1448. do_action( 'xmlrpc_call', 'wp.deletePost' );
  1449. $post = get_post( $post_id, ARRAY_A );
  1450. if ( empty( $post['ID'] ) ) {
  1451. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  1452. }
  1453. if ( ! current_user_can( 'delete_post', $post_id ) ) {
  1454. return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this post.' ) );
  1455. }
  1456. $result = wp_delete_post( $post_id );
  1457. if ( ! $result ) {
  1458. return new IXR_Error( 500, __( 'The post cannot be deleted.' ) );
  1459. }
  1460. return true;
  1461. }
  1462. /**
  1463. * Retrieve a post.
  1464. *
  1465. * @since 3.4.0
  1466. *
  1467. * The optional $fields parameter specifies what fields will be included
  1468. * in the response array. This should be a list of field names. 'post_id' will
  1469. * always be included in the response regardless of the value of $fields.
  1470. *
  1471. * Instead of, or in addition to, individual field names, conceptual group
  1472. * names can be used to specify multiple fields. The available conceptual
  1473. * groups are 'post' (all basic fields), 'taxonomies', 'custom_fields',
  1474. * and 'enclosure'.
  1475. *
  1476. * @see get_post()
  1477. *
  1478. * @param array $args {
  1479. * Method arguments. Note: arguments must be ordered as documented.
  1480. *
  1481. * @type int $blog_id Blog ID (unused).
  1482. * @type string $username Username.
  1483. * @type string $password Password.
  1484. * @type int $post_id Post ID.
  1485. * @type array $fields The subset of post type fields to return.
  1486. * }
  1487. * @return array|IXR_Error Array contains (based on $fields parameter):
  1488. * - 'post_id'
  1489. * - 'post_title'
  1490. * - 'post_date'
  1491. * - 'post_date_gmt'
  1492. * - 'post_modified'
  1493. * - 'post_modified_gmt'
  1494. * - 'post_status'
  1495. * - 'post_type'
  1496. * - 'post_name'
  1497. * - 'post_author'
  1498. * - 'post_password'
  1499. * - 'post_excerpt'
  1500. * - 'post_content'
  1501. * - 'link'
  1502. * - 'comment_status'
  1503. * - 'ping_status'
  1504. * - 'sticky'
  1505. * - 'custom_fields'
  1506. * - 'terms'
  1507. * - 'categories'
  1508. * - 'tags'
  1509. * - 'enclosure'
  1510. */
  1511. public function wp_getPost( $args ) {
  1512. if ( ! $this->minimum_args( $args, 4 ) )
  1513. return $this->error;
  1514. $this->escape( $args );
  1515. $username = $args[1];
  1516. $password = $args[2];
  1517. $post_id = (int) $args[3];
  1518. if ( isset( $args[4] ) ) {
  1519. $fields = $args[4];
  1520. } else {
  1521. /**
  1522. * Filters the list of post query fields used by the given XML-RPC method.
  1523. *
  1524. * @since 3.4.0
  1525. *
  1526. * @param array $fields Array of post fields. Default array contains 'post', 'terms', and 'custom_fields'.
  1527. * @param string $method Method name.
  1528. */
  1529. $fields = apply_filters( 'xmlrpc_default_post_fields', array( 'post', 'terms', 'custom_fields' ), 'wp.getPost' );
  1530. }
  1531. if ( ! $user = $this->login( $username, $password ) )
  1532. return $this->error;
  1533. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1534. do_action( 'xmlrpc_call', 'wp.getPost' );
  1535. $post = get_post( $post_id, ARRAY_A );
  1536. if ( empty( $post['ID'] ) )
  1537. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  1538. if ( ! current_user_can( 'edit_post', $post_id ) )
  1539. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  1540. return $this->_prepare_post( $post, $fields );
  1541. }
  1542. /**
  1543. * Retrieve posts.
  1544. *
  1545. * @since 3.4.0
  1546. *
  1547. * @see wp_get_recent_posts()
  1548. * @see wp_getPost() for more on `$fields`
  1549. * @see get_posts() for more on `$filter` values
  1550. *
  1551. * @param array $args {
  1552. * Method arguments. Note: arguments must be ordered as documented.
  1553. *
  1554. * @type int $blog_id Blog ID (unused).
  1555. * @type string $username Username.
  1556. * @type string $password Password.
  1557. * @type array $filter Optional. Modifies the query used to retrieve posts. Accepts 'post_type',
  1558. * 'post_status', 'number', 'offset', 'orderby', 's', and 'order'.
  1559. * Default empty array.
  1560. * @type array $fields Optional. The subset of post type fields to return in the response array.
  1561. * }
  1562. * @return array|IXR_Error Array contains a collection of posts.
  1563. */
  1564. public function wp_getPosts( $args ) {
  1565. if ( ! $this->minimum_args( $args, 3 ) )
  1566. return $this->error;
  1567. $this->escape( $args );
  1568. $username = $args[1];
  1569. $password = $args[2];
  1570. $filter = isset( $args[3] ) ? $args[3] : array();
  1571. if ( isset( $args[4] ) ) {
  1572. $fields = $args[4];
  1573. } else {
  1574. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1575. $fields = apply_filters( 'xmlrpc_default_post_fields', array( 'post', 'terms', 'custom_fields' ), 'wp.getPosts' );
  1576. }
  1577. if ( ! $user = $this->login( $username, $password ) )
  1578. return $this->error;
  1579. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1580. do_action( 'xmlrpc_call', 'wp.getPosts' );
  1581. $query = array();
  1582. if ( isset( $filter['post_type'] ) ) {
  1583. $post_type = get_post_type_object( $filter['post_type'] );
  1584. if ( ! ( (bool) $post_type ) )
  1585. return new IXR_Error( 403, __( 'Invalid post type.' ) );
  1586. } else {
  1587. $post_type = get_post_type_object( 'post' );
  1588. }
  1589. if ( ! current_user_can( $post_type->cap->edit_posts ) )
  1590. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts in this post type.' ) );
  1591. $query['post_type'] = $post_type->name;
  1592. if ( isset( $filter['post_status'] ) )
  1593. $query['post_status'] = $filter['post_status'];
  1594. if ( isset( $filter['number'] ) )
  1595. $query['numberposts'] = absint( $filter['number'] );
  1596. if ( isset( $filter['offset'] ) )
  1597. $query['offset'] = absint( $filter['offset'] );
  1598. if ( isset( $filter['orderby'] ) ) {
  1599. $query['orderby'] = $filter['orderby'];
  1600. if ( isset( $filter['order'] ) )
  1601. $query['order'] = $filter['order'];
  1602. }
  1603. if ( isset( $filter['s'] ) ) {
  1604. $query['s'] = $filter['s'];
  1605. }
  1606. $posts_list = wp_get_recent_posts( $query );
  1607. if ( ! $posts_list )
  1608. return array();
  1609. // Holds all the posts data.
  1610. $struct = array();
  1611. foreach ( $posts_list as $post ) {
  1612. if ( ! current_user_can( 'edit_post', $post['ID'] ) )
  1613. continue;
  1614. $struct[] = $this->_prepare_post( $post, $fields );
  1615. }
  1616. return $struct;
  1617. }
  1618. /**
  1619. * Create a new term.
  1620. *
  1621. * @since 3.4.0
  1622. *
  1623. * @see wp_insert_term()
  1624. *
  1625. * @param array $args {
  1626. * Method arguments. Note: arguments must be ordered as documented.
  1627. *
  1628. * @type int $blog_id Blog ID (unused).
  1629. * @type string $username Username.
  1630. * @type string $password Password.
  1631. * @type array $content_struct Content struct for adding a new term. The struct must contain
  1632. * the term 'name' and 'taxonomy'. Optional accepted values include
  1633. * 'parent', 'description', and 'slug'.
  1634. * }
  1635. * @return int|IXR_Error The term ID on success, or an IXR_Error object on failure.
  1636. */
  1637. public function wp_newTerm( $args ) {
  1638. if ( ! $this->minimum_args( $args, 4 ) )
  1639. return $this->error;
  1640. $this->escape( $args );
  1641. $username = $args[1];
  1642. $password = $args[2];
  1643. $content_struct = $args[3];
  1644. if ( ! $user = $this->login( $username, $password ) )
  1645. return $this->error;
  1646. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1647. do_action( 'xmlrpc_call', 'wp.newTerm' );
  1648. if ( ! taxonomy_exists( $content_struct['taxonomy'] ) )
  1649. return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
  1650. $taxonomy = get_taxonomy( $content_struct['taxonomy'] );
  1651. if ( ! current_user_can( $taxonomy->cap->edit_terms ) ) {
  1652. return new IXR_Error( 401, __( 'Sorry, you are not allowed to create terms in this taxonomy.' ) );
  1653. }
  1654. $taxonomy = (array) $taxonomy;
  1655. // hold the data of the term
  1656. $term_data = array();
  1657. $term_data['name'] = trim( $content_struct['name'] );
  1658. if ( empty( $term_data['name'] ) )
  1659. return new IXR_Error( 403, __( 'The term name cannot be empty.' ) );
  1660. if ( isset( $content_struct['parent'] ) ) {
  1661. if ( ! $taxonomy['hierarchical'] )
  1662. return new IXR_Error( 403, __( 'This taxonomy is not hierarchical.' ) );
  1663. $parent_term_id = (int) $content_struct['parent'];
  1664. $parent_term = get_term( $parent_term_id , $taxonomy['name'] );
  1665. if ( is_wp_error( $parent_term ) )
  1666. return new IXR_Error( 500, $parent_term->get_error_message() );
  1667. if ( ! $parent_term )
  1668. return new IXR_Error( 403, __( 'Parent term does not exist.' ) );
  1669. $term_data['parent'] = $content_struct['parent'];
  1670. }
  1671. if ( isset( $content_struct['description'] ) )
  1672. $term_data['description'] = $content_struct['description'];
  1673. if ( isset( $content_struct['slug'] ) )
  1674. $term_data['slug'] = $content_struct['slug'];
  1675. $term = wp_insert_term( $term_data['name'] , $taxonomy['name'] , $term_data );
  1676. if ( is_wp_error( $term ) )
  1677. return new IXR_Error( 500, $term->get_error_message() );
  1678. if ( ! $term )
  1679. return new IXR_Error( 500, __( 'Sorry, your term could not be created.' ) );
  1680. return strval( $term['term_id'] );
  1681. }
  1682. /**
  1683. * Edit a term.
  1684. *
  1685. * @since 3.4.0
  1686. *
  1687. * @see wp_update_term()
  1688. *
  1689. * @param array $args {
  1690. * Method arguments. Note: arguments must be ordered as documented.
  1691. *
  1692. * @type int $blog_id Blog ID (unused).
  1693. * @type string $username Username.
  1694. * @type string $password Password.
  1695. * @type int $term_id Term ID.
  1696. * @type array $content_struct Content struct for editing a term. The struct must contain the
  1697. * term ''taxonomy'. Optional accepted values include 'name', 'parent',
  1698. * 'description', and 'slug'.
  1699. * }
  1700. * @return true|IXR_Error True on success, IXR_Error instance on failure.
  1701. */
  1702. public function wp_editTerm( $args ) {
  1703. if ( ! $this->minimum_args( $args, 5 ) )
  1704. return $this->error;
  1705. $this->escape( $args );
  1706. $username = $args[1];
  1707. $password = $args[2];
  1708. $term_id = (int) $args[3];
  1709. $content_struct = $args[4];
  1710. if ( ! $user = $this->login( $username, $password ) )
  1711. return $this->error;
  1712. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1713. do_action( 'xmlrpc_call', 'wp.editTerm' );
  1714. if ( ! taxonomy_exists( $content_struct['taxonomy'] ) )
  1715. return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
  1716. $taxonomy = get_taxonomy( $content_struct['taxonomy'] );
  1717. $taxonomy = (array) $taxonomy;
  1718. // hold the data of the term
  1719. $term_data = array();
  1720. $term = get_term( $term_id , $content_struct['taxonomy'] );
  1721. if ( is_wp_error( $term ) )
  1722. return new IXR_Error( 500, $term->get_error_message() );
  1723. if ( ! $term )
  1724. return new IXR_Error( 404, __( 'Invalid term ID.' ) );
  1725. if ( ! current_user_can( 'edit_term', $term_id ) ) {
  1726. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this term.' ) );
  1727. }
  1728. if ( isset( $content_struct['name'] ) ) {
  1729. $term_data['name'] = trim( $content_struct['name'] );
  1730. if ( empty( $term_data['name'] ) )
  1731. return new IXR_Error( 403, __( 'The term name cannot be empty.' ) );
  1732. }
  1733. if ( ! empty( $content_struct['parent'] ) ) {
  1734. if ( ! $taxonomy['hierarchical'] )
  1735. return new IXR_Error( 403, __( "This taxonomy is not hierarchical so you can't set a parent." ) );
  1736. $parent_term_id = (int) $content_struct['parent'];
  1737. $parent_term = get_term( $parent_term_id , $taxonomy['name'] );
  1738. if ( is_wp_error( $parent_term ) )
  1739. return new IXR_Error( 500, $parent_term->get_error_message() );
  1740. if ( ! $parent_term )
  1741. return new IXR_Error( 403, __( 'Parent term does not exist.' ) );
  1742. $term_data['parent'] = $content_struct['parent'];
  1743. }
  1744. if ( isset( $content_struct['description'] ) )
  1745. $term_data['description'] = $content_struct['description'];
  1746. if ( isset( $content_struct['slug'] ) )
  1747. $term_data['slug'] = $content_struct['slug'];
  1748. $term = wp_update_term( $term_id , $taxonomy['name'] , $term_data );
  1749. if ( is_wp_error( $term ) )
  1750. return new IXR_Error( 500, $term->get_error_message() );
  1751. if ( ! $term )
  1752. return new IXR_Error( 500, __( 'Sorry, editing the term failed.' ) );
  1753. return true;
  1754. }
  1755. /**
  1756. * Delete a term.
  1757. *
  1758. * @since 3.4.0
  1759. *
  1760. * @see wp_delete_term()
  1761. *
  1762. * @param array $args {
  1763. * Method arguments. Note: arguments must be ordered as documented.
  1764. *
  1765. * @type int $blog_id Blog ID (unused).
  1766. * @type string $username Username.
  1767. * @type string $password Password.
  1768. * @type string $taxnomy_name Taxonomy name.
  1769. * @type int $term_id Term ID.
  1770. * }
  1771. * @return bool|IXR_Error True on success, IXR_Error instance on failure.
  1772. */
  1773. public function wp_deleteTerm( $args ) {
  1774. if ( ! $this->minimum_args( $args, 5 ) )
  1775. return $this->error;
  1776. $this->escape( $args );
  1777. $username = $args[1];
  1778. $password = $args[2];
  1779. $taxonomy = $args[3];
  1780. $term_id = (int) $args[4];
  1781. if ( ! $user = $this->login( $username, $password ) )
  1782. return $this->error;
  1783. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1784. do_action( 'xmlrpc_call', 'wp.deleteTerm' );
  1785. if ( ! taxonomy_exists( $taxonomy ) )
  1786. return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
  1787. $taxonomy = get_taxonomy( $taxonomy );
  1788. $term = get_term( $term_id, $taxonomy->name );
  1789. if ( is_wp_error( $term ) )
  1790. return new IXR_Error( 500, $term->get_error_message() );
  1791. if ( ! $term )
  1792. return new IXR_Error( 404, __( 'Invalid term ID.' ) );
  1793. if ( ! current_user_can( 'delete_term', $term_id ) ) {
  1794. return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this term.' ) );
  1795. }
  1796. $result = wp_delete_term( $term_id, $taxonomy->name );
  1797. if ( is_wp_error( $result ) )
  1798. return new IXR_Error( 500, $term->get_error_message() );
  1799. if ( ! $result )
  1800. return new IXR_Error( 500, __( 'Sorry, deleting the term failed.' ) );
  1801. return $result;
  1802. }
  1803. /**
  1804. * Retrieve a term.
  1805. *
  1806. * @since 3.4.0
  1807. *
  1808. * @see get_term()
  1809. *
  1810. * @param array $args {
  1811. * Method arguments. Note: arguments must be ordered as documented.
  1812. *
  1813. * @type int $blog_id Blog ID (unused).
  1814. * @type string $username Username.
  1815. * @type string $password Password.
  1816. * @type string $taxnomy Taxonomy name.
  1817. * @type string $term_id Term ID.
  1818. * }
  1819. * @return array|IXR_Error IXR_Error on failure, array on success, containing:
  1820. * - 'term_id'
  1821. * - 'name'
  1822. * - 'slug'
  1823. * - 'term_group'
  1824. * - 'term_taxonomy_id'
  1825. * - 'taxonomy'
  1826. * - 'description'
  1827. * - 'parent'
  1828. * - 'count'
  1829. */
  1830. public function wp_getTerm( $args ) {
  1831. if ( ! $this->minimum_args( $args, 5 ) )
  1832. return $this->error;
  1833. $this->escape( $args );
  1834. $username = $args[1];
  1835. $password = $args[2];
  1836. $taxonomy = $args[3];
  1837. $term_id = (int) $args[4];
  1838. if ( ! $user = $this->login( $username, $password ) )
  1839. return $this->error;
  1840. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1841. do_action( 'xmlrpc_call', 'wp.getTerm' );
  1842. if ( ! taxonomy_exists( $taxonomy ) )
  1843. return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
  1844. $taxonomy = get_taxonomy( $taxonomy );
  1845. $term = get_term( $term_id , $taxonomy->name, ARRAY_A );
  1846. if ( is_wp_error( $term ) )
  1847. return new IXR_Error( 500, $term->get_error_message() );
  1848. if ( ! $term )
  1849. return new IXR_Error( 404, __( 'Invalid term ID.' ) );
  1850. if ( ! current_user_can( 'assign_term', $term_id ) ) {
  1851. return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign this term.' ) );
  1852. }
  1853. return $this->_prepare_term( $term );
  1854. }
  1855. /**
  1856. * Retrieve all terms for a taxonomy.
  1857. *
  1858. * @since 3.4.0
  1859. *
  1860. * The optional $filter parameter modifies the query used to retrieve terms.
  1861. * Accepted keys are 'number', 'offset', 'orderby', 'order', 'hide_empty', and 'search'.
  1862. *
  1863. * @see get_terms()
  1864. *
  1865. * @param array $args {
  1866. * Method arguments. Note: arguments must be ordered as documented.
  1867. *
  1868. * @type int $blog_id Blog ID (unused).
  1869. * @type string $username Username.
  1870. * @type string $password Password.
  1871. * @type string $taxnomy Taxonomy name.
  1872. * @type array $filter Optional. Modifies the query used to retrieve posts. Accepts 'number',
  1873. * 'offset', 'orderby', 'order', 'hide_empty', and 'search'. Default empty array.
  1874. * }
  1875. * @return array|IXR_Error An associative array of terms data on success, IXR_Error instance otherwise.
  1876. */
  1877. public function wp_getTerms( $args ) {
  1878. if ( ! $this->minimum_args( $args, 4 ) )
  1879. return $this->error;
  1880. $this->escape( $args );
  1881. $username = $args[1];
  1882. $password = $args[2];
  1883. $taxonomy = $args[3];
  1884. $filter = isset( $args[4] ) ? $args[4] : array();
  1885. if ( ! $user = $this->login( $username, $password ) )
  1886. return $this->error;
  1887. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1888. do_action( 'xmlrpc_call', 'wp.getTerms' );
  1889. if ( ! taxonomy_exists( $taxonomy ) )
  1890. return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
  1891. $taxonomy = get_taxonomy( $taxonomy );
  1892. if ( ! current_user_can( $taxonomy->cap->assign_terms ) )
  1893. return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign terms in this taxonomy.' ) );
  1894. $query = array();
  1895. if ( isset( $filter['number'] ) )
  1896. $query['number'] = absint( $filter['number'] );
  1897. if ( isset( $filter['offset'] ) )
  1898. $query['offset'] = absint( $filter['offset'] );
  1899. if ( isset( $filter['orderby'] ) ) {
  1900. $query['orderby'] = $filter['orderby'];
  1901. if ( isset( $filter['order'] ) )
  1902. $query['order'] = $filter['order'];
  1903. }
  1904. if ( isset( $filter['hide_empty'] ) )
  1905. $query['hide_empty'] = $filter['hide_empty'];
  1906. else
  1907. $query['get'] = 'all';
  1908. if ( isset( $filter['search'] ) )
  1909. $query['search'] = $filter['search'];
  1910. $terms = get_terms( $taxonomy->name, $query );
  1911. if ( is_wp_error( $terms ) )
  1912. return new IXR_Error( 500, $terms->get_error_message() );
  1913. $struct = array();
  1914. foreach ( $terms as $term ) {
  1915. $struct[] = $this->_prepare_term( $term );
  1916. }
  1917. return $struct;
  1918. }
  1919. /**
  1920. * Retrieve a taxonomy.
  1921. *
  1922. * @since 3.4.0
  1923. *
  1924. * @see get_taxonomy()
  1925. *
  1926. * @param array $args {
  1927. * Method arguments. Note: arguments must be ordered as documented.
  1928. *
  1929. * @type int $blog_id Blog ID (unused).
  1930. * @type string $username Username.
  1931. * @type string $password Password.
  1932. * @type string $taxnomy Taxonomy name.
  1933. * @type array $fields Optional. Array of taxonomy fields to limit to in the return.
  1934. * Accepts 'labels', 'cap', 'menu', and 'object_type'.
  1935. * Default empty array.
  1936. * }
  1937. * @return array|IXR_Error An array of taxonomy data on success, IXR_Error instance otherwise.
  1938. */
  1939. public function wp_getTaxonomy( $args ) {
  1940. if ( ! $this->minimum_args( $args, 4 ) )
  1941. return $this->error;
  1942. $this->escape( $args );
  1943. $username = $args[1];
  1944. $password = $args[2];
  1945. $taxonomy = $args[3];
  1946. if ( isset( $args[4] ) ) {
  1947. $fields = $args[4];
  1948. } else {
  1949. /**
  1950. * Filters the taxonomy query fields used by the given XML-RPC method.
  1951. *
  1952. * @since 3.4.0
  1953. *
  1954. * @param array $fields An array of taxonomy fields to retrieve.
  1955. * @param string $method The method name.
  1956. */
  1957. $fields = apply_filters( 'xmlrpc_default_taxonomy_fields', array( 'labels', 'cap', 'object_type' ), 'wp.getTaxonomy' );
  1958. }
  1959. if ( ! $user = $this->login( $username, $password ) )
  1960. return $this->error;
  1961. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  1962. do_action( 'xmlrpc_call', 'wp.getTaxonomy' );
  1963. if ( ! taxonomy_exists( $taxonomy ) )
  1964. return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
  1965. $taxonomy = get_taxonomy( $taxonomy );
  1966. if ( ! current_user_can( $taxonomy->cap->assign_terms ) )
  1967. return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign terms in this taxonomy.' ) );
  1968. return $this->_prepare_taxonomy( $taxonomy, $fields );
  1969. }
  1970. /**
  1971. * Retrieve all taxonomies.
  1972. *
  1973. * @since 3.4.0
  1974. *
  1975. * @see get_taxonomies()
  1976. *
  1977. * @param array $args {
  1978. * Method arguments. Note: arguments must be ordered as documented.
  1979. *
  1980. * @type int $blog_id Blog ID (unused).
  1981. * @type string $username Username.
  1982. * @type string $password Password.
  1983. * @type array $filter Optional. An array of arguments for retrieving taxonomies.
  1984. * @type array $fields Optional. The subset of taxonomy fields to return.
  1985. * }
  1986. * @return array|IXR_Error An associative array of taxonomy data with returned fields determined
  1987. * by `$fields`, or an IXR_Error instance on failure.
  1988. */
  1989. public function wp_getTaxonomies( $args ) {
  1990. if ( ! $this->minimum_args( $args, 3 ) )
  1991. return $this->error;
  1992. $this->escape( $args );
  1993. $username = $args[1];
  1994. $password = $args[2];
  1995. $filter = isset( $args[3] ) ? $args[3] : array( 'public' => true );
  1996. if ( isset( $args[4] ) ) {
  1997. $fields = $args[4];
  1998. } else {
  1999. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2000. $fields = apply_filters( 'xmlrpc_default_taxonomy_fields', array( 'labels', 'cap', 'object_type' ), 'wp.getTaxonomies' );
  2001. }
  2002. if ( ! $user = $this->login( $username, $password ) )
  2003. return $this->error;
  2004. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2005. do_action( 'xmlrpc_call', 'wp.getTaxonomies' );
  2006. $taxonomies = get_taxonomies( $filter, 'objects' );
  2007. // holds all the taxonomy data
  2008. $struct = array();
  2009. foreach ( $taxonomies as $taxonomy ) {
  2010. // capability check for post_types
  2011. if ( ! current_user_can( $taxonomy->cap->assign_terms ) )
  2012. continue;
  2013. $struct[] = $this->_prepare_taxonomy( $taxonomy, $fields );
  2014. }
  2015. return $struct;
  2016. }
  2017. /**
  2018. * Retrieve a user.
  2019. *
  2020. * The optional $fields parameter specifies what fields will be included
  2021. * in the response array. This should be a list of field names. 'user_id' will
  2022. * always be included in the response regardless of the value of $fields.
  2023. *
  2024. * Instead of, or in addition to, individual field names, conceptual group
  2025. * names can be used to specify multiple fields. The available conceptual
  2026. * groups are 'basic' and 'all'.
  2027. *
  2028. * @uses get_userdata()
  2029. *
  2030. * @param array $args {
  2031. * Method arguments. Note: arguments must be ordered as documented.
  2032. *
  2033. * @type int $blog_id (unused)
  2034. * @type string $username
  2035. * @type string $password
  2036. * @type int $user_id
  2037. * @type array $fields (optional)
  2038. * }
  2039. * @return array|IXR_Error Array contains (based on $fields parameter):
  2040. * - 'user_id'
  2041. * - 'username'
  2042. * - 'first_name'
  2043. * - 'last_name'
  2044. * - 'registered'
  2045. * - 'bio'
  2046. * - 'email'
  2047. * - 'nickname'
  2048. * - 'nicename'
  2049. * - 'url'
  2050. * - 'display_name'
  2051. * - 'roles'
  2052. */
  2053. public function wp_getUser( $args ) {
  2054. if ( ! $this->minimum_args( $args, 4 ) )
  2055. return $this->error;
  2056. $this->escape( $args );
  2057. $username = $args[1];
  2058. $password = $args[2];
  2059. $user_id = (int) $args[3];
  2060. if ( isset( $args[4] ) ) {
  2061. $fields = $args[4];
  2062. } else {
  2063. /**
  2064. * Filters the default user query fields used by the given XML-RPC method.
  2065. *
  2066. * @since 3.5.0
  2067. *
  2068. * @param array $fields User query fields for given method. Default 'all'.
  2069. * @param string $method The method name.
  2070. */
  2071. $fields = apply_filters( 'xmlrpc_default_user_fields', array( 'all' ), 'wp.getUser' );
  2072. }
  2073. if ( ! $user = $this->login( $username, $password ) )
  2074. return $this->error;
  2075. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2076. do_action( 'xmlrpc_call', 'wp.getUser' );
  2077. if ( ! current_user_can( 'edit_user', $user_id ) )
  2078. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this user.' ) );
  2079. $user_data = get_userdata( $user_id );
  2080. if ( ! $user_data )
  2081. return new IXR_Error( 404, __( 'Invalid user ID.' ) );
  2082. return $this->_prepare_user( $user_data, $fields );
  2083. }
  2084. /**
  2085. * Retrieve users.
  2086. *
  2087. * The optional $filter parameter modifies the query used to retrieve users.
  2088. * Accepted keys are 'number' (default: 50), 'offset' (default: 0), 'role',
  2089. * 'who', 'orderby', and 'order'.
  2090. *
  2091. * The optional $fields parameter specifies what fields will be included
  2092. * in the response array.
  2093. *
  2094. * @uses get_users()
  2095. * @see wp_getUser() for more on $fields and return values
  2096. *
  2097. * @param array $args {
  2098. * Method arguments. Note: arguments must be ordered as documented.
  2099. *
  2100. * @type int $blog_id (unused)
  2101. * @type string $username
  2102. * @type string $password
  2103. * @type array $filter (optional)
  2104. * @type array $fields (optional)
  2105. * }
  2106. * @return array|IXR_Error users data
  2107. */
  2108. public function wp_getUsers( $args ) {
  2109. if ( ! $this->minimum_args( $args, 3 ) )
  2110. return $this->error;
  2111. $this->escape( $args );
  2112. $username = $args[1];
  2113. $password = $args[2];
  2114. $filter = isset( $args[3] ) ? $args[3] : array();
  2115. if ( isset( $args[4] ) ) {
  2116. $fields = $args[4];
  2117. } else {
  2118. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2119. $fields = apply_filters( 'xmlrpc_default_user_fields', array( 'all' ), 'wp.getUsers' );
  2120. }
  2121. if ( ! $user = $this->login( $username, $password ) )
  2122. return $this->error;
  2123. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2124. do_action( 'xmlrpc_call', 'wp.getUsers' );
  2125. if ( ! current_user_can( 'list_users' ) )
  2126. return new IXR_Error( 401, __( 'Sorry, you are not allowed to list users.' ) );
  2127. $query = array( 'fields' => 'all_with_meta' );
  2128. $query['number'] = ( isset( $filter['number'] ) ) ? absint( $filter['number'] ) : 50;
  2129. $query['offset'] = ( isset( $filter['offset'] ) ) ? absint( $filter['offset'] ) : 0;
  2130. if ( isset( $filter['orderby'] ) ) {
  2131. $query['orderby'] = $filter['orderby'];
  2132. if ( isset( $filter['order'] ) )
  2133. $query['order'] = $filter['order'];
  2134. }
  2135. if ( isset( $filter['role'] ) ) {
  2136. if ( get_role( $filter['role'] ) === null )
  2137. return new IXR_Error( 403, __( 'Invalid role.' ) );
  2138. $query['role'] = $filter['role'];
  2139. }
  2140. if ( isset( $filter['who'] ) ) {
  2141. $query['who'] = $filter['who'];
  2142. }
  2143. $users = get_users( $query );
  2144. $_users = array();
  2145. foreach ( $users as $user_data ) {
  2146. if ( current_user_can( 'edit_user', $user_data->ID ) )
  2147. $_users[] = $this->_prepare_user( $user_data, $fields );
  2148. }
  2149. return $_users;
  2150. }
  2151. /**
  2152. * Retrieve information about the requesting user.
  2153. *
  2154. * @uses get_userdata()
  2155. *
  2156. * @param array $args {
  2157. * Method arguments. Note: arguments must be ordered as documented.
  2158. *
  2159. * @type int $blog_id (unused)
  2160. * @type string $username
  2161. * @type string $password
  2162. * @type array $fields (optional)
  2163. * }
  2164. * @return array|IXR_Error (@see wp_getUser)
  2165. */
  2166. public function wp_getProfile( $args ) {
  2167. if ( ! $this->minimum_args( $args, 3 ) )
  2168. return $this->error;
  2169. $this->escape( $args );
  2170. $username = $args[1];
  2171. $password = $args[2];
  2172. if ( isset( $args[3] ) ) {
  2173. $fields = $args[3];
  2174. } else {
  2175. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2176. $fields = apply_filters( 'xmlrpc_default_user_fields', array( 'all' ), 'wp.getProfile' );
  2177. }
  2178. if ( ! $user = $this->login( $username, $password ) )
  2179. return $this->error;
  2180. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2181. do_action( 'xmlrpc_call', 'wp.getProfile' );
  2182. if ( ! current_user_can( 'edit_user', $user->ID ) )
  2183. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit your profile.' ) );
  2184. $user_data = get_userdata( $user->ID );
  2185. return $this->_prepare_user( $user_data, $fields );
  2186. }
  2187. /**
  2188. * Edit user's profile.
  2189. *
  2190. * @uses wp_update_user()
  2191. *
  2192. * @param array $args {
  2193. * Method arguments. Note: arguments must be ordered as documented.
  2194. *
  2195. * @type int $blog_id (unused)
  2196. * @type string $username
  2197. * @type string $password
  2198. * @type array $content_struct It can optionally contain:
  2199. * - 'first_name'
  2200. * - 'last_name'
  2201. * - 'website'
  2202. * - 'display_name'
  2203. * - 'nickname'
  2204. * - 'nicename'
  2205. * - 'bio'
  2206. * }
  2207. * @return true|IXR_Error True, on success.
  2208. */
  2209. public function wp_editProfile( $args ) {
  2210. if ( ! $this->minimum_args( $args, 4 ) )
  2211. return $this->error;
  2212. $this->escape( $args );
  2213. $username = $args[1];
  2214. $password = $args[2];
  2215. $content_struct = $args[3];
  2216. if ( ! $user = $this->login( $username, $password ) )
  2217. return $this->error;
  2218. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2219. do_action( 'xmlrpc_call', 'wp.editProfile' );
  2220. if ( ! current_user_can( 'edit_user', $user->ID ) )
  2221. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit your profile.' ) );
  2222. // holds data of the user
  2223. $user_data = array();
  2224. $user_data['ID'] = $user->ID;
  2225. // only set the user details if it was given
  2226. if ( isset( $content_struct['first_name'] ) )
  2227. $user_data['first_name'] = $content_struct['first_name'];
  2228. if ( isset( $content_struct['last_name'] ) )
  2229. $user_data['last_name'] = $content_struct['last_name'];
  2230. if ( isset( $content_struct['url'] ) )
  2231. $user_data['user_url'] = $content_struct['url'];
  2232. if ( isset( $content_struct['display_name'] ) )
  2233. $user_data['display_name'] = $content_struct['display_name'];
  2234. if ( isset( $content_struct['nickname'] ) )
  2235. $user_data['nickname'] = $content_struct['nickname'];
  2236. if ( isset( $content_struct['nicename'] ) )
  2237. $user_data['user_nicename'] = $content_struct['nicename'];
  2238. if ( isset( $content_struct['bio'] ) )
  2239. $user_data['description'] = $content_struct['bio'];
  2240. $result = wp_update_user( $user_data );
  2241. if ( is_wp_error( $result ) )
  2242. return new IXR_Error( 500, $result->get_error_message() );
  2243. if ( ! $result )
  2244. return new IXR_Error( 500, __( 'Sorry, the user cannot be updated.' ) );
  2245. return true;
  2246. }
  2247. /**
  2248. * Retrieve page.
  2249. *
  2250. * @since 2.2.0
  2251. *
  2252. * @param array $args {
  2253. * Method arguments. Note: arguments must be ordered as documented.
  2254. *
  2255. * @type int $blog_id (unused)
  2256. * @type int $page_id
  2257. * @type string $username
  2258. * @type string $password
  2259. * }
  2260. * @return array|IXR_Error
  2261. */
  2262. public function wp_getPage( $args ) {
  2263. $this->escape( $args );
  2264. $page_id = (int) $args[1];
  2265. $username = $args[2];
  2266. $password = $args[3];
  2267. if ( !$user = $this->login($username, $password) ) {
  2268. return $this->error;
  2269. }
  2270. $page = get_post($page_id);
  2271. if ( ! $page )
  2272. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  2273. if ( !current_user_can( 'edit_page', $page_id ) )
  2274. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this page.' ) );
  2275. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2276. do_action( 'xmlrpc_call', 'wp.getPage' );
  2277. // If we found the page then format the data.
  2278. if ( $page->ID && ($page->post_type == 'page') ) {
  2279. return $this->_prepare_page( $page );
  2280. }
  2281. // If the page doesn't exist indicate that.
  2282. else {
  2283. return new IXR_Error( 404, __( 'Sorry, no such page.' ) );
  2284. }
  2285. }
  2286. /**
  2287. * Retrieve Pages.
  2288. *
  2289. * @since 2.2.0
  2290. *
  2291. * @param array $args {
  2292. * Method arguments. Note: arguments must be ordered as documented.
  2293. *
  2294. * @type int $blog_id (unused)
  2295. * @type string $username
  2296. * @type string $password
  2297. * @type int $num_pages
  2298. * }
  2299. * @return array|IXR_Error
  2300. */
  2301. public function wp_getPages( $args ) {
  2302. $this->escape( $args );
  2303. $username = $args[1];
  2304. $password = $args[2];
  2305. $num_pages = isset($args[3]) ? (int) $args[3] : 10;
  2306. if ( !$user = $this->login($username, $password) )
  2307. return $this->error;
  2308. if ( !current_user_can( 'edit_pages' ) )
  2309. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit pages.' ) );
  2310. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2311. do_action( 'xmlrpc_call', 'wp.getPages' );
  2312. $pages = get_posts( array('post_type' => 'page', 'post_status' => 'any', 'numberposts' => $num_pages) );
  2313. $num_pages = count($pages);
  2314. // If we have pages, put together their info.
  2315. if ( $num_pages >= 1 ) {
  2316. $pages_struct = array();
  2317. foreach ($pages as $page) {
  2318. if ( current_user_can( 'edit_page', $page->ID ) )
  2319. $pages_struct[] = $this->_prepare_page( $page );
  2320. }
  2321. return $pages_struct;
  2322. }
  2323. return array();
  2324. }
  2325. /**
  2326. * Create new page.
  2327. *
  2328. * @since 2.2.0
  2329. *
  2330. * @see wp_xmlrpc_server::mw_newPost()
  2331. *
  2332. * @param array $args {
  2333. * Method arguments. Note: arguments must be ordered as documented.
  2334. *
  2335. * @type int $blog_id (unused)
  2336. * @type string $username
  2337. * @type string $password
  2338. * @type array $content_struct
  2339. * }
  2340. * @return int|IXR_Error
  2341. */
  2342. public function wp_newPage( $args ) {
  2343. // Items not escaped here will be escaped in newPost.
  2344. $username = $this->escape( $args[1] );
  2345. $password = $this->escape( $args[2] );
  2346. if ( !$user = $this->login($username, $password) )
  2347. return $this->error;
  2348. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2349. do_action( 'xmlrpc_call', 'wp.newPage' );
  2350. // Mark this as content for a page.
  2351. $args[3]["post_type"] = 'page';
  2352. // Let mw_newPost do all of the heavy lifting.
  2353. return $this->mw_newPost( $args );
  2354. }
  2355. /**
  2356. * Delete page.
  2357. *
  2358. * @since 2.2.0
  2359. *
  2360. * @param array $args {
  2361. * Method arguments. Note: arguments must be ordered as documented.
  2362. *
  2363. * @type int $blog_id (unused)
  2364. * @type string $username
  2365. * @type string $password
  2366. * @type int $page_id
  2367. * }
  2368. * @return true|IXR_Error True, if success.
  2369. */
  2370. public function wp_deletePage( $args ) {
  2371. $this->escape( $args );
  2372. $username = $args[1];
  2373. $password = $args[2];
  2374. $page_id = (int) $args[3];
  2375. if ( !$user = $this->login($username, $password) )
  2376. return $this->error;
  2377. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2378. do_action( 'xmlrpc_call', 'wp.deletePage' );
  2379. // Get the current page based on the page_id and
  2380. // make sure it is a page and not a post.
  2381. $actual_page = get_post($page_id, ARRAY_A);
  2382. if ( !$actual_page || ($actual_page['post_type'] != 'page') )
  2383. return new IXR_Error( 404, __( 'Sorry, no such page.' ) );
  2384. // Make sure the user can delete pages.
  2385. if ( !current_user_can('delete_page', $page_id) )
  2386. return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this page.' ) );
  2387. // Attempt to delete the page.
  2388. $result = wp_delete_post($page_id);
  2389. if ( !$result )
  2390. return new IXR_Error( 500, __( 'Failed to delete the page.' ) );
  2391. /**
  2392. * Fires after a page has been successfully deleted via XML-RPC.
  2393. *
  2394. * @since 3.4.0
  2395. *
  2396. * @param int $page_id ID of the deleted page.
  2397. * @param array $args An array of arguments to delete the page.
  2398. */
  2399. do_action( 'xmlrpc_call_success_wp_deletePage', $page_id, $args );
  2400. return true;
  2401. }
  2402. /**
  2403. * Edit page.
  2404. *
  2405. * @since 2.2.0
  2406. *
  2407. * @param array $args {
  2408. * Method arguments. Note: arguments must be ordered as documented.
  2409. *
  2410. * @type int $blog_id (unused)
  2411. * @type int $page_id
  2412. * @type string $username
  2413. * @type string $password
  2414. * @type string $content
  2415. * @type string $publish
  2416. * }
  2417. * @return array|IXR_Error
  2418. */
  2419. public function wp_editPage( $args ) {
  2420. // Items will be escaped in mw_editPost.
  2421. $page_id = (int) $args[1];
  2422. $username = $args[2];
  2423. $password = $args[3];
  2424. $content = $args[4];
  2425. $publish = $args[5];
  2426. $escaped_username = $this->escape( $username );
  2427. $escaped_password = $this->escape( $password );
  2428. if ( !$user = $this->login( $escaped_username, $escaped_password ) ) {
  2429. return $this->error;
  2430. }
  2431. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2432. do_action( 'xmlrpc_call', 'wp.editPage' );
  2433. // Get the page data and make sure it is a page.
  2434. $actual_page = get_post($page_id, ARRAY_A);
  2435. if ( !$actual_page || ($actual_page['post_type'] != 'page') )
  2436. return new IXR_Error( 404, __( 'Sorry, no such page.' ) );
  2437. // Make sure the user is allowed to edit pages.
  2438. if ( !current_user_can('edit_page', $page_id) )
  2439. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this page.' ) );
  2440. // Mark this as content for a page.
  2441. $content['post_type'] = 'page';
  2442. // Arrange args in the way mw_editPost understands.
  2443. $args = array(
  2444. $page_id,
  2445. $username,
  2446. $password,
  2447. $content,
  2448. $publish
  2449. );
  2450. // Let mw_editPost do all of the heavy lifting.
  2451. return $this->mw_editPost( $args );
  2452. }
  2453. /**
  2454. * Retrieve page list.
  2455. *
  2456. * @since 2.2.0
  2457. *
  2458. * @global wpdb $wpdb WordPress database abstraction object.
  2459. *
  2460. * @param array $args {
  2461. * Method arguments. Note: arguments must be ordered as documented.
  2462. *
  2463. * @type int $blog_id (unused)
  2464. * @type string $username
  2465. * @type string $password
  2466. * }
  2467. * @return array|IXR_Error
  2468. */
  2469. public function wp_getPageList( $args ) {
  2470. global $wpdb;
  2471. $this->escape( $args );
  2472. $username = $args[1];
  2473. $password = $args[2];
  2474. if ( !$user = $this->login($username, $password) )
  2475. return $this->error;
  2476. if ( !current_user_can( 'edit_pages' ) )
  2477. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit pages.' ) );
  2478. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2479. do_action( 'xmlrpc_call', 'wp.getPageList' );
  2480. // Get list of pages ids and titles
  2481. $page_list = $wpdb->get_results("
  2482. SELECT ID page_id,
  2483. post_title page_title,
  2484. post_parent page_parent_id,
  2485. post_date_gmt,
  2486. post_date,
  2487. post_status
  2488. FROM {$wpdb->posts}
  2489. WHERE post_type = 'page'
  2490. ORDER BY ID
  2491. ");
  2492. // The date needs to be formatted properly.
  2493. $num_pages = count($page_list);
  2494. for ( $i = 0; $i < $num_pages; $i++ ) {
  2495. $page_list[$i]->dateCreated = $this->_convert_date( $page_list[$i]->post_date );
  2496. $page_list[$i]->date_created_gmt = $this->_convert_date_gmt( $page_list[$i]->post_date_gmt, $page_list[$i]->post_date );
  2497. unset($page_list[$i]->post_date_gmt);
  2498. unset($page_list[$i]->post_date);
  2499. unset($page_list[$i]->post_status);
  2500. }
  2501. return $page_list;
  2502. }
  2503. /**
  2504. * Retrieve authors list.
  2505. *
  2506. * @since 2.2.0
  2507. *
  2508. * @param array $args {
  2509. * Method arguments. Note: arguments must be ordered as documented.
  2510. *
  2511. * @type int $blog_id (unused)
  2512. * @type string $username
  2513. * @type string $password
  2514. * }
  2515. * @return array|IXR_Error
  2516. */
  2517. public function wp_getAuthors( $args ) {
  2518. $this->escape( $args );
  2519. $username = $args[1];
  2520. $password = $args[2];
  2521. if ( !$user = $this->login($username, $password) )
  2522. return $this->error;
  2523. if ( !current_user_can('edit_posts') )
  2524. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts.' ) );
  2525. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2526. do_action( 'xmlrpc_call', 'wp.getAuthors' );
  2527. $authors = array();
  2528. foreach ( get_users( array( 'fields' => array('ID','user_login','display_name') ) ) as $user ) {
  2529. $authors[] = array(
  2530. 'user_id' => $user->ID,
  2531. 'user_login' => $user->user_login,
  2532. 'display_name' => $user->display_name
  2533. );
  2534. }
  2535. return $authors;
  2536. }
  2537. /**
  2538. * Get list of all tags
  2539. *
  2540. * @since 2.7.0
  2541. *
  2542. * @param array $args {
  2543. * Method arguments. Note: arguments must be ordered as documented.
  2544. *
  2545. * @type int $blog_id (unused)
  2546. * @type string $username
  2547. * @type string $password
  2548. * }
  2549. * @return array|IXR_Error
  2550. */
  2551. public function wp_getTags( $args ) {
  2552. $this->escape( $args );
  2553. $username = $args[1];
  2554. $password = $args[2];
  2555. if ( !$user = $this->login($username, $password) )
  2556. return $this->error;
  2557. if ( !current_user_can( 'edit_posts' ) )
  2558. return new IXR_Error( 401, __( 'Sorry, you must be able to edit posts on this site in order to view tags.' ) );
  2559. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2560. do_action( 'xmlrpc_call', 'wp.getKeywords' );
  2561. $tags = array();
  2562. if ( $all_tags = get_tags() ) {
  2563. foreach ( (array) $all_tags as $tag ) {
  2564. $struct = array();
  2565. $struct['tag_id'] = $tag->term_id;
  2566. $struct['name'] = $tag->name;
  2567. $struct['count'] = $tag->count;
  2568. $struct['slug'] = $tag->slug;
  2569. $struct['html_url'] = esc_html( get_tag_link( $tag->term_id ) );
  2570. $struct['rss_url'] = esc_html( get_tag_feed_link( $tag->term_id ) );
  2571. $tags[] = $struct;
  2572. }
  2573. }
  2574. return $tags;
  2575. }
  2576. /**
  2577. * Create new category.
  2578. *
  2579. * @since 2.2.0
  2580. *
  2581. * @param array $args {
  2582. * Method arguments. Note: arguments must be ordered as documented.
  2583. *
  2584. * @type int $blog_id (unused)
  2585. * @type string $username
  2586. * @type string $password
  2587. * @type array $category
  2588. * }
  2589. * @return int|IXR_Error Category ID.
  2590. */
  2591. public function wp_newCategory( $args ) {
  2592. $this->escape( $args );
  2593. $username = $args[1];
  2594. $password = $args[2];
  2595. $category = $args[3];
  2596. if ( !$user = $this->login($username, $password) )
  2597. return $this->error;
  2598. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2599. do_action( 'xmlrpc_call', 'wp.newCategory' );
  2600. // Make sure the user is allowed to add a category.
  2601. if ( !current_user_can('manage_categories') )
  2602. return new IXR_Error(401, __('Sorry, you are not allowed to add a category.'));
  2603. // If no slug was provided make it empty so that
  2604. // WordPress will generate one.
  2605. if ( empty($category['slug']) )
  2606. $category['slug'] = '';
  2607. // If no parent_id was provided make it empty
  2608. // so that it will be a top level page (no parent).
  2609. if ( !isset($category['parent_id']) )
  2610. $category['parent_id'] = '';
  2611. // If no description was provided make it empty.
  2612. if ( empty($category["description"]) )
  2613. $category["description"] = "";
  2614. $new_category = array(
  2615. 'cat_name' => $category['name'],
  2616. 'category_nicename' => $category['slug'],
  2617. 'category_parent' => $category['parent_id'],
  2618. 'category_description' => $category['description']
  2619. );
  2620. $cat_id = wp_insert_category($new_category, true);
  2621. if ( is_wp_error( $cat_id ) ) {
  2622. if ( 'term_exists' == $cat_id->get_error_code() )
  2623. return (int) $cat_id->get_error_data();
  2624. else
  2625. return new IXR_Error(500, __('Sorry, the new category failed.'));
  2626. } elseif ( ! $cat_id ) {
  2627. return new IXR_Error(500, __('Sorry, the new category failed.'));
  2628. }
  2629. /**
  2630. * Fires after a new category has been successfully created via XML-RPC.
  2631. *
  2632. * @since 3.4.0
  2633. *
  2634. * @param int $cat_id ID of the new category.
  2635. * @param array $args An array of new category arguments.
  2636. */
  2637. do_action( 'xmlrpc_call_success_wp_newCategory', $cat_id, $args );
  2638. return $cat_id;
  2639. }
  2640. /**
  2641. * Remove category.
  2642. *
  2643. * @since 2.5.0
  2644. *
  2645. * @param array $args {
  2646. * Method arguments. Note: arguments must be ordered as documented.
  2647. *
  2648. * @type int $blog_id (unused)
  2649. * @type string $username
  2650. * @type string $password
  2651. * @type int $category_id
  2652. * }
  2653. * @return bool|IXR_Error See wp_delete_term() for return info.
  2654. */
  2655. public function wp_deleteCategory( $args ) {
  2656. $this->escape( $args );
  2657. $username = $args[1];
  2658. $password = $args[2];
  2659. $category_id = (int) $args[3];
  2660. if ( !$user = $this->login($username, $password) )
  2661. return $this->error;
  2662. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2663. do_action( 'xmlrpc_call', 'wp.deleteCategory' );
  2664. if ( !current_user_can('manage_categories') )
  2665. return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete a category.' ) );
  2666. $status = wp_delete_term( $category_id, 'category' );
  2667. if ( true == $status ) {
  2668. /**
  2669. * Fires after a category has been successfully deleted via XML-RPC.
  2670. *
  2671. * @since 3.4.0
  2672. *
  2673. * @param int $category_id ID of the deleted category.
  2674. * @param array $args An array of arguments to delete the category.
  2675. */
  2676. do_action( 'xmlrpc_call_success_wp_deleteCategory', $category_id, $args );
  2677. }
  2678. return $status;
  2679. }
  2680. /**
  2681. * Retrieve category list.
  2682. *
  2683. * @since 2.2.0
  2684. *
  2685. * @param array $args {
  2686. * Method arguments. Note: arguments must be ordered as documented.
  2687. *
  2688. * @type int $blog_id (unused)
  2689. * @type string $username
  2690. * @type string $password
  2691. * @type array $category
  2692. * @type int $max_results
  2693. * }
  2694. * @return array|IXR_Error
  2695. */
  2696. public function wp_suggestCategories( $args ) {
  2697. $this->escape( $args );
  2698. $username = $args[1];
  2699. $password = $args[2];
  2700. $category = $args[3];
  2701. $max_results = (int) $args[4];
  2702. if ( !$user = $this->login($username, $password) )
  2703. return $this->error;
  2704. if ( !current_user_can( 'edit_posts' ) )
  2705. return new IXR_Error( 401, __( 'Sorry, you must be able to edit posts on this site in order to view categories.' ) );
  2706. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2707. do_action( 'xmlrpc_call', 'wp.suggestCategories' );
  2708. $category_suggestions = array();
  2709. $args = array('get' => 'all', 'number' => $max_results, 'name__like' => $category);
  2710. foreach ( (array) get_categories($args) as $cat ) {
  2711. $category_suggestions[] = array(
  2712. 'category_id' => $cat->term_id,
  2713. 'category_name' => $cat->name
  2714. );
  2715. }
  2716. return $category_suggestions;
  2717. }
  2718. /**
  2719. * Retrieve comment.
  2720. *
  2721. * @since 2.7.0
  2722. *
  2723. * @param array $args {
  2724. * Method arguments. Note: arguments must be ordered as documented.
  2725. *
  2726. * @type int $blog_id (unused)
  2727. * @type string $username
  2728. * @type string $password
  2729. * @type int $comment_id
  2730. * }
  2731. * @return array|IXR_Error
  2732. */
  2733. public function wp_getComment($args) {
  2734. $this->escape($args);
  2735. $username = $args[1];
  2736. $password = $args[2];
  2737. $comment_id = (int) $args[3];
  2738. if ( ! $user = $this->login( $username, $password ) ) {
  2739. return $this->error;
  2740. }
  2741. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2742. do_action( 'xmlrpc_call', 'wp.getComment' );
  2743. if ( ! $comment = get_comment( $comment_id ) ) {
  2744. return new IXR_Error( 404, __( 'Invalid comment ID.' ) );
  2745. }
  2746. if ( ! current_user_can( 'edit_comment', $comment_id ) ) {
  2747. return new IXR_Error( 403, __( 'Sorry, you are not allowed to moderate or edit this comment.' ) );
  2748. }
  2749. return $this->_prepare_comment( $comment );
  2750. }
  2751. /**
  2752. * Retrieve comments.
  2753. *
  2754. * Besides the common blog_id (unused), username, and password arguments, it takes a filter
  2755. * array as last argument.
  2756. *
  2757. * Accepted 'filter' keys are 'status', 'post_id', 'offset', and 'number'.
  2758. *
  2759. * The defaults are as follows:
  2760. * - 'status' - Default is ''. Filter by status (e.g., 'approve', 'hold')
  2761. * - 'post_id' - Default is ''. The post where the comment is posted. Empty string shows all comments.
  2762. * - 'number' - Default is 10. Total number of media items to retrieve.
  2763. * - 'offset' - Default is 0. See WP_Query::query() for more.
  2764. *
  2765. * @since 2.7.0
  2766. *
  2767. * @param array $args {
  2768. * Method arguments. Note: arguments must be ordered as documented.
  2769. *
  2770. * @type int $blog_id (unused)
  2771. * @type string $username
  2772. * @type string $password
  2773. * @type array $struct
  2774. * }
  2775. * @return array|IXR_Error Contains a collection of comments. See wp_xmlrpc_server::wp_getComment() for a description of each item contents
  2776. */
  2777. public function wp_getComments( $args ) {
  2778. $this->escape( $args );
  2779. $username = $args[1];
  2780. $password = $args[2];
  2781. $struct = isset( $args[3] ) ? $args[3] : array();
  2782. if ( ! $user = $this->login( $username, $password ) ) {
  2783. return $this->error;
  2784. }
  2785. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2786. do_action( 'xmlrpc_call', 'wp.getComments' );
  2787. if ( isset( $struct['status'] ) ) {
  2788. $status = $struct['status'];
  2789. } else {
  2790. $status = '';
  2791. }
  2792. if ( ! current_user_can( 'moderate_comments' ) && 'approve' !== $status ) {
  2793. return new IXR_Error( 401, __( 'Invalid comment status.' ) );
  2794. }
  2795. $post_id = '';
  2796. if ( isset( $struct['post_id'] ) ) {
  2797. $post_id = absint( $struct['post_id'] );
  2798. }
  2799. $post_type = '';
  2800. if ( isset( $struct['post_type'] ) ) {
  2801. $post_type_object = get_post_type_object( $struct['post_type'] );
  2802. if ( ! $post_type_object || ! post_type_supports( $post_type_object->name, 'comments' ) ) {
  2803. return new IXR_Error( 404, __( 'Invalid post type.' ) );
  2804. }
  2805. $post_type = $struct['post_type'];
  2806. }
  2807. $offset = 0;
  2808. if ( isset( $struct['offset'] ) ) {
  2809. $offset = absint( $struct['offset'] );
  2810. }
  2811. $number = 10;
  2812. if ( isset( $struct['number'] ) ) {
  2813. $number = absint( $struct['number'] );
  2814. }
  2815. $comments = get_comments( array(
  2816. 'status' => $status,
  2817. 'post_id' => $post_id,
  2818. 'offset' => $offset,
  2819. 'number' => $number,
  2820. 'post_type' => $post_type,
  2821. ) );
  2822. $comments_struct = array();
  2823. if ( is_array( $comments ) ) {
  2824. foreach ( $comments as $comment ) {
  2825. $comments_struct[] = $this->_prepare_comment( $comment );
  2826. }
  2827. }
  2828. return $comments_struct;
  2829. }
  2830. /**
  2831. * Delete a comment.
  2832. *
  2833. * By default, the comment will be moved to the trash instead of deleted.
  2834. * See wp_delete_comment() for more information on this behavior.
  2835. *
  2836. * @since 2.7.0
  2837. *
  2838. * @param array $args {
  2839. * Method arguments. Note: arguments must be ordered as documented.
  2840. *
  2841. * @type int $blog_id (unused)
  2842. * @type string $username
  2843. * @type string $password
  2844. * @type int $comment_ID
  2845. * }
  2846. * @return bool|IXR_Error See wp_delete_comment().
  2847. */
  2848. public function wp_deleteComment( $args ) {
  2849. $this->escape($args);
  2850. $username = $args[1];
  2851. $password = $args[2];
  2852. $comment_ID = (int) $args[3];
  2853. if ( ! $user = $this->login( $username, $password ) ) {
  2854. return $this->error;
  2855. }
  2856. if ( ! get_comment( $comment_ID ) ) {
  2857. return new IXR_Error( 404, __( 'Invalid comment ID.' ) );
  2858. }
  2859. if ( !current_user_can( 'edit_comment', $comment_ID ) ) {
  2860. return new IXR_Error( 403, __( 'Sorry, you are not allowed to moderate or edit this comment.' ) );
  2861. }
  2862. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2863. do_action( 'xmlrpc_call', 'wp.deleteComment' );
  2864. $status = wp_delete_comment( $comment_ID );
  2865. if ( $status ) {
  2866. /**
  2867. * Fires after a comment has been successfully deleted via XML-RPC.
  2868. *
  2869. * @since 3.4.0
  2870. *
  2871. * @param int $comment_ID ID of the deleted comment.
  2872. * @param array $args An array of arguments to delete the comment.
  2873. */
  2874. do_action( 'xmlrpc_call_success_wp_deleteComment', $comment_ID, $args );
  2875. }
  2876. return $status;
  2877. }
  2878. /**
  2879. * Edit comment.
  2880. *
  2881. * Besides the common blog_id (unused), username, and password arguments, it takes a
  2882. * comment_id integer and a content_struct array as last argument.
  2883. *
  2884. * The allowed keys in the content_struct array are:
  2885. * - 'author'
  2886. * - 'author_url'
  2887. * - 'author_email'
  2888. * - 'content'
  2889. * - 'date_created_gmt'
  2890. * - 'status'. Common statuses are 'approve', 'hold', 'spam'. See get_comment_statuses() for more details
  2891. *
  2892. * @since 2.7.0
  2893. *
  2894. * @param array $args {
  2895. * Method arguments. Note: arguments must be ordered as documented.
  2896. *
  2897. * @type int $blog_id (unused)
  2898. * @type string $username
  2899. * @type string $password
  2900. * @type int $comment_ID
  2901. * @type array $content_struct
  2902. * }
  2903. * @return true|IXR_Error True, on success.
  2904. */
  2905. public function wp_editComment( $args ) {
  2906. $this->escape( $args );
  2907. $username = $args[1];
  2908. $password = $args[2];
  2909. $comment_ID = (int) $args[3];
  2910. $content_struct = $args[4];
  2911. if ( !$user = $this->login( $username, $password ) ) {
  2912. return $this->error;
  2913. }
  2914. if ( ! get_comment( $comment_ID ) ) {
  2915. return new IXR_Error( 404, __( 'Invalid comment ID.' ) );
  2916. }
  2917. if ( ! current_user_can( 'edit_comment', $comment_ID ) ) {
  2918. return new IXR_Error( 403, __( 'Sorry, you are not allowed to moderate or edit this comment.' ) );
  2919. }
  2920. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  2921. do_action( 'xmlrpc_call', 'wp.editComment' );
  2922. if ( isset($content_struct['status']) ) {
  2923. $statuses = get_comment_statuses();
  2924. $statuses = array_keys($statuses);
  2925. if ( ! in_array($content_struct['status'], $statuses) )
  2926. return new IXR_Error( 401, __( 'Invalid comment status.' ) );
  2927. $comment_approved = $content_struct['status'];
  2928. }
  2929. // Do some timestamp voodoo
  2930. if ( !empty( $content_struct['date_created_gmt'] ) ) {
  2931. // We know this is supposed to be GMT, so we're going to slap that Z on there by force
  2932. $dateCreated = rtrim( $content_struct['date_created_gmt']->getIso(), 'Z' ) . 'Z';
  2933. $comment_date = get_date_from_gmt(iso8601_to_datetime($dateCreated));
  2934. $comment_date_gmt = iso8601_to_datetime($dateCreated, 'GMT');
  2935. }
  2936. if ( isset($content_struct['content']) )
  2937. $comment_content = $content_struct['content'];
  2938. if ( isset($content_struct['author']) )
  2939. $comment_author = $content_struct['author'];
  2940. if ( isset($content_struct['author_url']) )
  2941. $comment_author_url = $content_struct['author_url'];
  2942. if ( isset($content_struct['author_email']) )
  2943. $comment_author_email = $content_struct['author_email'];
  2944. // We've got all the data -- post it:
  2945. $comment = compact('comment_ID', 'comment_content', 'comment_approved', 'comment_date', 'comment_date_gmt', 'comment_author', 'comment_author_email', 'comment_author_url');
  2946. $result = wp_update_comment($comment);
  2947. if ( is_wp_error( $result ) )
  2948. return new IXR_Error(500, $result->get_error_message());
  2949. if ( !$result )
  2950. return new IXR_Error(500, __('Sorry, the comment could not be edited.'));
  2951. /**
  2952. * Fires after a comment has been successfully updated via XML-RPC.
  2953. *
  2954. * @since 3.4.0
  2955. *
  2956. * @param int $comment_ID ID of the updated comment.
  2957. * @param array $args An array of arguments to update the comment.
  2958. */
  2959. do_action( 'xmlrpc_call_success_wp_editComment', $comment_ID, $args );
  2960. return true;
  2961. }
  2962. /**
  2963. * Create new comment.
  2964. *
  2965. * @since 2.7.0
  2966. *
  2967. * @param array $args {
  2968. * Method arguments. Note: arguments must be ordered as documented.
  2969. *
  2970. * @type int $blog_id (unused)
  2971. * @type string $username
  2972. * @type string $password
  2973. * @type string|int $post
  2974. * @type array $content_struct
  2975. * }
  2976. * @return int|IXR_Error See wp_new_comment().
  2977. */
  2978. public function wp_newComment($args) {
  2979. $this->escape($args);
  2980. $username = $args[1];
  2981. $password = $args[2];
  2982. $post = $args[3];
  2983. $content_struct = $args[4];
  2984. /**
  2985. * Filters whether to allow anonymous comments over XML-RPC.
  2986. *
  2987. * @since 2.7.0
  2988. *
  2989. * @param bool $allow Whether to allow anonymous commenting via XML-RPC.
  2990. * Default false.
  2991. */
  2992. $allow_anon = apply_filters( 'xmlrpc_allow_anonymous_comments', false );
  2993. $user = $this->login($username, $password);
  2994. if ( !$user ) {
  2995. $logged_in = false;
  2996. if ( $allow_anon && get_option('comment_registration') ) {
  2997. return new IXR_Error( 403, __( 'You must be registered to comment.' ) );
  2998. } elseif ( ! $allow_anon ) {
  2999. return $this->error;
  3000. }
  3001. } else {
  3002. $logged_in = true;
  3003. }
  3004. if ( is_numeric($post) )
  3005. $post_id = absint($post);
  3006. else
  3007. $post_id = url_to_postid($post);
  3008. if ( ! $post_id ) {
  3009. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  3010. }
  3011. if ( ! get_post( $post_id ) ) {
  3012. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  3013. }
  3014. if ( ! comments_open( $post_id ) ) {
  3015. return new IXR_Error( 403, __( 'Sorry, comments are closed for this item.' ) );
  3016. }
  3017. if ( empty( $content_struct['content'] ) ) {
  3018. return new IXR_Error( 403, __( 'Comment is required.' ) );
  3019. }
  3020. $comment = array(
  3021. 'comment_post_ID' => $post_id,
  3022. 'comment_content' => $content_struct['content'],
  3023. );
  3024. if ( $logged_in ) {
  3025. $display_name = $user->display_name;
  3026. $user_email = $user->user_email;
  3027. $user_url = $user->user_url;
  3028. $comment['comment_author'] = $this->escape( $display_name );
  3029. $comment['comment_author_email'] = $this->escape( $user_email );
  3030. $comment['comment_author_url'] = $this->escape( $user_url );
  3031. $comment['user_ID'] = $user->ID;
  3032. } else {
  3033. $comment['comment_author'] = '';
  3034. if ( isset($content_struct['author']) )
  3035. $comment['comment_author'] = $content_struct['author'];
  3036. $comment['comment_author_email'] = '';
  3037. if ( isset($content_struct['author_email']) )
  3038. $comment['comment_author_email'] = $content_struct['author_email'];
  3039. $comment['comment_author_url'] = '';
  3040. if ( isset($content_struct['author_url']) )
  3041. $comment['comment_author_url'] = $content_struct['author_url'];
  3042. $comment['user_ID'] = 0;
  3043. if ( get_option('require_name_email') ) {
  3044. if ( 6 > strlen($comment['comment_author_email']) || '' == $comment['comment_author'] )
  3045. return new IXR_Error( 403, __( 'Comment author name and email are required.' ) );
  3046. elseif ( !is_email($comment['comment_author_email']) )
  3047. return new IXR_Error( 403, __( 'A valid email address is required.' ) );
  3048. }
  3049. }
  3050. $comment['comment_parent'] = isset($content_struct['comment_parent']) ? absint($content_struct['comment_parent']) : 0;
  3051. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3052. do_action( 'xmlrpc_call', 'wp.newComment' );
  3053. $comment_ID = wp_new_comment( $comment, true );
  3054. if ( is_wp_error( $comment_ID ) ) {
  3055. return new IXR_Error( 403, $comment_ID->get_error_message() );
  3056. }
  3057. if ( ! $comment_ID ) {
  3058. return new IXR_Error( 403, __( 'An unknown error occurred' ) );
  3059. }
  3060. /**
  3061. * Fires after a new comment has been successfully created via XML-RPC.
  3062. *
  3063. * @since 3.4.0
  3064. *
  3065. * @param int $comment_ID ID of the new comment.
  3066. * @param array $args An array of new comment arguments.
  3067. */
  3068. do_action( 'xmlrpc_call_success_wp_newComment', $comment_ID, $args );
  3069. return $comment_ID;
  3070. }
  3071. /**
  3072. * Retrieve all of the comment status.
  3073. *
  3074. * @since 2.7.0
  3075. *
  3076. * @param array $args {
  3077. * Method arguments. Note: arguments must be ordered as documented.
  3078. *
  3079. * @type int $blog_id (unused)
  3080. * @type string $username
  3081. * @type string $password
  3082. * }
  3083. * @return array|IXR_Error
  3084. */
  3085. public function wp_getCommentStatusList( $args ) {
  3086. $this->escape( $args );
  3087. $username = $args[1];
  3088. $password = $args[2];
  3089. if ( ! $user = $this->login( $username, $password ) ) {
  3090. return $this->error;
  3091. }
  3092. if ( ! current_user_can( 'publish_posts' ) ) {
  3093. return new IXR_Error( 403, __( 'Sorry, you are not allowed access to details about this site.' ) );
  3094. }
  3095. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3096. do_action( 'xmlrpc_call', 'wp.getCommentStatusList' );
  3097. return get_comment_statuses();
  3098. }
  3099. /**
  3100. * Retrieve comment count.
  3101. *
  3102. * @since 2.5.0
  3103. *
  3104. * @param array $args {
  3105. * Method arguments. Note: arguments must be ordered as documented.
  3106. *
  3107. * @type int $blog_id (unused)
  3108. * @type string $username
  3109. * @type string $password
  3110. * @type int $post_id
  3111. * }
  3112. * @return array|IXR_Error
  3113. */
  3114. public function wp_getCommentCount( $args ) {
  3115. $this->escape( $args );
  3116. $username = $args[1];
  3117. $password = $args[2];
  3118. $post_id = (int) $args[3];
  3119. if ( ! $user = $this->login( $username, $password ) ) {
  3120. return $this->error;
  3121. }
  3122. $post = get_post( $post_id, ARRAY_A );
  3123. if ( empty( $post['ID'] ) ) {
  3124. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  3125. }
  3126. if ( ! current_user_can( 'edit_post', $post_id ) ) {
  3127. return new IXR_Error( 403, __( 'Sorry, you are not allowed access to details of this post.' ) );
  3128. }
  3129. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3130. do_action( 'xmlrpc_call', 'wp.getCommentCount' );
  3131. $count = wp_count_comments( $post_id );
  3132. return array(
  3133. 'approved' => $count->approved,
  3134. 'awaiting_moderation' => $count->moderated,
  3135. 'spam' => $count->spam,
  3136. 'total_comments' => $count->total_comments
  3137. );
  3138. }
  3139. /**
  3140. * Retrieve post statuses.
  3141. *
  3142. * @since 2.5.0
  3143. *
  3144. * @param array $args {
  3145. * Method arguments. Note: arguments must be ordered as documented.
  3146. *
  3147. * @type int $blog_id (unused)
  3148. * @type string $username
  3149. * @type string $password
  3150. * }
  3151. * @return array|IXR_Error
  3152. */
  3153. public function wp_getPostStatusList( $args ) {
  3154. $this->escape( $args );
  3155. $username = $args[1];
  3156. $password = $args[2];
  3157. if ( !$user = $this->login($username, $password) )
  3158. return $this->error;
  3159. if ( !current_user_can( 'edit_posts' ) )
  3160. return new IXR_Error( 403, __( 'Sorry, you are not allowed access to details about this site.' ) );
  3161. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3162. do_action( 'xmlrpc_call', 'wp.getPostStatusList' );
  3163. return get_post_statuses();
  3164. }
  3165. /**
  3166. * Retrieve page statuses.
  3167. *
  3168. * @since 2.5.0
  3169. *
  3170. * @param array $args {
  3171. * Method arguments. Note: arguments must be ordered as documented.
  3172. *
  3173. * @type int $blog_id (unused)
  3174. * @type string $username
  3175. * @type string $password
  3176. * }
  3177. * @return array|IXR_Error
  3178. */
  3179. public function wp_getPageStatusList( $args ) {
  3180. $this->escape( $args );
  3181. $username = $args[1];
  3182. $password = $args[2];
  3183. if ( !$user = $this->login($username, $password) )
  3184. return $this->error;
  3185. if ( !current_user_can( 'edit_pages' ) )
  3186. return new IXR_Error( 403, __( 'Sorry, you are not allowed access to details about this site.' ) );
  3187. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3188. do_action( 'xmlrpc_call', 'wp.getPageStatusList' );
  3189. return get_page_statuses();
  3190. }
  3191. /**
  3192. * Retrieve page templates.
  3193. *
  3194. * @since 2.6.0
  3195. *
  3196. * @param array $args {
  3197. * Method arguments. Note: arguments must be ordered as documented.
  3198. *
  3199. * @type int $blog_id (unused)
  3200. * @type string $username
  3201. * @type string $password
  3202. * }
  3203. * @return array|IXR_Error
  3204. */
  3205. public function wp_getPageTemplates( $args ) {
  3206. $this->escape( $args );
  3207. $username = $args[1];
  3208. $password = $args[2];
  3209. if ( !$user = $this->login($username, $password) )
  3210. return $this->error;
  3211. if ( !current_user_can( 'edit_pages' ) )
  3212. return new IXR_Error( 403, __( 'Sorry, you are not allowed access to details about this site.' ) );
  3213. $templates = get_page_templates();
  3214. $templates['Default'] = 'default';
  3215. return $templates;
  3216. }
  3217. /**
  3218. * Retrieve blog options.
  3219. *
  3220. * @since 2.6.0
  3221. *
  3222. * @param array $args {
  3223. * Method arguments. Note: arguments must be ordered as documented.
  3224. *
  3225. * @type int $blog_id (unused)
  3226. * @type string $username
  3227. * @type string $password
  3228. * @type array $options
  3229. * }
  3230. * @return array|IXR_Error
  3231. */
  3232. public function wp_getOptions( $args ) {
  3233. $this->escape( $args );
  3234. $username = $args[1];
  3235. $password = $args[2];
  3236. $options = isset( $args[3] ) ? (array) $args[3] : array();
  3237. if ( !$user = $this->login($username, $password) )
  3238. return $this->error;
  3239. // If no specific options where asked for, return all of them
  3240. if ( count( $options ) == 0 )
  3241. $options = array_keys($this->blog_options);
  3242. return $this->_getOptions($options);
  3243. }
  3244. /**
  3245. * Retrieve blog options value from list.
  3246. *
  3247. * @since 2.6.0
  3248. *
  3249. * @param array $options Options to retrieve.
  3250. * @return array
  3251. */
  3252. public function _getOptions($options) {
  3253. $data = array();
  3254. $can_manage = current_user_can( 'manage_options' );
  3255. foreach ( $options as $option ) {
  3256. if ( array_key_exists( $option, $this->blog_options ) ) {
  3257. $data[$option] = $this->blog_options[$option];
  3258. //Is the value static or dynamic?
  3259. if ( isset( $data[$option]['option'] ) ) {
  3260. $data[$option]['value'] = get_option( $data[$option]['option'] );
  3261. unset($data[$option]['option']);
  3262. }
  3263. if ( ! $can_manage )
  3264. $data[$option]['readonly'] = true;
  3265. }
  3266. }
  3267. return $data;
  3268. }
  3269. /**
  3270. * Update blog options.
  3271. *
  3272. * @since 2.6.0
  3273. *
  3274. * @param array $args {
  3275. * Method arguments. Note: arguments must be ordered as documented.
  3276. *
  3277. * @type int $blog_id (unused)
  3278. * @type string $username
  3279. * @type string $password
  3280. * @type array $options
  3281. * }
  3282. * @return array|IXR_Error
  3283. */
  3284. public function wp_setOptions( $args ) {
  3285. $this->escape( $args );
  3286. $username = $args[1];
  3287. $password = $args[2];
  3288. $options = (array) $args[3];
  3289. if ( !$user = $this->login($username, $password) )
  3290. return $this->error;
  3291. if ( !current_user_can( 'manage_options' ) )
  3292. return new IXR_Error( 403, __( 'Sorry, you are not allowed to update options.' ) );
  3293. $option_names = array();
  3294. foreach ( $options as $o_name => $o_value ) {
  3295. $option_names[] = $o_name;
  3296. if ( !array_key_exists( $o_name, $this->blog_options ) )
  3297. continue;
  3298. if ( $this->blog_options[$o_name]['readonly'] == true )
  3299. continue;
  3300. update_option( $this->blog_options[$o_name]['option'], wp_unslash( $o_value ) );
  3301. }
  3302. //Now return the updated values
  3303. return $this->_getOptions($option_names);
  3304. }
  3305. /**
  3306. * Retrieve a media item by ID
  3307. *
  3308. * @since 3.1.0
  3309. *
  3310. * @param array $args {
  3311. * Method arguments. Note: arguments must be ordered as documented.
  3312. *
  3313. * @type int $blog_id (unused)
  3314. * @type string $username
  3315. * @type string $password
  3316. * @type int $attachment_id
  3317. * }
  3318. * @return array|IXR_Error Associative array contains:
  3319. * - 'date_created_gmt'
  3320. * - 'parent'
  3321. * - 'link'
  3322. * - 'thumbnail'
  3323. * - 'title'
  3324. * - 'caption'
  3325. * - 'description'
  3326. * - 'metadata'
  3327. */
  3328. public function wp_getMediaItem( $args ) {
  3329. $this->escape( $args );
  3330. $username = $args[1];
  3331. $password = $args[2];
  3332. $attachment_id = (int) $args[3];
  3333. if ( !$user = $this->login($username, $password) )
  3334. return $this->error;
  3335. if ( !current_user_can( 'upload_files' ) )
  3336. return new IXR_Error( 403, __( 'Sorry, you are not allowed to upload files.' ) );
  3337. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3338. do_action( 'xmlrpc_call', 'wp.getMediaItem' );
  3339. if ( ! $attachment = get_post($attachment_id) )
  3340. return new IXR_Error( 404, __( 'Invalid attachment ID.' ) );
  3341. return $this->_prepare_media_item( $attachment );
  3342. }
  3343. /**
  3344. * Retrieves a collection of media library items (or attachments)
  3345. *
  3346. * Besides the common blog_id (unused), username, and password arguments, it takes a filter
  3347. * array as last argument.
  3348. *
  3349. * Accepted 'filter' keys are 'parent_id', 'mime_type', 'offset', and 'number'.
  3350. *
  3351. * The defaults are as follows:
  3352. * - 'number' - Default is 5. Total number of media items to retrieve.
  3353. * - 'offset' - Default is 0. See WP_Query::query() for more.
  3354. * - 'parent_id' - Default is ''. The post where the media item is attached. Empty string shows all media items. 0 shows unattached media items.
  3355. * - 'mime_type' - Default is ''. Filter by mime type (e.g., 'image/jpeg', 'application/pdf')
  3356. *
  3357. * @since 3.1.0
  3358. *
  3359. * @param array $args {
  3360. * Method arguments. Note: arguments must be ordered as documented.
  3361. *
  3362. * @type int $blog_id (unused)
  3363. * @type string $username
  3364. * @type string $password
  3365. * @type array $struct
  3366. * }
  3367. * @return array|IXR_Error Contains a collection of media items. See wp_xmlrpc_server::wp_getMediaItem() for a description of each item contents
  3368. */
  3369. public function wp_getMediaLibrary($args) {
  3370. $this->escape($args);
  3371. $username = $args[1];
  3372. $password = $args[2];
  3373. $struct = isset( $args[3] ) ? $args[3] : array() ;
  3374. if ( !$user = $this->login($username, $password) )
  3375. return $this->error;
  3376. if ( !current_user_can( 'upload_files' ) )
  3377. return new IXR_Error( 401, __( 'Sorry, you are not allowed to upload files.' ) );
  3378. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3379. do_action( 'xmlrpc_call', 'wp.getMediaLibrary' );
  3380. $parent_id = ( isset($struct['parent_id']) ) ? absint($struct['parent_id']) : '' ;
  3381. $mime_type = ( isset($struct['mime_type']) ) ? $struct['mime_type'] : '' ;
  3382. $offset = ( isset($struct['offset']) ) ? absint($struct['offset']) : 0 ;
  3383. $number = ( isset($struct['number']) ) ? absint($struct['number']) : -1 ;
  3384. $attachments = get_posts( array('post_type' => 'attachment', 'post_parent' => $parent_id, 'offset' => $offset, 'numberposts' => $number, 'post_mime_type' => $mime_type ) );
  3385. $attachments_struct = array();
  3386. foreach ($attachments as $attachment )
  3387. $attachments_struct[] = $this->_prepare_media_item( $attachment );
  3388. return $attachments_struct;
  3389. }
  3390. /**
  3391. * Retrieves a list of post formats used by the site.
  3392. *
  3393. * @since 3.1.0
  3394. *
  3395. * @param array $args {
  3396. * Method arguments. Note: arguments must be ordered as documented.
  3397. *
  3398. * @type int $blog_id (unused)
  3399. * @type string $username
  3400. * @type string $password
  3401. * }
  3402. * @return array|IXR_Error List of post formats, otherwise IXR_Error object.
  3403. */
  3404. public function wp_getPostFormats( $args ) {
  3405. $this->escape( $args );
  3406. $username = $args[1];
  3407. $password = $args[2];
  3408. if ( !$user = $this->login( $username, $password ) )
  3409. return $this->error;
  3410. if ( !current_user_can( 'edit_posts' ) )
  3411. return new IXR_Error( 403, __( 'Sorry, you are not allowed access to details about this site.' ) );
  3412. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3413. do_action( 'xmlrpc_call', 'wp.getPostFormats' );
  3414. $formats = get_post_format_strings();
  3415. // find out if they want a list of currently supports formats
  3416. if ( isset( $args[3] ) && is_array( $args[3] ) ) {
  3417. if ( $args[3]['show-supported'] ) {
  3418. if ( current_theme_supports( 'post-formats' ) ) {
  3419. $supported = get_theme_support( 'post-formats' );
  3420. $data = array();
  3421. $data['all'] = $formats;
  3422. $data['supported'] = $supported[0];
  3423. $formats = $data;
  3424. }
  3425. }
  3426. }
  3427. return $formats;
  3428. }
  3429. /**
  3430. * Retrieves a post type
  3431. *
  3432. * @since 3.4.0
  3433. *
  3434. * @see get_post_type_object()
  3435. *
  3436. * @param array $args {
  3437. * Method arguments. Note: arguments must be ordered as documented.
  3438. *
  3439. * @type int $blog_id (unused)
  3440. * @type string $username
  3441. * @type string $password
  3442. * @type string $post_type_name
  3443. * @type array $fields (optional)
  3444. * }
  3445. * @return array|IXR_Error Array contains:
  3446. * - 'labels'
  3447. * - 'description'
  3448. * - 'capability_type'
  3449. * - 'cap'
  3450. * - 'map_meta_cap'
  3451. * - 'hierarchical'
  3452. * - 'menu_position'
  3453. * - 'taxonomies'
  3454. * - 'supports'
  3455. */
  3456. public function wp_getPostType( $args ) {
  3457. if ( ! $this->minimum_args( $args, 4 ) )
  3458. return $this->error;
  3459. $this->escape( $args );
  3460. $username = $args[1];
  3461. $password = $args[2];
  3462. $post_type_name = $args[3];
  3463. if ( isset( $args[4] ) ) {
  3464. $fields = $args[4];
  3465. } else {
  3466. /**
  3467. * Filters the default query fields used by the given XML-RPC method.
  3468. *
  3469. * @since 3.4.0
  3470. *
  3471. * @param array $fields An array of post type query fields for the given method.
  3472. * @param string $method The method name.
  3473. */
  3474. $fields = apply_filters( 'xmlrpc_default_posttype_fields', array( 'labels', 'cap', 'taxonomies' ), 'wp.getPostType' );
  3475. }
  3476. if ( !$user = $this->login( $username, $password ) )
  3477. return $this->error;
  3478. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3479. do_action( 'xmlrpc_call', 'wp.getPostType' );
  3480. if ( ! post_type_exists( $post_type_name ) )
  3481. return new IXR_Error( 403, __( 'Invalid post type.' ) );
  3482. $post_type = get_post_type_object( $post_type_name );
  3483. if ( ! current_user_can( $post_type->cap->edit_posts ) )
  3484. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts in this post type.' ) );
  3485. return $this->_prepare_post_type( $post_type, $fields );
  3486. }
  3487. /**
  3488. * Retrieves a post types
  3489. *
  3490. * @since 3.4.0
  3491. *
  3492. * @see get_post_types()
  3493. *
  3494. * @param array $args {
  3495. * Method arguments. Note: arguments must be ordered as documented.
  3496. *
  3497. * @type int $blog_id (unused)
  3498. * @type string $username
  3499. * @type string $password
  3500. * @type array $filter (optional)
  3501. * @type array $fields (optional)
  3502. * }
  3503. * @return array|IXR_Error
  3504. */
  3505. public function wp_getPostTypes( $args ) {
  3506. if ( ! $this->minimum_args( $args, 3 ) )
  3507. return $this->error;
  3508. $this->escape( $args );
  3509. $username = $args[1];
  3510. $password = $args[2];
  3511. $filter = isset( $args[3] ) ? $args[3] : array( 'public' => true );
  3512. if ( isset( $args[4] ) ) {
  3513. $fields = $args[4];
  3514. } else {
  3515. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3516. $fields = apply_filters( 'xmlrpc_default_posttype_fields', array( 'labels', 'cap', 'taxonomies' ), 'wp.getPostTypes' );
  3517. }
  3518. if ( ! $user = $this->login( $username, $password ) )
  3519. return $this->error;
  3520. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3521. do_action( 'xmlrpc_call', 'wp.getPostTypes' );
  3522. $post_types = get_post_types( $filter, 'objects' );
  3523. $struct = array();
  3524. foreach ( $post_types as $post_type ) {
  3525. if ( ! current_user_can( $post_type->cap->edit_posts ) )
  3526. continue;
  3527. $struct[$post_type->name] = $this->_prepare_post_type( $post_type, $fields );
  3528. }
  3529. return $struct;
  3530. }
  3531. /**
  3532. * Retrieve revisions for a specific post.
  3533. *
  3534. * @since 3.5.0
  3535. *
  3536. * The optional $fields parameter specifies what fields will be included
  3537. * in the response array.
  3538. *
  3539. * @uses wp_get_post_revisions()
  3540. * @see wp_getPost() for more on $fields
  3541. *
  3542. * @param array $args {
  3543. * Method arguments. Note: arguments must be ordered as documented.
  3544. *
  3545. * @type int $blog_id (unused)
  3546. * @type string $username
  3547. * @type string $password
  3548. * @type int $post_id
  3549. * @type array $fields (optional)
  3550. * }
  3551. * @return array|IXR_Error contains a collection of posts.
  3552. */
  3553. public function wp_getRevisions( $args ) {
  3554. if ( ! $this->minimum_args( $args, 4 ) )
  3555. return $this->error;
  3556. $this->escape( $args );
  3557. $username = $args[1];
  3558. $password = $args[2];
  3559. $post_id = (int) $args[3];
  3560. if ( isset( $args[4] ) ) {
  3561. $fields = $args[4];
  3562. } else {
  3563. /**
  3564. * Filters the default revision query fields used by the given XML-RPC method.
  3565. *
  3566. * @since 3.5.0
  3567. *
  3568. * @param array $field An array of revision query fields.
  3569. * @param string $method The method name.
  3570. */
  3571. $fields = apply_filters( 'xmlrpc_default_revision_fields', array( 'post_date', 'post_date_gmt' ), 'wp.getRevisions' );
  3572. }
  3573. if ( ! $user = $this->login( $username, $password ) )
  3574. return $this->error;
  3575. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3576. do_action( 'xmlrpc_call', 'wp.getRevisions' );
  3577. if ( ! $post = get_post( $post_id ) )
  3578. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  3579. if ( ! current_user_can( 'edit_post', $post_id ) )
  3580. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts.' ) );
  3581. // Check if revisions are enabled.
  3582. if ( ! wp_revisions_enabled( $post ) )
  3583. return new IXR_Error( 401, __( 'Sorry, revisions are disabled.' ) );
  3584. $revisions = wp_get_post_revisions( $post_id );
  3585. if ( ! $revisions )
  3586. return array();
  3587. $struct = array();
  3588. foreach ( $revisions as $revision ) {
  3589. if ( ! current_user_can( 'read_post', $revision->ID ) )
  3590. continue;
  3591. // Skip autosaves
  3592. if ( wp_is_post_autosave( $revision ) )
  3593. continue;
  3594. $struct[] = $this->_prepare_post( get_object_vars( $revision ), $fields );
  3595. }
  3596. return $struct;
  3597. }
  3598. /**
  3599. * Restore a post revision
  3600. *
  3601. * @since 3.5.0
  3602. *
  3603. * @uses wp_restore_post_revision()
  3604. *
  3605. * @param array $args {
  3606. * Method arguments. Note: arguments must be ordered as documented.
  3607. *
  3608. * @type int $blog_id (unused)
  3609. * @type string $username
  3610. * @type string $password
  3611. * @type int $revision_id
  3612. * }
  3613. * @return bool|IXR_Error false if there was an error restoring, true if success.
  3614. */
  3615. public function wp_restoreRevision( $args ) {
  3616. if ( ! $this->minimum_args( $args, 3 ) )
  3617. return $this->error;
  3618. $this->escape( $args );
  3619. $username = $args[1];
  3620. $password = $args[2];
  3621. $revision_id = (int) $args[3];
  3622. if ( ! $user = $this->login( $username, $password ) )
  3623. return $this->error;
  3624. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3625. do_action( 'xmlrpc_call', 'wp.restoreRevision' );
  3626. if ( ! $revision = wp_get_post_revision( $revision_id ) )
  3627. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  3628. if ( wp_is_post_autosave( $revision ) )
  3629. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  3630. if ( ! $post = get_post( $revision->post_parent ) )
  3631. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  3632. if ( ! current_user_can( 'edit_post', $revision->post_parent ) )
  3633. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  3634. // Check if revisions are disabled.
  3635. if ( ! wp_revisions_enabled( $post ) )
  3636. return new IXR_Error( 401, __( 'Sorry, revisions are disabled.' ) );
  3637. $post = wp_restore_post_revision( $revision_id );
  3638. return (bool) $post;
  3639. }
  3640. /* Blogger API functions.
  3641. * specs on http://plant.blogger.com/api and https://groups.yahoo.com/group/bloggerDev/
  3642. */
  3643. /**
  3644. * Retrieve blogs that user owns.
  3645. *
  3646. * Will make more sense once we support multiple blogs.
  3647. *
  3648. * @since 1.5.0
  3649. *
  3650. * @param array $args {
  3651. * Method arguments. Note: arguments must be ordered as documented.
  3652. *
  3653. * @type int $blog_id (unused)
  3654. * @type string $username
  3655. * @type string $password
  3656. * }
  3657. * @return array|IXR_Error
  3658. */
  3659. public function blogger_getUsersBlogs($args) {
  3660. if ( ! $this->minimum_args( $args, 3 ) ) {
  3661. return $this->error;
  3662. }
  3663. if ( is_multisite() ) {
  3664. return $this->_multisite_getUsersBlogs($args);
  3665. }
  3666. $this->escape($args);
  3667. $username = $args[1];
  3668. $password = $args[2];
  3669. if ( !$user = $this->login($username, $password) )
  3670. return $this->error;
  3671. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3672. do_action( 'xmlrpc_call', 'blogger.getUsersBlogs' );
  3673. $is_admin = current_user_can('manage_options');
  3674. $struct = array(
  3675. 'isAdmin' => $is_admin,
  3676. 'url' => get_option('home') . '/',
  3677. 'blogid' => '1',
  3678. 'blogName' => get_option('blogname'),
  3679. 'xmlrpc' => site_url( 'xmlrpc.php', 'rpc' ),
  3680. );
  3681. return array($struct);
  3682. }
  3683. /**
  3684. * Private function for retrieving a users blogs for multisite setups
  3685. *
  3686. * @since 3.0.0
  3687. * @access protected
  3688. *
  3689. * @param array $args {
  3690. * Method arguments. Note: arguments must be ordered as documented.
  3691. *
  3692. * @type string $username Username.
  3693. * @type string $password Password.
  3694. * }
  3695. * @return array|IXR_Error
  3696. */
  3697. protected function _multisite_getUsersBlogs( $args ) {
  3698. $current_blog = get_site();
  3699. $domain = $current_blog->domain;
  3700. $path = $current_blog->path . 'xmlrpc.php';
  3701. $rpc = new IXR_Client( set_url_scheme( "http://{$domain}{$path}" ) );
  3702. $rpc->query('wp.getUsersBlogs', $args[1], $args[2]);
  3703. $blogs = $rpc->getResponse();
  3704. if ( isset($blogs['faultCode']) )
  3705. return new IXR_Error($blogs['faultCode'], $blogs['faultString']);
  3706. if ( $_SERVER['HTTP_HOST'] == $domain && $_SERVER['REQUEST_URI'] == $path ) {
  3707. return $blogs;
  3708. } else {
  3709. foreach ( (array) $blogs as $blog ) {
  3710. if ( strpos($blog['url'], $_SERVER['HTTP_HOST']) )
  3711. return array($blog);
  3712. }
  3713. return array();
  3714. }
  3715. }
  3716. /**
  3717. * Retrieve user's data.
  3718. *
  3719. * Gives your client some info about you, so you don't have to.
  3720. *
  3721. * @since 1.5.0
  3722. *
  3723. * @param array $args {
  3724. * Method arguments. Note: arguments must be ordered as documented.
  3725. *
  3726. * @type int $blog_id (unused)
  3727. * @type string $username
  3728. * @type string $password
  3729. * }
  3730. * @return array|IXR_Error
  3731. */
  3732. public function blogger_getUserInfo( $args ) {
  3733. $this->escape( $args );
  3734. $username = $args[1];
  3735. $password = $args[2];
  3736. if ( !$user = $this->login($username, $password) )
  3737. return $this->error;
  3738. if ( !current_user_can( 'edit_posts' ) )
  3739. return new IXR_Error( 401, __( 'Sorry, you are not allowed to access user data on this site.' ) );
  3740. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3741. do_action( 'xmlrpc_call', 'blogger.getUserInfo' );
  3742. $struct = array(
  3743. 'nickname' => $user->nickname,
  3744. 'userid' => $user->ID,
  3745. 'url' => $user->user_url,
  3746. 'lastname' => $user->last_name,
  3747. 'firstname' => $user->first_name
  3748. );
  3749. return $struct;
  3750. }
  3751. /**
  3752. * Retrieve post.
  3753. *
  3754. * @since 1.5.0
  3755. *
  3756. * @param array $args {
  3757. * Method arguments. Note: arguments must be ordered as documented.
  3758. *
  3759. * @type int $blog_id (unused)
  3760. * @type int $post_ID
  3761. * @type string $username
  3762. * @type string $password
  3763. * }
  3764. * @return array|IXR_Error
  3765. */
  3766. public function blogger_getPost( $args ) {
  3767. $this->escape( $args );
  3768. $post_ID = (int) $args[1];
  3769. $username = $args[2];
  3770. $password = $args[3];
  3771. if ( !$user = $this->login($username, $password) )
  3772. return $this->error;
  3773. $post_data = get_post($post_ID, ARRAY_A);
  3774. if ( ! $post_data )
  3775. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  3776. if ( !current_user_can( 'edit_post', $post_ID ) )
  3777. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  3778. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3779. do_action( 'xmlrpc_call', 'blogger.getPost' );
  3780. $categories = implode(',', wp_get_post_categories($post_ID));
  3781. $content = '<title>'.wp_unslash($post_data['post_title']).'</title>';
  3782. $content .= '<category>'.$categories.'</category>';
  3783. $content .= wp_unslash($post_data['post_content']);
  3784. $struct = array(
  3785. 'userid' => $post_data['post_author'],
  3786. 'dateCreated' => $this->_convert_date( $post_data['post_date'] ),
  3787. 'content' => $content,
  3788. 'postid' => (string) $post_data['ID']
  3789. );
  3790. return $struct;
  3791. }
  3792. /**
  3793. * Retrieve list of recent posts.
  3794. *
  3795. * @since 1.5.0
  3796. *
  3797. * @param array $args {
  3798. * Method arguments. Note: arguments must be ordered as documented.
  3799. *
  3800. * @type string $appkey (unused)
  3801. * @type int $blog_id (unused)
  3802. * @type string $username
  3803. * @type string $password
  3804. * @type int $numberposts (optional)
  3805. * }
  3806. * @return array|IXR_Error
  3807. */
  3808. public function blogger_getRecentPosts( $args ) {
  3809. $this->escape($args);
  3810. // $args[0] = appkey - ignored
  3811. $username = $args[2];
  3812. $password = $args[3];
  3813. if ( isset( $args[4] ) )
  3814. $query = array( 'numberposts' => absint( $args[4] ) );
  3815. else
  3816. $query = array();
  3817. if ( !$user = $this->login($username, $password) )
  3818. return $this->error;
  3819. if ( ! current_user_can( 'edit_posts' ) )
  3820. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts.' ) );
  3821. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3822. do_action( 'xmlrpc_call', 'blogger.getRecentPosts' );
  3823. $posts_list = wp_get_recent_posts( $query );
  3824. if ( !$posts_list ) {
  3825. $this->error = new IXR_Error(500, __('Either there are no posts, or something went wrong.'));
  3826. return $this->error;
  3827. }
  3828. $recent_posts = array();
  3829. foreach ($posts_list as $entry) {
  3830. if ( !current_user_can( 'edit_post', $entry['ID'] ) )
  3831. continue;
  3832. $post_date = $this->_convert_date( $entry['post_date'] );
  3833. $categories = implode(',', wp_get_post_categories($entry['ID']));
  3834. $content = '<title>'.wp_unslash($entry['post_title']).'</title>';
  3835. $content .= '<category>'.$categories.'</category>';
  3836. $content .= wp_unslash($entry['post_content']);
  3837. $recent_posts[] = array(
  3838. 'userid' => $entry['post_author'],
  3839. 'dateCreated' => $post_date,
  3840. 'content' => $content,
  3841. 'postid' => (string) $entry['ID'],
  3842. );
  3843. }
  3844. return $recent_posts;
  3845. }
  3846. /**
  3847. * Deprecated.
  3848. *
  3849. * @since 1.5.0
  3850. * @deprecated 3.5.0
  3851. *
  3852. * @param array $args Unused.
  3853. * @return IXR_Error Error object.
  3854. */
  3855. public function blogger_getTemplate($args) {
  3856. return new IXR_Error( 403, __('Sorry, that file cannot be edited.' ) );
  3857. }
  3858. /**
  3859. * Deprecated.
  3860. *
  3861. * @since 1.5.0
  3862. * @deprecated 3.5.0
  3863. *
  3864. * @param array $args Unused.
  3865. * @return IXR_Error Error object.
  3866. */
  3867. public function blogger_setTemplate($args) {
  3868. return new IXR_Error( 403, __('Sorry, that file cannot be edited.' ) );
  3869. }
  3870. /**
  3871. * Creates new post.
  3872. *
  3873. * @since 1.5.0
  3874. *
  3875. * @param array $args {
  3876. * Method arguments. Note: arguments must be ordered as documented.
  3877. *
  3878. * @type string $appkey (unused)
  3879. * @type int $blog_id (unused)
  3880. * @type string $username
  3881. * @type string $password
  3882. * @type string $content
  3883. * @type string $publish
  3884. * }
  3885. * @return int|IXR_Error
  3886. */
  3887. public function blogger_newPost( $args ) {
  3888. $this->escape( $args );
  3889. $username = $args[2];
  3890. $password = $args[3];
  3891. $content = $args[4];
  3892. $publish = $args[5];
  3893. if ( !$user = $this->login($username, $password) )
  3894. return $this->error;
  3895. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3896. do_action( 'xmlrpc_call', 'blogger.newPost' );
  3897. $cap = ($publish) ? 'publish_posts' : 'edit_posts';
  3898. if ( ! current_user_can( get_post_type_object( 'post' )->cap->create_posts ) || !current_user_can($cap) )
  3899. return new IXR_Error(401, __('Sorry, you are not allowed to post on this site.'));
  3900. $post_status = ($publish) ? 'publish' : 'draft';
  3901. $post_author = $user->ID;
  3902. $post_title = xmlrpc_getposttitle($content);
  3903. $post_category = xmlrpc_getpostcategory($content);
  3904. $post_content = xmlrpc_removepostdata($content);
  3905. $post_date = current_time('mysql');
  3906. $post_date_gmt = current_time('mysql', 1);
  3907. $post_data = compact('post_author', 'post_date', 'post_date_gmt', 'post_content', 'post_title', 'post_category', 'post_status');
  3908. $post_ID = wp_insert_post($post_data);
  3909. if ( is_wp_error( $post_ID ) )
  3910. return new IXR_Error(500, $post_ID->get_error_message());
  3911. if ( !$post_ID )
  3912. return new IXR_Error(500, __('Sorry, your entry could not be posted.'));
  3913. $this->attach_uploads( $post_ID, $post_content );
  3914. /**
  3915. * Fires after a new post has been successfully created via the XML-RPC Blogger API.
  3916. *
  3917. * @since 3.4.0
  3918. *
  3919. * @param int $post_ID ID of the new post.
  3920. * @param array $args An array of new post arguments.
  3921. */
  3922. do_action( 'xmlrpc_call_success_blogger_newPost', $post_ID, $args );
  3923. return $post_ID;
  3924. }
  3925. /**
  3926. * Edit a post.
  3927. *
  3928. * @since 1.5.0
  3929. *
  3930. * @param array $args {
  3931. * Method arguments. Note: arguments must be ordered as documented.
  3932. *
  3933. * @type int $blog_id (unused)
  3934. * @type int $post_ID
  3935. * @type string $username
  3936. * @type string $password
  3937. * @type string $content
  3938. * @type bool $publish
  3939. * }
  3940. * @return true|IXR_Error true when done.
  3941. */
  3942. public function blogger_editPost( $args ) {
  3943. $this->escape($args);
  3944. $post_ID = (int) $args[1];
  3945. $username = $args[2];
  3946. $password = $args[3];
  3947. $content = $args[4];
  3948. $publish = $args[5];
  3949. if ( ! $user = $this->login( $username, $password ) ) {
  3950. return $this->error;
  3951. }
  3952. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  3953. do_action( 'xmlrpc_call', 'blogger.editPost' );
  3954. $actual_post = get_post( $post_ID, ARRAY_A );
  3955. if ( ! $actual_post || $actual_post['post_type'] != 'post' ) {
  3956. return new IXR_Error( 404, __( 'Sorry, no such post.' ) );
  3957. }
  3958. $this->escape($actual_post);
  3959. if ( ! current_user_can( 'edit_post', $post_ID ) ) {
  3960. return new IXR_Error(401, __('Sorry, you are not allowed to edit this post.'));
  3961. }
  3962. if ( 'publish' == $actual_post['post_status'] && ! current_user_can( 'publish_posts' ) ) {
  3963. return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish this post.' ) );
  3964. }
  3965. $postdata = array();
  3966. $postdata['ID'] = $actual_post['ID'];
  3967. $postdata['post_content'] = xmlrpc_removepostdata( $content );
  3968. $postdata['post_title'] = xmlrpc_getposttitle( $content );
  3969. $postdata['post_category'] = xmlrpc_getpostcategory( $content );
  3970. $postdata['post_status'] = $actual_post['post_status'];
  3971. $postdata['post_excerpt'] = $actual_post['post_excerpt'];
  3972. $postdata['post_status'] = $publish ? 'publish' : 'draft';
  3973. $result = wp_update_post( $postdata );
  3974. if ( ! $result ) {
  3975. return new IXR_Error(500, __('For some strange yet very annoying reason, this post could not be edited.'));
  3976. }
  3977. $this->attach_uploads( $actual_post['ID'], $postdata['post_content'] );
  3978. /**
  3979. * Fires after a post has been successfully updated via the XML-RPC Blogger API.
  3980. *
  3981. * @since 3.4.0
  3982. *
  3983. * @param int $post_ID ID of the updated post.
  3984. * @param array $args An array of arguments for the post to edit.
  3985. */
  3986. do_action( 'xmlrpc_call_success_blogger_editPost', $post_ID, $args );
  3987. return true;
  3988. }
  3989. /**
  3990. * Remove a post.
  3991. *
  3992. * @since 1.5.0
  3993. *
  3994. * @param array $args {
  3995. * Method arguments. Note: arguments must be ordered as documented.
  3996. *
  3997. * @type int $blog_id (unused)
  3998. * @type int $post_ID
  3999. * @type string $username
  4000. * @type string $password
  4001. * }
  4002. * @return true|IXR_Error True when post is deleted.
  4003. */
  4004. public function blogger_deletePost( $args ) {
  4005. $this->escape( $args );
  4006. $post_ID = (int) $args[1];
  4007. $username = $args[2];
  4008. $password = $args[3];
  4009. if ( !$user = $this->login($username, $password) )
  4010. return $this->error;
  4011. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4012. do_action( 'xmlrpc_call', 'blogger.deletePost' );
  4013. $actual_post = get_post( $post_ID, ARRAY_A );
  4014. if ( ! $actual_post || $actual_post['post_type'] != 'post' ) {
  4015. return new IXR_Error( 404, __( 'Sorry, no such post.' ) );
  4016. }
  4017. if ( ! current_user_can( 'delete_post', $post_ID ) ) {
  4018. return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this post.' ) );
  4019. }
  4020. $result = wp_delete_post( $post_ID );
  4021. if ( ! $result ) {
  4022. return new IXR_Error( 500, __( 'The post cannot be deleted.' ) );
  4023. }
  4024. /**
  4025. * Fires after a post has been successfully deleted via the XML-RPC Blogger API.
  4026. *
  4027. * @since 3.4.0
  4028. *
  4029. * @param int $post_ID ID of the deleted post.
  4030. * @param array $args An array of arguments to delete the post.
  4031. */
  4032. do_action( 'xmlrpc_call_success_blogger_deletePost', $post_ID, $args );
  4033. return true;
  4034. }
  4035. /* MetaWeblog API functions
  4036. * specs on wherever Dave Winer wants them to be
  4037. */
  4038. /**
  4039. * Create a new post.
  4040. *
  4041. * The 'content_struct' argument must contain:
  4042. * - title
  4043. * - description
  4044. * - mt_excerpt
  4045. * - mt_text_more
  4046. * - mt_keywords
  4047. * - mt_tb_ping_urls
  4048. * - categories
  4049. *
  4050. * Also, it can optionally contain:
  4051. * - wp_slug
  4052. * - wp_password
  4053. * - wp_page_parent_id
  4054. * - wp_page_order
  4055. * - wp_author_id
  4056. * - post_status | page_status - can be 'draft', 'private', 'publish', or 'pending'
  4057. * - mt_allow_comments - can be 'open' or 'closed'
  4058. * - mt_allow_pings - can be 'open' or 'closed'
  4059. * - date_created_gmt
  4060. * - dateCreated
  4061. * - wp_post_thumbnail
  4062. *
  4063. * @since 1.5.0
  4064. *
  4065. * @param array $args {
  4066. * Method arguments. Note: arguments must be ordered as documented.
  4067. *
  4068. * @type int $blog_id (unused)
  4069. * @type string $username
  4070. * @type string $password
  4071. * @type array $content_struct
  4072. * @type int $publish
  4073. * }
  4074. * @return int|IXR_Error
  4075. */
  4076. public function mw_newPost($args) {
  4077. $this->escape($args);
  4078. $username = $args[1];
  4079. $password = $args[2];
  4080. $content_struct = $args[3];
  4081. $publish = isset( $args[4] ) ? $args[4] : 0;
  4082. if ( !$user = $this->login($username, $password) )
  4083. return $this->error;
  4084. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4085. do_action( 'xmlrpc_call', 'metaWeblog.newPost' );
  4086. $page_template = '';
  4087. if ( !empty( $content_struct['post_type'] ) ) {
  4088. if ( $content_struct['post_type'] == 'page' ) {
  4089. if ( $publish )
  4090. $cap = 'publish_pages';
  4091. elseif ( isset( $content_struct['page_status'] ) && 'publish' == $content_struct['page_status'] )
  4092. $cap = 'publish_pages';
  4093. else
  4094. $cap = 'edit_pages';
  4095. $error_message = __( 'Sorry, you are not allowed to publish pages on this site.' );
  4096. $post_type = 'page';
  4097. if ( !empty( $content_struct['wp_page_template'] ) )
  4098. $page_template = $content_struct['wp_page_template'];
  4099. } elseif ( $content_struct['post_type'] == 'post' ) {
  4100. if ( $publish )
  4101. $cap = 'publish_posts';
  4102. elseif ( isset( $content_struct['post_status'] ) && 'publish' == $content_struct['post_status'] )
  4103. $cap = 'publish_posts';
  4104. else
  4105. $cap = 'edit_posts';
  4106. $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
  4107. $post_type = 'post';
  4108. } else {
  4109. // No other post_type values are allowed here
  4110. return new IXR_Error( 401, __( 'Invalid post type.' ) );
  4111. }
  4112. } else {
  4113. if ( $publish )
  4114. $cap = 'publish_posts';
  4115. elseif ( isset( $content_struct['post_status'] ) && 'publish' == $content_struct['post_status'])
  4116. $cap = 'publish_posts';
  4117. else
  4118. $cap = 'edit_posts';
  4119. $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
  4120. $post_type = 'post';
  4121. }
  4122. if ( ! current_user_can( get_post_type_object( $post_type )->cap->create_posts ) )
  4123. return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish posts on this site.' ) );
  4124. if ( !current_user_can( $cap ) )
  4125. return new IXR_Error( 401, $error_message );
  4126. // Check for a valid post format if one was given
  4127. if ( isset( $content_struct['wp_post_format'] ) ) {
  4128. $content_struct['wp_post_format'] = sanitize_key( $content_struct['wp_post_format'] );
  4129. if ( !array_key_exists( $content_struct['wp_post_format'], get_post_format_strings() ) ) {
  4130. return new IXR_Error( 404, __( 'Invalid post format.' ) );
  4131. }
  4132. }
  4133. // Let WordPress generate the post_name (slug) unless
  4134. // one has been provided.
  4135. $post_name = "";
  4136. if ( isset($content_struct['wp_slug']) )
  4137. $post_name = $content_struct['wp_slug'];
  4138. // Only use a password if one was given.
  4139. if ( isset($content_struct['wp_password']) )
  4140. $post_password = $content_struct['wp_password'];
  4141. // Only set a post parent if one was provided.
  4142. if ( isset($content_struct['wp_page_parent_id']) )
  4143. $post_parent = $content_struct['wp_page_parent_id'];
  4144. // Only set the menu_order if it was provided.
  4145. if ( isset($content_struct['wp_page_order']) )
  4146. $menu_order = $content_struct['wp_page_order'];
  4147. $post_author = $user->ID;
  4148. // If an author id was provided then use it instead.
  4149. if ( isset( $content_struct['wp_author_id'] ) && ( $user->ID != $content_struct['wp_author_id'] ) ) {
  4150. switch ( $post_type ) {
  4151. case "post":
  4152. if ( !current_user_can( 'edit_others_posts' ) )
  4153. return new IXR_Error( 401, __( 'Sorry, you are not allowed to create posts as this user.' ) );
  4154. break;
  4155. case "page":
  4156. if ( !current_user_can( 'edit_others_pages' ) )
  4157. return new IXR_Error( 401, __( 'Sorry, you are not allowed to create pages as this user.' ) );
  4158. break;
  4159. default:
  4160. return new IXR_Error( 401, __( 'Invalid post type.' ) );
  4161. }
  4162. $author = get_userdata( $content_struct['wp_author_id'] );
  4163. if ( ! $author )
  4164. return new IXR_Error( 404, __( 'Invalid author ID.' ) );
  4165. $post_author = $content_struct['wp_author_id'];
  4166. }
  4167. $post_title = isset( $content_struct['title'] ) ? $content_struct['title'] : null;
  4168. $post_content = isset( $content_struct['description'] ) ? $content_struct['description'] : null;
  4169. $post_status = $publish ? 'publish' : 'draft';
  4170. if ( isset( $content_struct["{$post_type}_status"] ) ) {
  4171. switch ( $content_struct["{$post_type}_status"] ) {
  4172. case 'draft':
  4173. case 'pending':
  4174. case 'private':
  4175. case 'publish':
  4176. $post_status = $content_struct["{$post_type}_status"];
  4177. break;
  4178. default:
  4179. $post_status = $publish ? 'publish' : 'draft';
  4180. break;
  4181. }
  4182. }
  4183. $post_excerpt = isset($content_struct['mt_excerpt']) ? $content_struct['mt_excerpt'] : null;
  4184. $post_more = isset($content_struct['mt_text_more']) ? $content_struct['mt_text_more'] : null;
  4185. $tags_input = isset($content_struct['mt_keywords']) ? $content_struct['mt_keywords'] : null;
  4186. if ( isset($content_struct['mt_allow_comments']) ) {
  4187. if ( !is_numeric($content_struct['mt_allow_comments']) ) {
  4188. switch ( $content_struct['mt_allow_comments'] ) {
  4189. case 'closed':
  4190. $comment_status = 'closed';
  4191. break;
  4192. case 'open':
  4193. $comment_status = 'open';
  4194. break;
  4195. default:
  4196. $comment_status = get_default_comment_status( $post_type );
  4197. break;
  4198. }
  4199. } else {
  4200. switch ( (int) $content_struct['mt_allow_comments'] ) {
  4201. case 0:
  4202. case 2:
  4203. $comment_status = 'closed';
  4204. break;
  4205. case 1:
  4206. $comment_status = 'open';
  4207. break;
  4208. default:
  4209. $comment_status = get_default_comment_status( $post_type );
  4210. break;
  4211. }
  4212. }
  4213. } else {
  4214. $comment_status = get_default_comment_status( $post_type );
  4215. }
  4216. if ( isset($content_struct['mt_allow_pings']) ) {
  4217. if ( !is_numeric($content_struct['mt_allow_pings']) ) {
  4218. switch ( $content_struct['mt_allow_pings'] ) {
  4219. case 'closed':
  4220. $ping_status = 'closed';
  4221. break;
  4222. case 'open':
  4223. $ping_status = 'open';
  4224. break;
  4225. default:
  4226. $ping_status = get_default_comment_status( $post_type, 'pingback' );
  4227. break;
  4228. }
  4229. } else {
  4230. switch ( (int) $content_struct['mt_allow_pings'] ) {
  4231. case 0:
  4232. $ping_status = 'closed';
  4233. break;
  4234. case 1:
  4235. $ping_status = 'open';
  4236. break;
  4237. default:
  4238. $ping_status = get_default_comment_status( $post_type, 'pingback' );
  4239. break;
  4240. }
  4241. }
  4242. } else {
  4243. $ping_status = get_default_comment_status( $post_type, 'pingback' );
  4244. }
  4245. if ( $post_more )
  4246. $post_content = $post_content . '<!--more-->' . $post_more;
  4247. $to_ping = null;
  4248. if ( isset( $content_struct['mt_tb_ping_urls'] ) ) {
  4249. $to_ping = $content_struct['mt_tb_ping_urls'];
  4250. if ( is_array($to_ping) )
  4251. $to_ping = implode(' ', $to_ping);
  4252. }
  4253. // Do some timestamp voodoo
  4254. if ( !empty( $content_struct['date_created_gmt'] ) )
  4255. // We know this is supposed to be GMT, so we're going to slap that Z on there by force
  4256. $dateCreated = rtrim( $content_struct['date_created_gmt']->getIso(), 'Z' ) . 'Z';
  4257. elseif ( !empty( $content_struct['dateCreated']) )
  4258. $dateCreated = $content_struct['dateCreated']->getIso();
  4259. if ( !empty( $dateCreated ) ) {
  4260. $post_date = get_date_from_gmt(iso8601_to_datetime($dateCreated));
  4261. $post_date_gmt = iso8601_to_datetime($dateCreated, 'GMT');
  4262. } else {
  4263. $post_date = '';
  4264. $post_date_gmt = '';
  4265. }
  4266. $post_category = array();
  4267. if ( isset( $content_struct['categories'] ) ) {
  4268. $catnames = $content_struct['categories'];
  4269. if ( is_array($catnames) ) {
  4270. foreach ($catnames as $cat) {
  4271. $post_category[] = get_cat_ID($cat);
  4272. }
  4273. }
  4274. }
  4275. $postdata = compact('post_author', 'post_date', 'post_date_gmt', 'post_content', 'post_title', 'post_category', 'post_status', 'post_excerpt', 'comment_status', 'ping_status', 'to_ping', 'post_type', 'post_name', 'post_password', 'post_parent', 'menu_order', 'tags_input', 'page_template');
  4276. $post_ID = $postdata['ID'] = get_default_post_to_edit( $post_type, true )->ID;
  4277. // Only posts can be sticky
  4278. if ( $post_type == 'post' && isset( $content_struct['sticky'] ) ) {
  4279. $data = $postdata;
  4280. $data['sticky'] = $content_struct['sticky'];
  4281. $error = $this->_toggle_sticky( $data );
  4282. if ( $error ) {
  4283. return $error;
  4284. }
  4285. }
  4286. if ( isset($content_struct['custom_fields']) )
  4287. $this->set_custom_fields($post_ID, $content_struct['custom_fields']);
  4288. if ( isset ( $content_struct['wp_post_thumbnail'] ) ) {
  4289. if ( set_post_thumbnail( $post_ID, $content_struct['wp_post_thumbnail'] ) === false )
  4290. return new IXR_Error( 404, __( 'Invalid attachment ID.' ) );
  4291. unset( $content_struct['wp_post_thumbnail'] );
  4292. }
  4293. // Handle enclosures
  4294. $thisEnclosure = isset($content_struct['enclosure']) ? $content_struct['enclosure'] : null;
  4295. $this->add_enclosure_if_new($post_ID, $thisEnclosure);
  4296. $this->attach_uploads( $post_ID, $post_content );
  4297. // Handle post formats if assigned, value is validated earlier
  4298. // in this function
  4299. if ( isset( $content_struct['wp_post_format'] ) )
  4300. set_post_format( $post_ID, $content_struct['wp_post_format'] );
  4301. $post_ID = wp_insert_post( $postdata, true );
  4302. if ( is_wp_error( $post_ID ) )
  4303. return new IXR_Error(500, $post_ID->get_error_message());
  4304. if ( !$post_ID )
  4305. return new IXR_Error(500, __('Sorry, your entry could not be posted.'));
  4306. /**
  4307. * Fires after a new post has been successfully created via the XML-RPC MovableType API.
  4308. *
  4309. * @since 3.4.0
  4310. *
  4311. * @param int $post_ID ID of the new post.
  4312. * @param array $args An array of arguments to create the new post.
  4313. */
  4314. do_action( 'xmlrpc_call_success_mw_newPost', $post_ID, $args );
  4315. return strval($post_ID);
  4316. }
  4317. /**
  4318. * Adds an enclosure to a post if it's new.
  4319. *
  4320. * @since 2.8.0
  4321. *
  4322. * @param integer $post_ID Post ID.
  4323. * @param array $enclosure Enclosure data.
  4324. */
  4325. public function add_enclosure_if_new( $post_ID, $enclosure ) {
  4326. if ( is_array( $enclosure ) && isset( $enclosure['url'] ) && isset( $enclosure['length'] ) && isset( $enclosure['type'] ) ) {
  4327. $encstring = $enclosure['url'] . "\n" . $enclosure['length'] . "\n" . $enclosure['type'] . "\n";
  4328. $found = false;
  4329. if ( $enclosures = get_post_meta( $post_ID, 'enclosure' ) ) {
  4330. foreach ( $enclosures as $enc ) {
  4331. // This method used to omit the trailing new line. #23219
  4332. if ( rtrim( $enc, "\n" ) == rtrim( $encstring, "\n" ) ) {
  4333. $found = true;
  4334. break;
  4335. }
  4336. }
  4337. }
  4338. if ( ! $found )
  4339. add_post_meta( $post_ID, 'enclosure', $encstring );
  4340. }
  4341. }
  4342. /**
  4343. * Attach upload to a post.
  4344. *
  4345. * @since 2.1.0
  4346. *
  4347. * @global wpdb $wpdb WordPress database abstraction object.
  4348. *
  4349. * @param int $post_ID Post ID.
  4350. * @param string $post_content Post Content for attachment.
  4351. */
  4352. public function attach_uploads( $post_ID, $post_content ) {
  4353. global $wpdb;
  4354. // find any unattached files
  4355. $attachments = $wpdb->get_results( "SELECT ID, guid FROM {$wpdb->posts} WHERE post_parent = '0' AND post_type = 'attachment'" );
  4356. if ( is_array( $attachments ) ) {
  4357. foreach ( $attachments as $file ) {
  4358. if ( ! empty( $file->guid ) && strpos( $post_content, $file->guid ) !== false )
  4359. $wpdb->update($wpdb->posts, array('post_parent' => $post_ID), array('ID' => $file->ID) );
  4360. }
  4361. }
  4362. }
  4363. /**
  4364. * Edit a post.
  4365. *
  4366. * @since 1.5.0
  4367. *
  4368. * @param array $args {
  4369. * Method arguments. Note: arguments must be ordered as documented.
  4370. *
  4371. * @type int $blog_id (unused)
  4372. * @type string $username
  4373. * @type string $password
  4374. * @type array $content_struct
  4375. * @type int $publish
  4376. * }
  4377. * @return bool|IXR_Error True on success.
  4378. */
  4379. public function mw_editPost( $args ) {
  4380. $this->escape( $args );
  4381. $post_ID = (int) $args[0];
  4382. $username = $args[1];
  4383. $password = $args[2];
  4384. $content_struct = $args[3];
  4385. $publish = isset( $args[4] ) ? $args[4] : 0;
  4386. if ( ! $user = $this->login($username, $password) )
  4387. return $this->error;
  4388. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4389. do_action( 'xmlrpc_call', 'metaWeblog.editPost' );
  4390. $postdata = get_post( $post_ID, ARRAY_A );
  4391. /*
  4392. * If there is no post data for the give post id, stop now and return an error.
  4393. * Otherwise a new post will be created (which was the old behavior).
  4394. */
  4395. if ( ! $postdata || empty( $postdata[ 'ID' ] ) )
  4396. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  4397. if ( ! current_user_can( 'edit_post', $post_ID ) )
  4398. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  4399. // Use wp.editPost to edit post types other than post and page.
  4400. if ( ! in_array( $postdata[ 'post_type' ], array( 'post', 'page' ) ) )
  4401. return new IXR_Error( 401, __( 'Invalid post type.' ) );
  4402. // Thwart attempt to change the post type.
  4403. if ( ! empty( $content_struct[ 'post_type' ] ) && ( $content_struct['post_type'] != $postdata[ 'post_type' ] ) )
  4404. return new IXR_Error( 401, __( 'The post type may not be changed.' ) );
  4405. // Check for a valid post format if one was given
  4406. if ( isset( $content_struct['wp_post_format'] ) ) {
  4407. $content_struct['wp_post_format'] = sanitize_key( $content_struct['wp_post_format'] );
  4408. if ( !array_key_exists( $content_struct['wp_post_format'], get_post_format_strings() ) ) {
  4409. return new IXR_Error( 404, __( 'Invalid post format.' ) );
  4410. }
  4411. }
  4412. $this->escape($postdata);
  4413. $ID = $postdata['ID'];
  4414. $post_content = $postdata['post_content'];
  4415. $post_title = $postdata['post_title'];
  4416. $post_excerpt = $postdata['post_excerpt'];
  4417. $post_password = $postdata['post_password'];
  4418. $post_parent = $postdata['post_parent'];
  4419. $post_type = $postdata['post_type'];
  4420. $menu_order = $postdata['menu_order'];
  4421. // Let WordPress manage slug if none was provided.
  4422. $post_name = $postdata['post_name'];
  4423. if ( isset($content_struct['wp_slug']) )
  4424. $post_name = $content_struct['wp_slug'];
  4425. // Only use a password if one was given.
  4426. if ( isset($content_struct['wp_password']) )
  4427. $post_password = $content_struct['wp_password'];
  4428. // Only set a post parent if one was given.
  4429. if ( isset($content_struct['wp_page_parent_id']) )
  4430. $post_parent = $content_struct['wp_page_parent_id'];
  4431. // Only set the menu_order if it was given.
  4432. if ( isset($content_struct['wp_page_order']) )
  4433. $menu_order = $content_struct['wp_page_order'];
  4434. $page_template = null;
  4435. if ( ! empty( $content_struct['wp_page_template'] ) && 'page' == $post_type )
  4436. $page_template = $content_struct['wp_page_template'];
  4437. $post_author = $postdata['post_author'];
  4438. // Only set the post_author if one is set.
  4439. if ( isset( $content_struct['wp_author_id'] ) ) {
  4440. // Check permissions if attempting to switch author to or from another user.
  4441. if ( $user->ID != $content_struct['wp_author_id'] || $user->ID != $post_author ) {
  4442. switch ( $post_type ) {
  4443. case 'post':
  4444. if ( ! current_user_can( 'edit_others_posts' ) ) {
  4445. return new IXR_Error( 401, __( 'Sorry, you are not allowed to change the post author as this user.' ) );
  4446. }
  4447. break;
  4448. case 'page':
  4449. if ( ! current_user_can( 'edit_others_pages' ) ) {
  4450. return new IXR_Error( 401, __( 'Sorry, you are not allowed to change the page author as this user.' ) );
  4451. }
  4452. break;
  4453. default:
  4454. return new IXR_Error( 401, __( 'Invalid post type.' ) );
  4455. }
  4456. $post_author = $content_struct['wp_author_id'];
  4457. }
  4458. }
  4459. if ( isset($content_struct['mt_allow_comments']) ) {
  4460. if ( !is_numeric($content_struct['mt_allow_comments']) ) {
  4461. switch ( $content_struct['mt_allow_comments'] ) {
  4462. case 'closed':
  4463. $comment_status = 'closed';
  4464. break;
  4465. case 'open':
  4466. $comment_status = 'open';
  4467. break;
  4468. default:
  4469. $comment_status = get_default_comment_status( $post_type );
  4470. break;
  4471. }
  4472. } else {
  4473. switch ( (int) $content_struct['mt_allow_comments'] ) {
  4474. case 0:
  4475. case 2:
  4476. $comment_status = 'closed';
  4477. break;
  4478. case 1:
  4479. $comment_status = 'open';
  4480. break;
  4481. default:
  4482. $comment_status = get_default_comment_status( $post_type );
  4483. break;
  4484. }
  4485. }
  4486. }
  4487. if ( isset($content_struct['mt_allow_pings']) ) {
  4488. if ( !is_numeric($content_struct['mt_allow_pings']) ) {
  4489. switch ( $content_struct['mt_allow_pings'] ) {
  4490. case 'closed':
  4491. $ping_status = 'closed';
  4492. break;
  4493. case 'open':
  4494. $ping_status = 'open';
  4495. break;
  4496. default:
  4497. $ping_status = get_default_comment_status( $post_type, 'pingback' );
  4498. break;
  4499. }
  4500. } else {
  4501. switch ( (int) $content_struct["mt_allow_pings"] ) {
  4502. case 0:
  4503. $ping_status = 'closed';
  4504. break;
  4505. case 1:
  4506. $ping_status = 'open';
  4507. break;
  4508. default:
  4509. $ping_status = get_default_comment_status( $post_type, 'pingback' );
  4510. break;
  4511. }
  4512. }
  4513. }
  4514. if ( isset( $content_struct['title'] ) )
  4515. $post_title = $content_struct['title'];
  4516. if ( isset( $content_struct['description'] ) )
  4517. $post_content = $content_struct['description'];
  4518. $post_category = array();
  4519. if ( isset( $content_struct['categories'] ) ) {
  4520. $catnames = $content_struct['categories'];
  4521. if ( is_array($catnames) ) {
  4522. foreach ($catnames as $cat) {
  4523. $post_category[] = get_cat_ID($cat);
  4524. }
  4525. }
  4526. }
  4527. if ( isset( $content_struct['mt_excerpt'] ) )
  4528. $post_excerpt = $content_struct['mt_excerpt'];
  4529. $post_more = isset( $content_struct['mt_text_more'] ) ? $content_struct['mt_text_more'] : null;
  4530. $post_status = $publish ? 'publish' : 'draft';
  4531. if ( isset( $content_struct["{$post_type}_status"] ) ) {
  4532. switch( $content_struct["{$post_type}_status"] ) {
  4533. case 'draft':
  4534. case 'pending':
  4535. case 'private':
  4536. case 'publish':
  4537. $post_status = $content_struct["{$post_type}_status"];
  4538. break;
  4539. default:
  4540. $post_status = $publish ? 'publish' : 'draft';
  4541. break;
  4542. }
  4543. }
  4544. $tags_input = isset( $content_struct['mt_keywords'] ) ? $content_struct['mt_keywords'] : null;
  4545. if ( 'publish' == $post_status || 'private' == $post_status ) {
  4546. if ( 'page' == $post_type && ! current_user_can( 'publish_pages' ) ) {
  4547. return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish this page.' ) );
  4548. } elseif ( ! current_user_can( 'publish_posts' ) ) {
  4549. return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish this post.' ) );
  4550. }
  4551. }
  4552. if ( $post_more )
  4553. $post_content = $post_content . "<!--more-->" . $post_more;
  4554. $to_ping = null;
  4555. if ( isset( $content_struct['mt_tb_ping_urls'] ) ) {
  4556. $to_ping = $content_struct['mt_tb_ping_urls'];
  4557. if ( is_array($to_ping) )
  4558. $to_ping = implode(' ', $to_ping);
  4559. }
  4560. // Do some timestamp voodoo.
  4561. if ( !empty( $content_struct['date_created_gmt'] ) )
  4562. // We know this is supposed to be GMT, so we're going to slap that Z on there by force.
  4563. $dateCreated = rtrim( $content_struct['date_created_gmt']->getIso(), 'Z' ) . 'Z';
  4564. elseif ( !empty( $content_struct['dateCreated']) )
  4565. $dateCreated = $content_struct['dateCreated']->getIso();
  4566. // Default to not flagging the post date to be edited unless it's intentional.
  4567. $edit_date = false;
  4568. if ( !empty( $dateCreated ) ) {
  4569. $post_date = get_date_from_gmt(iso8601_to_datetime($dateCreated));
  4570. $post_date_gmt = iso8601_to_datetime($dateCreated, 'GMT');
  4571. // Flag the post date to be edited.
  4572. $edit_date = true;
  4573. } else {
  4574. $post_date = $postdata['post_date'];
  4575. $post_date_gmt = $postdata['post_date_gmt'];
  4576. }
  4577. // We've got all the data -- post it.
  4578. $newpost = compact('ID', 'post_content', 'post_title', 'post_category', 'post_status', 'post_excerpt', 'comment_status', 'ping_status', 'edit_date', 'post_date', 'post_date_gmt', 'to_ping', 'post_name', 'post_password', 'post_parent', 'menu_order', 'post_author', 'tags_input', 'page_template');
  4579. $result = wp_update_post($newpost, true);
  4580. if ( is_wp_error( $result ) )
  4581. return new IXR_Error(500, $result->get_error_message());
  4582. if ( !$result )
  4583. return new IXR_Error(500, __('Sorry, your entry could not be edited.'));
  4584. // Only posts can be sticky
  4585. if ( $post_type == 'post' && isset( $content_struct['sticky'] ) ) {
  4586. $data = $newpost;
  4587. $data['sticky'] = $content_struct['sticky'];
  4588. $data['post_type'] = 'post';
  4589. $error = $this->_toggle_sticky( $data, true );
  4590. if ( $error ) {
  4591. return $error;
  4592. }
  4593. }
  4594. if ( isset($content_struct['custom_fields']) )
  4595. $this->set_custom_fields($post_ID, $content_struct['custom_fields']);
  4596. if ( isset ( $content_struct['wp_post_thumbnail'] ) ) {
  4597. // Empty value deletes, non-empty value adds/updates.
  4598. if ( empty( $content_struct['wp_post_thumbnail'] ) ) {
  4599. delete_post_thumbnail( $post_ID );
  4600. } else {
  4601. if ( set_post_thumbnail( $post_ID, $content_struct['wp_post_thumbnail'] ) === false )
  4602. return new IXR_Error( 404, __( 'Invalid attachment ID.' ) );
  4603. }
  4604. unset( $content_struct['wp_post_thumbnail'] );
  4605. }
  4606. // Handle enclosures.
  4607. $thisEnclosure = isset($content_struct['enclosure']) ? $content_struct['enclosure'] : null;
  4608. $this->add_enclosure_if_new($post_ID, $thisEnclosure);
  4609. $this->attach_uploads( $ID, $post_content );
  4610. // Handle post formats if assigned, validation is handled earlier in this function.
  4611. if ( isset( $content_struct['wp_post_format'] ) )
  4612. set_post_format( $post_ID, $content_struct['wp_post_format'] );
  4613. /**
  4614. * Fires after a post has been successfully updated via the XML-RPC MovableType API.
  4615. *
  4616. * @since 3.4.0
  4617. *
  4618. * @param int $post_ID ID of the updated post.
  4619. * @param array $args An array of arguments to update the post.
  4620. */
  4621. do_action( 'xmlrpc_call_success_mw_editPost', $post_ID, $args );
  4622. return true;
  4623. }
  4624. /**
  4625. * Retrieve post.
  4626. *
  4627. * @since 1.5.0
  4628. *
  4629. * @param array $args {
  4630. * Method arguments. Note: arguments must be ordered as documented.
  4631. *
  4632. * @type int $blog_id (unused)
  4633. * @type int $post_ID
  4634. * @type string $username
  4635. * @type string $password
  4636. * }
  4637. * @return array|IXR_Error
  4638. */
  4639. public function mw_getPost( $args ) {
  4640. $this->escape( $args );
  4641. $post_ID = (int) $args[0];
  4642. $username = $args[1];
  4643. $password = $args[2];
  4644. if ( !$user = $this->login($username, $password) )
  4645. return $this->error;
  4646. $postdata = get_post($post_ID, ARRAY_A);
  4647. if ( ! $postdata )
  4648. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  4649. if ( !current_user_can( 'edit_post', $post_ID ) )
  4650. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  4651. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4652. do_action( 'xmlrpc_call', 'metaWeblog.getPost' );
  4653. if ($postdata['post_date'] != '') {
  4654. $post_date = $this->_convert_date( $postdata['post_date'] );
  4655. $post_date_gmt = $this->_convert_date_gmt( $postdata['post_date_gmt'], $postdata['post_date'] );
  4656. $post_modified = $this->_convert_date( $postdata['post_modified'] );
  4657. $post_modified_gmt = $this->_convert_date_gmt( $postdata['post_modified_gmt'], $postdata['post_modified'] );
  4658. $categories = array();
  4659. $catids = wp_get_post_categories($post_ID);
  4660. foreach ($catids as $catid)
  4661. $categories[] = get_cat_name($catid);
  4662. $tagnames = array();
  4663. $tags = wp_get_post_tags( $post_ID );
  4664. if ( !empty( $tags ) ) {
  4665. foreach ( $tags as $tag )
  4666. $tagnames[] = $tag->name;
  4667. $tagnames = implode( ', ', $tagnames );
  4668. } else {
  4669. $tagnames = '';
  4670. }
  4671. $post = get_extended($postdata['post_content']);
  4672. $link = get_permalink($postdata['ID']);
  4673. // Get the author info.
  4674. $author = get_userdata($postdata['post_author']);
  4675. $allow_comments = ('open' == $postdata['comment_status']) ? 1 : 0;
  4676. $allow_pings = ('open' == $postdata['ping_status']) ? 1 : 0;
  4677. // Consider future posts as published
  4678. if ( $postdata['post_status'] === 'future' )
  4679. $postdata['post_status'] = 'publish';
  4680. // Get post format
  4681. $post_format = get_post_format( $post_ID );
  4682. if ( empty( $post_format ) )
  4683. $post_format = 'standard';
  4684. $sticky = false;
  4685. if ( is_sticky( $post_ID ) )
  4686. $sticky = true;
  4687. $enclosure = array();
  4688. foreach ( (array) get_post_custom($post_ID) as $key => $val) {
  4689. if ($key == 'enclosure') {
  4690. foreach ( (array) $val as $enc ) {
  4691. $encdata = explode("\n", $enc);
  4692. $enclosure['url'] = trim(htmlspecialchars($encdata[0]));
  4693. $enclosure['length'] = (int) trim($encdata[1]);
  4694. $enclosure['type'] = trim($encdata[2]);
  4695. break 2;
  4696. }
  4697. }
  4698. }
  4699. $resp = array(
  4700. 'dateCreated' => $post_date,
  4701. 'userid' => $postdata['post_author'],
  4702. 'postid' => $postdata['ID'],
  4703. 'description' => $post['main'],
  4704. 'title' => $postdata['post_title'],
  4705. 'link' => $link,
  4706. 'permaLink' => $link,
  4707. // commented out because no other tool seems to use this
  4708. // 'content' => $entry['post_content'],
  4709. 'categories' => $categories,
  4710. 'mt_excerpt' => $postdata['post_excerpt'],
  4711. 'mt_text_more' => $post['extended'],
  4712. 'wp_more_text' => $post['more_text'],
  4713. 'mt_allow_comments' => $allow_comments,
  4714. 'mt_allow_pings' => $allow_pings,
  4715. 'mt_keywords' => $tagnames,
  4716. 'wp_slug' => $postdata['post_name'],
  4717. 'wp_password' => $postdata['post_password'],
  4718. 'wp_author_id' => (string) $author->ID,
  4719. 'wp_author_display_name' => $author->display_name,
  4720. 'date_created_gmt' => $post_date_gmt,
  4721. 'post_status' => $postdata['post_status'],
  4722. 'custom_fields' => $this->get_custom_fields($post_ID),
  4723. 'wp_post_format' => $post_format,
  4724. 'sticky' => $sticky,
  4725. 'date_modified' => $post_modified,
  4726. 'date_modified_gmt' => $post_modified_gmt
  4727. );
  4728. if ( !empty($enclosure) ) $resp['enclosure'] = $enclosure;
  4729. $resp['wp_post_thumbnail'] = get_post_thumbnail_id( $postdata['ID'] );
  4730. return $resp;
  4731. } else {
  4732. return new IXR_Error(404, __('Sorry, no such post.'));
  4733. }
  4734. }
  4735. /**
  4736. * Retrieve list of recent posts.
  4737. *
  4738. * @since 1.5.0
  4739. *
  4740. * @param array $args {
  4741. * Method arguments. Note: arguments must be ordered as documented.
  4742. *
  4743. * @type int $blog_id (unused)
  4744. * @type string $username
  4745. * @type string $password
  4746. * @type int $numberposts
  4747. * }
  4748. * @return array|IXR_Error
  4749. */
  4750. public function mw_getRecentPosts( $args ) {
  4751. $this->escape( $args );
  4752. $username = $args[1];
  4753. $password = $args[2];
  4754. if ( isset( $args[3] ) )
  4755. $query = array( 'numberposts' => absint( $args[3] ) );
  4756. else
  4757. $query = array();
  4758. if ( !$user = $this->login($username, $password) )
  4759. return $this->error;
  4760. if ( ! current_user_can( 'edit_posts' ) )
  4761. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit posts.' ) );
  4762. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4763. do_action( 'xmlrpc_call', 'metaWeblog.getRecentPosts' );
  4764. $posts_list = wp_get_recent_posts( $query );
  4765. if ( !$posts_list )
  4766. return array();
  4767. $recent_posts = array();
  4768. foreach ($posts_list as $entry) {
  4769. if ( !current_user_can( 'edit_post', $entry['ID'] ) )
  4770. continue;
  4771. $post_date = $this->_convert_date( $entry['post_date'] );
  4772. $post_date_gmt = $this->_convert_date_gmt( $entry['post_date_gmt'], $entry['post_date'] );
  4773. $post_modified = $this->_convert_date( $entry['post_modified'] );
  4774. $post_modified_gmt = $this->_convert_date_gmt( $entry['post_modified_gmt'], $entry['post_modified'] );
  4775. $categories = array();
  4776. $catids = wp_get_post_categories($entry['ID']);
  4777. foreach ( $catids as $catid )
  4778. $categories[] = get_cat_name($catid);
  4779. $tagnames = array();
  4780. $tags = wp_get_post_tags( $entry['ID'] );
  4781. if ( !empty( $tags ) ) {
  4782. foreach ( $tags as $tag ) {
  4783. $tagnames[] = $tag->name;
  4784. }
  4785. $tagnames = implode( ', ', $tagnames );
  4786. } else {
  4787. $tagnames = '';
  4788. }
  4789. $post = get_extended($entry['post_content']);
  4790. $link = get_permalink($entry['ID']);
  4791. // Get the post author info.
  4792. $author = get_userdata($entry['post_author']);
  4793. $allow_comments = ('open' == $entry['comment_status']) ? 1 : 0;
  4794. $allow_pings = ('open' == $entry['ping_status']) ? 1 : 0;
  4795. // Consider future posts as published
  4796. if ( $entry['post_status'] === 'future' )
  4797. $entry['post_status'] = 'publish';
  4798. // Get post format
  4799. $post_format = get_post_format( $entry['ID'] );
  4800. if ( empty( $post_format ) )
  4801. $post_format = 'standard';
  4802. $recent_posts[] = array(
  4803. 'dateCreated' => $post_date,
  4804. 'userid' => $entry['post_author'],
  4805. 'postid' => (string) $entry['ID'],
  4806. 'description' => $post['main'],
  4807. 'title' => $entry['post_title'],
  4808. 'link' => $link,
  4809. 'permaLink' => $link,
  4810. // commented out because no other tool seems to use this
  4811. // 'content' => $entry['post_content'],
  4812. 'categories' => $categories,
  4813. 'mt_excerpt' => $entry['post_excerpt'],
  4814. 'mt_text_more' => $post['extended'],
  4815. 'wp_more_text' => $post['more_text'],
  4816. 'mt_allow_comments' => $allow_comments,
  4817. 'mt_allow_pings' => $allow_pings,
  4818. 'mt_keywords' => $tagnames,
  4819. 'wp_slug' => $entry['post_name'],
  4820. 'wp_password' => $entry['post_password'],
  4821. 'wp_author_id' => (string) $author->ID,
  4822. 'wp_author_display_name' => $author->display_name,
  4823. 'date_created_gmt' => $post_date_gmt,
  4824. 'post_status' => $entry['post_status'],
  4825. 'custom_fields' => $this->get_custom_fields($entry['ID']),
  4826. 'wp_post_format' => $post_format,
  4827. 'date_modified' => $post_modified,
  4828. 'date_modified_gmt' => $post_modified_gmt,
  4829. 'sticky' => ( $entry['post_type'] === 'post' && is_sticky( $entry['ID'] ) ),
  4830. 'wp_post_thumbnail' => get_post_thumbnail_id( $entry['ID'] )
  4831. );
  4832. }
  4833. return $recent_posts;
  4834. }
  4835. /**
  4836. * Retrieve the list of categories on a given blog.
  4837. *
  4838. * @since 1.5.0
  4839. *
  4840. * @param array $args {
  4841. * Method arguments. Note: arguments must be ordered as documented.
  4842. *
  4843. * @type int $blog_id (unused)
  4844. * @type string $username
  4845. * @type string $password
  4846. * }
  4847. * @return array|IXR_Error
  4848. */
  4849. public function mw_getCategories( $args ) {
  4850. $this->escape( $args );
  4851. $username = $args[1];
  4852. $password = $args[2];
  4853. if ( !$user = $this->login($username, $password) )
  4854. return $this->error;
  4855. if ( !current_user_can( 'edit_posts' ) )
  4856. return new IXR_Error( 401, __( 'Sorry, you must be able to edit posts on this site in order to view categories.' ) );
  4857. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4858. do_action( 'xmlrpc_call', 'metaWeblog.getCategories' );
  4859. $categories_struct = array();
  4860. if ( $cats = get_categories(array('get' => 'all')) ) {
  4861. foreach ( $cats as $cat ) {
  4862. $struct = array();
  4863. $struct['categoryId'] = $cat->term_id;
  4864. $struct['parentId'] = $cat->parent;
  4865. $struct['description'] = $cat->name;
  4866. $struct['categoryDescription'] = $cat->description;
  4867. $struct['categoryName'] = $cat->name;
  4868. $struct['htmlUrl'] = esc_html(get_category_link($cat->term_id));
  4869. $struct['rssUrl'] = esc_html(get_category_feed_link($cat->term_id, 'rss2'));
  4870. $categories_struct[] = $struct;
  4871. }
  4872. }
  4873. return $categories_struct;
  4874. }
  4875. /**
  4876. * Uploads a file, following your settings.
  4877. *
  4878. * Adapted from a patch by Johann Richard.
  4879. *
  4880. * @link http://mycvs.org/archives/2004/06/30/file-upload-to-wordpress-in-ecto/
  4881. *
  4882. * @since 1.5.0
  4883. *
  4884. * @global wpdb $wpdb WordPress database abstraction object.
  4885. *
  4886. * @param array $args {
  4887. * Method arguments. Note: arguments must be ordered as documented.
  4888. *
  4889. * @type int $blog_id (unused)
  4890. * @type string $username
  4891. * @type string $password
  4892. * @type array $data
  4893. * }
  4894. * @return array|IXR_Error
  4895. */
  4896. public function mw_newMediaObject( $args ) {
  4897. global $wpdb;
  4898. $username = $this->escape( $args[1] );
  4899. $password = $this->escape( $args[2] );
  4900. $data = $args[3];
  4901. $name = sanitize_file_name( $data['name'] );
  4902. $type = $data['type'];
  4903. $bits = $data['bits'];
  4904. if ( !$user = $this->login($username, $password) )
  4905. return $this->error;
  4906. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4907. do_action( 'xmlrpc_call', 'metaWeblog.newMediaObject' );
  4908. if ( !current_user_can('upload_files') ) {
  4909. $this->error = new IXR_Error( 401, __( 'Sorry, you are not allowed to upload files.' ) );
  4910. return $this->error;
  4911. }
  4912. if ( is_multisite() && upload_is_user_over_quota( false ) ) {
  4913. $this->error = new IXR_Error( 401, __( 'Sorry, you have used your space allocation.' ) );
  4914. return $this->error;
  4915. }
  4916. /**
  4917. * Filters whether to preempt the XML-RPC media upload.
  4918. *
  4919. * Passing a truthy value will effectively short-circuit the media upload,
  4920. * returning that value as a 500 error instead.
  4921. *
  4922. * @since 2.1.0
  4923. *
  4924. * @param bool $error Whether to pre-empt the media upload. Default false.
  4925. */
  4926. if ( $upload_err = apply_filters( 'pre_upload_error', false ) ) {
  4927. return new IXR_Error( 500, $upload_err );
  4928. }
  4929. $upload = wp_upload_bits($name, null, $bits);
  4930. if ( ! empty($upload['error']) ) {
  4931. /* translators: 1: file name, 2: error message */
  4932. $errorString = sprintf( __( 'Could not write file %1$s (%2$s).' ), $name, $upload['error'] );
  4933. return new IXR_Error( 500, $errorString );
  4934. }
  4935. // Construct the attachment array
  4936. $post_id = 0;
  4937. if ( ! empty( $data['post_id'] ) ) {
  4938. $post_id = (int) $data['post_id'];
  4939. if ( ! current_user_can( 'edit_post', $post_id ) )
  4940. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  4941. }
  4942. $attachment = array(
  4943. 'post_title' => $name,
  4944. 'post_content' => '',
  4945. 'post_type' => 'attachment',
  4946. 'post_parent' => $post_id,
  4947. 'post_mime_type' => $type,
  4948. 'guid' => $upload[ 'url' ]
  4949. );
  4950. // Save the data
  4951. $id = wp_insert_attachment( $attachment, $upload[ 'file' ], $post_id );
  4952. wp_update_attachment_metadata( $id, wp_generate_attachment_metadata( $id, $upload['file'] ) );
  4953. /**
  4954. * Fires after a new attachment has been added via the XML-RPC MovableType API.
  4955. *
  4956. * @since 3.4.0
  4957. *
  4958. * @param int $id ID of the new attachment.
  4959. * @param array $args An array of arguments to add the attachment.
  4960. */
  4961. do_action( 'xmlrpc_call_success_mw_newMediaObject', $id, $args );
  4962. $struct = $this->_prepare_media_item( get_post( $id ) );
  4963. // Deprecated values
  4964. $struct['id'] = $struct['attachment_id'];
  4965. $struct['file'] = $struct['title'];
  4966. $struct['url'] = $struct['link'];
  4967. return $struct;
  4968. }
  4969. /* MovableType API functions
  4970. * specs on http://www.movabletype.org/docs/mtmanual_programmatic.html
  4971. */
  4972. /**
  4973. * Retrieve the post titles of recent posts.
  4974. *
  4975. * @since 1.5.0
  4976. *
  4977. * @param array $args {
  4978. * Method arguments. Note: arguments must be ordered as documented.
  4979. *
  4980. * @type int $blog_id (unused)
  4981. * @type string $username
  4982. * @type string $password
  4983. * @type int $numberposts
  4984. * }
  4985. * @return array|IXR_Error
  4986. */
  4987. public function mt_getRecentPostTitles( $args ) {
  4988. $this->escape( $args );
  4989. $username = $args[1];
  4990. $password = $args[2];
  4991. if ( isset( $args[3] ) )
  4992. $query = array( 'numberposts' => absint( $args[3] ) );
  4993. else
  4994. $query = array();
  4995. if ( !$user = $this->login($username, $password) )
  4996. return $this->error;
  4997. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  4998. do_action( 'xmlrpc_call', 'mt.getRecentPostTitles' );
  4999. $posts_list = wp_get_recent_posts( $query );
  5000. if ( !$posts_list ) {
  5001. $this->error = new IXR_Error(500, __('Either there are no posts, or something went wrong.'));
  5002. return $this->error;
  5003. }
  5004. $recent_posts = array();
  5005. foreach ($posts_list as $entry) {
  5006. if ( !current_user_can( 'edit_post', $entry['ID'] ) )
  5007. continue;
  5008. $post_date = $this->_convert_date( $entry['post_date'] );
  5009. $post_date_gmt = $this->_convert_date_gmt( $entry['post_date_gmt'], $entry['post_date'] );
  5010. $recent_posts[] = array(
  5011. 'dateCreated' => $post_date,
  5012. 'userid' => $entry['post_author'],
  5013. 'postid' => (string) $entry['ID'],
  5014. 'title' => $entry['post_title'],
  5015. 'post_status' => $entry['post_status'],
  5016. 'date_created_gmt' => $post_date_gmt
  5017. );
  5018. }
  5019. return $recent_posts;
  5020. }
  5021. /**
  5022. * Retrieve list of all categories on blog.
  5023. *
  5024. * @since 1.5.0
  5025. *
  5026. * @param array $args {
  5027. * Method arguments. Note: arguments must be ordered as documented.
  5028. *
  5029. * @type int $blog_id (unused)
  5030. * @type string $username
  5031. * @type string $password
  5032. * }
  5033. * @return array|IXR_Error
  5034. */
  5035. public function mt_getCategoryList( $args ) {
  5036. $this->escape( $args );
  5037. $username = $args[1];
  5038. $password = $args[2];
  5039. if ( !$user = $this->login($username, $password) )
  5040. return $this->error;
  5041. if ( !current_user_can( 'edit_posts' ) )
  5042. return new IXR_Error( 401, __( 'Sorry, you must be able to edit posts on this site in order to view categories.' ) );
  5043. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5044. do_action( 'xmlrpc_call', 'mt.getCategoryList' );
  5045. $categories_struct = array();
  5046. if ( $cats = get_categories(array('hide_empty' => 0, 'hierarchical' => 0)) ) {
  5047. foreach ( $cats as $cat ) {
  5048. $struct = array();
  5049. $struct['categoryId'] = $cat->term_id;
  5050. $struct['categoryName'] = $cat->name;
  5051. $categories_struct[] = $struct;
  5052. }
  5053. }
  5054. return $categories_struct;
  5055. }
  5056. /**
  5057. * Retrieve post categories.
  5058. *
  5059. * @since 1.5.0
  5060. *
  5061. * @param array $args {
  5062. * Method arguments. Note: arguments must be ordered as documented.
  5063. *
  5064. * @type int $post_ID
  5065. * @type string $username
  5066. * @type string $password
  5067. * }
  5068. * @return array|IXR_Error
  5069. */
  5070. public function mt_getPostCategories( $args ) {
  5071. $this->escape( $args );
  5072. $post_ID = (int) $args[0];
  5073. $username = $args[1];
  5074. $password = $args[2];
  5075. if ( !$user = $this->login($username, $password) )
  5076. return $this->error;
  5077. if ( ! get_post( $post_ID ) )
  5078. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  5079. if ( !current_user_can( 'edit_post', $post_ID ) )
  5080. return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
  5081. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5082. do_action( 'xmlrpc_call', 'mt.getPostCategories' );
  5083. $categories = array();
  5084. $catids = wp_get_post_categories(intval($post_ID));
  5085. // first listed category will be the primary category
  5086. $isPrimary = true;
  5087. foreach ( $catids as $catid ) {
  5088. $categories[] = array(
  5089. 'categoryName' => get_cat_name($catid),
  5090. 'categoryId' => (string) $catid,
  5091. 'isPrimary' => $isPrimary
  5092. );
  5093. $isPrimary = false;
  5094. }
  5095. return $categories;
  5096. }
  5097. /**
  5098. * Sets categories for a post.
  5099. *
  5100. * @since 1.5.0
  5101. *
  5102. * @param array $args {
  5103. * Method arguments. Note: arguments must be ordered as documented.
  5104. *
  5105. * @type int $post_ID
  5106. * @type string $username
  5107. * @type string $password
  5108. * @type array $categories
  5109. * }
  5110. * @return true|IXR_Error True on success.
  5111. */
  5112. public function mt_setPostCategories( $args ) {
  5113. $this->escape( $args );
  5114. $post_ID = (int) $args[0];
  5115. $username = $args[1];
  5116. $password = $args[2];
  5117. $categories = $args[3];
  5118. if ( !$user = $this->login($username, $password) )
  5119. return $this->error;
  5120. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5121. do_action( 'xmlrpc_call', 'mt.setPostCategories' );
  5122. if ( ! get_post( $post_ID ) )
  5123. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  5124. if ( !current_user_can('edit_post', $post_ID) )
  5125. return new IXR_Error(401, __('Sorry, you are not allowed to edit this post.'));
  5126. $catids = array();
  5127. foreach ( $categories as $cat ) {
  5128. $catids[] = $cat['categoryId'];
  5129. }
  5130. wp_set_post_categories($post_ID, $catids);
  5131. return true;
  5132. }
  5133. /**
  5134. * Retrieve an array of methods supported by this server.
  5135. *
  5136. * @since 1.5.0
  5137. *
  5138. * @return array
  5139. */
  5140. public function mt_supportedMethods() {
  5141. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5142. do_action( 'xmlrpc_call', 'mt.supportedMethods' );
  5143. return array_keys( $this->methods );
  5144. }
  5145. /**
  5146. * Retrieve an empty array because we don't support per-post text filters.
  5147. *
  5148. * @since 1.5.0
  5149. */
  5150. public function mt_supportedTextFilters() {
  5151. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5152. do_action( 'xmlrpc_call', 'mt.supportedTextFilters' );
  5153. /**
  5154. * Filters the MoveableType text filters list for XML-RPC.
  5155. *
  5156. * @since 2.2.0
  5157. *
  5158. * @param array $filters An array of text filters.
  5159. */
  5160. return apply_filters( 'xmlrpc_text_filters', array() );
  5161. }
  5162. /**
  5163. * Retrieve trackbacks sent to a given post.
  5164. *
  5165. * @since 1.5.0
  5166. *
  5167. * @global wpdb $wpdb WordPress database abstraction object.
  5168. *
  5169. * @param int $post_ID
  5170. * @return array|IXR_Error
  5171. */
  5172. public function mt_getTrackbackPings( $post_ID ) {
  5173. global $wpdb;
  5174. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5175. do_action( 'xmlrpc_call', 'mt.getTrackbackPings' );
  5176. $actual_post = get_post($post_ID, ARRAY_A);
  5177. if ( !$actual_post )
  5178. return new IXR_Error(404, __('Sorry, no such post.'));
  5179. $comments = $wpdb->get_results( $wpdb->prepare("SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID) );
  5180. if ( !$comments )
  5181. return array();
  5182. $trackback_pings = array();
  5183. foreach ( $comments as $comment ) {
  5184. if ( 'trackback' == $comment->comment_type ) {
  5185. $content = $comment->comment_content;
  5186. $title = substr($content, 8, (strpos($content, '</strong>') - 8));
  5187. $trackback_pings[] = array(
  5188. 'pingTitle' => $title,
  5189. 'pingURL' => $comment->comment_author_url,
  5190. 'pingIP' => $comment->comment_author_IP
  5191. );
  5192. }
  5193. }
  5194. return $trackback_pings;
  5195. }
  5196. /**
  5197. * Sets a post's publish status to 'publish'.
  5198. *
  5199. * @since 1.5.0
  5200. *
  5201. * @param array $args {
  5202. * Method arguments. Note: arguments must be ordered as documented.
  5203. *
  5204. * @type int $post_ID
  5205. * @type string $username
  5206. * @type string $password
  5207. * }
  5208. * @return int|IXR_Error
  5209. */
  5210. public function mt_publishPost( $args ) {
  5211. $this->escape( $args );
  5212. $post_ID = (int) $args[0];
  5213. $username = $args[1];
  5214. $password = $args[2];
  5215. if ( !$user = $this->login($username, $password) )
  5216. return $this->error;
  5217. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5218. do_action( 'xmlrpc_call', 'mt.publishPost' );
  5219. $postdata = get_post($post_ID, ARRAY_A);
  5220. if ( ! $postdata )
  5221. return new IXR_Error( 404, __( 'Invalid post ID.' ) );
  5222. if ( !current_user_can('publish_posts') || !current_user_can('edit_post', $post_ID) )
  5223. return new IXR_Error(401, __('Sorry, you are not allowed to publish this post.'));
  5224. $postdata['post_status'] = 'publish';
  5225. // retain old cats
  5226. $cats = wp_get_post_categories($post_ID);
  5227. $postdata['post_category'] = $cats;
  5228. $this->escape($postdata);
  5229. return wp_update_post( $postdata );
  5230. }
  5231. /* PingBack functions
  5232. * specs on www.hixie.ch/specs/pingback/pingback
  5233. */
  5234. /**
  5235. * Retrieves a pingback and registers it.
  5236. *
  5237. * @since 1.5.0
  5238. *
  5239. * @param array $args {
  5240. * Method arguments. Note: arguments must be ordered as documented.
  5241. *
  5242. * @type string $pagelinkedfrom
  5243. * @type string $pagelinkedto
  5244. * }
  5245. * @return string|IXR_Error
  5246. */
  5247. public function pingback_ping( $args ) {
  5248. global $wpdb;
  5249. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5250. do_action( 'xmlrpc_call', 'pingback.ping' );
  5251. $this->escape( $args );
  5252. $pagelinkedfrom = str_replace( '&amp;', '&', $args[0] );
  5253. $pagelinkedto = str_replace( '&amp;', '&', $args[1] );
  5254. $pagelinkedto = str_replace( '&', '&amp;', $pagelinkedto );
  5255. /**
  5256. * Filters the pingback source URI.
  5257. *
  5258. * @since 3.6.0
  5259. *
  5260. * @param string $pagelinkedfrom URI of the page linked from.
  5261. * @param string $pagelinkedto URI of the page linked to.
  5262. */
  5263. $pagelinkedfrom = apply_filters( 'pingback_ping_source_uri', $pagelinkedfrom, $pagelinkedto );
  5264. if ( ! $pagelinkedfrom )
  5265. return $this->pingback_error( 0, __( 'A valid URL was not provided.' ) );
  5266. // Check if the page linked to is in our site
  5267. $pos1 = strpos($pagelinkedto, str_replace(array('http://www.','http://','https://www.','https://'), '', get_option('home')));
  5268. if ( !$pos1 )
  5269. return $this->pingback_error( 0, __( 'Is there no link to us?' ) );
  5270. // let's find which post is linked to
  5271. // FIXME: does url_to_postid() cover all these cases already?
  5272. // if so, then let's use it and drop the old code.
  5273. $urltest = parse_url($pagelinkedto);
  5274. if ( $post_ID = url_to_postid($pagelinkedto) ) {
  5275. // $way
  5276. } elseif ( isset( $urltest['path'] ) && preg_match('#p/[0-9]{1,}#', $urltest['path'], $match) ) {
  5277. // the path defines the post_ID (archives/p/XXXX)
  5278. $blah = explode('/', $match[0]);
  5279. $post_ID = (int) $blah[1];
  5280. } elseif ( isset( $urltest['query'] ) && preg_match('#p=[0-9]{1,}#', $urltest['query'], $match) ) {
  5281. // the querystring defines the post_ID (?p=XXXX)
  5282. $blah = explode('=', $match[0]);
  5283. $post_ID = (int) $blah[1];
  5284. } elseif ( isset($urltest['fragment']) ) {
  5285. // an #anchor is there, it's either...
  5286. if ( intval($urltest['fragment']) ) {
  5287. // ...an integer #XXXX (simplest case)
  5288. $post_ID = (int) $urltest['fragment'];
  5289. } elseif ( preg_match('/post-[0-9]+/',$urltest['fragment']) ) {
  5290. // ...a post id in the form 'post-###'
  5291. $post_ID = preg_replace('/[^0-9]+/', '', $urltest['fragment']);
  5292. } elseif ( is_string($urltest['fragment']) ) {
  5293. // ...or a string #title, a little more complicated
  5294. $title = preg_replace('/[^a-z0-9]/i', '.', $urltest['fragment']);
  5295. $sql = $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_title RLIKE %s", $title );
  5296. if (! ($post_ID = $wpdb->get_var($sql)) ) {
  5297. // returning unknown error '0' is better than die()ing
  5298. return $this->pingback_error( 0, '' );
  5299. }
  5300. }
  5301. } else {
  5302. // TODO: Attempt to extract a post ID from the given URL
  5303. return $this->pingback_error( 33, __('The specified target URL cannot be used as a target. It either doesn&#8217;t exist, or it is not a pingback-enabled resource.' ) );
  5304. }
  5305. $post_ID = (int) $post_ID;
  5306. $post = get_post($post_ID);
  5307. if ( !$post ) // Post_ID not found
  5308. return $this->pingback_error( 33, __( 'The specified target URL cannot be used as a target. It either doesn&#8217;t exist, or it is not a pingback-enabled resource.' ) );
  5309. if ( $post_ID == url_to_postid($pagelinkedfrom) )
  5310. return $this->pingback_error( 0, __( 'The source URL and the target URL cannot both point to the same resource.' ) );
  5311. // Check if pings are on
  5312. if ( !pings_open($post) )
  5313. return $this->pingback_error( 33, __( 'The specified target URL cannot be used as a target. It either doesn&#8217;t exist, or it is not a pingback-enabled resource.' ) );
  5314. // Let's check that the remote site didn't already pingback this entry
  5315. if ( $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_author_url = %s", $post_ID, $pagelinkedfrom) ) )
  5316. return $this->pingback_error( 48, __( 'The pingback has already been registered.' ) );
  5317. // very stupid, but gives time to the 'from' server to publish !
  5318. sleep(1);
  5319. $remote_ip = preg_replace( '/[^0-9a-fA-F:., ]/', '', $_SERVER['REMOTE_ADDR'] );
  5320. /** This filter is documented in wp-includes/class-http.php */
  5321. $user_agent = apply_filters( 'http_headers_useragent', 'WordPress/' . get_bloginfo( 'version' ) . '; ' . get_bloginfo( 'url' ) );
  5322. // Let's check the remote site
  5323. $http_api_args = array(
  5324. 'timeout' => 10,
  5325. 'redirection' => 0,
  5326. 'limit_response_size' => 153600, // 150 KB
  5327. 'user-agent' => "$user_agent; verifying pingback from $remote_ip",
  5328. 'headers' => array(
  5329. 'X-Pingback-Forwarded-For' => $remote_ip,
  5330. ),
  5331. );
  5332. $request = wp_safe_remote_get( $pagelinkedfrom, $http_api_args );
  5333. $remote_source = $remote_source_original = wp_remote_retrieve_body( $request );
  5334. if ( ! $remote_source ) {
  5335. return $this->pingback_error( 16, __( 'The source URL does not exist.' ) );
  5336. }
  5337. /**
  5338. * Filters the pingback remote source.
  5339. *
  5340. * @since 2.5.0
  5341. *
  5342. * @param string $remote_source Response source for the page linked from.
  5343. * @param string $pagelinkedto URL of the page linked to.
  5344. */
  5345. $remote_source = apply_filters( 'pre_remote_source', $remote_source, $pagelinkedto );
  5346. // Work around bug in strip_tags():
  5347. $remote_source = str_replace( '<!DOC', '<DOC', $remote_source );
  5348. $remote_source = preg_replace( '/[\r\n\t ]+/', ' ', $remote_source ); // normalize spaces
  5349. $remote_source = preg_replace( "/<\/*(h1|h2|h3|h4|h5|h6|p|th|td|li|dt|dd|pre|caption|input|textarea|button|body)[^>]*>/", "\n\n", $remote_source );
  5350. preg_match( '|<title>([^<]*?)</title>|is', $remote_source, $matchtitle );
  5351. $title = isset( $matchtitle[1] ) ? $matchtitle[1] : '';
  5352. if ( empty( $title ) ) {
  5353. return $this->pingback_error( 32, __( 'We cannot find a title on that page.' ) );
  5354. }
  5355. $remote_source = strip_tags( $remote_source, '<a>' ); // just keep the tag we need
  5356. $p = explode( "\n\n", $remote_source );
  5357. $preg_target = preg_quote($pagelinkedto, '|');
  5358. foreach ( $p as $para ) {
  5359. if ( strpos($para, $pagelinkedto) !== false ) { // it exists, but is it a link?
  5360. preg_match("|<a[^>]+?".$preg_target."[^>]*>([^>]+?)</a>|", $para, $context);
  5361. // If the URL isn't in a link context, keep looking
  5362. if ( empty($context) )
  5363. continue;
  5364. // We're going to use this fake tag to mark the context in a bit
  5365. // the marker is needed in case the link text appears more than once in the paragraph
  5366. $excerpt = preg_replace('|\</?wpcontext\>|', '', $para);
  5367. // prevent really long link text
  5368. if ( strlen($context[1]) > 100 )
  5369. $context[1] = substr($context[1], 0, 100) . '&#8230;';
  5370. $marker = '<wpcontext>'.$context[1].'</wpcontext>'; // set up our marker
  5371. $excerpt= str_replace($context[0], $marker, $excerpt); // swap out the link for our marker
  5372. $excerpt = strip_tags($excerpt, '<wpcontext>'); // strip all tags but our context marker
  5373. $excerpt = trim($excerpt);
  5374. $preg_marker = preg_quote($marker, '|');
  5375. $excerpt = preg_replace("|.*?\s(.{0,100}$preg_marker.{0,100})\s.*|s", '$1', $excerpt);
  5376. $excerpt = strip_tags($excerpt); // YES, again, to remove the marker wrapper
  5377. break;
  5378. }
  5379. }
  5380. if ( empty($context) ) // Link to target not found
  5381. return $this->pingback_error( 17, __( 'The source URL does not contain a link to the target URL, and so cannot be used as a source.' ) );
  5382. $pagelinkedfrom = str_replace('&', '&amp;', $pagelinkedfrom);
  5383. $context = '[&#8230;] ' . esc_html( $excerpt ) . ' [&#8230;]';
  5384. $pagelinkedfrom = $this->escape( $pagelinkedfrom );
  5385. $comment_post_ID = (int) $post_ID;
  5386. $comment_author = $title;
  5387. $comment_author_email = '';
  5388. $this->escape($comment_author);
  5389. $comment_author_url = $pagelinkedfrom;
  5390. $comment_content = $context;
  5391. $this->escape($comment_content);
  5392. $comment_type = 'pingback';
  5393. $commentdata = compact(
  5394. 'comment_post_ID', 'comment_author', 'comment_author_url', 'comment_author_email',
  5395. 'comment_content', 'comment_type', 'remote_source', 'remote_source_original'
  5396. );
  5397. $comment_ID = wp_new_comment($commentdata);
  5398. /**
  5399. * Fires after a post pingback has been sent.
  5400. *
  5401. * @since 0.71
  5402. *
  5403. * @param int $comment_ID Comment ID.
  5404. */
  5405. do_action( 'pingback_post', $comment_ID );
  5406. /* translators: 1: URL of the page linked from, 2: URL of the page linked to */
  5407. return sprintf( __( 'Pingback from %1$s to %2$s registered. Keep the web talking! :-)' ), $pagelinkedfrom, $pagelinkedto );
  5408. }
  5409. /**
  5410. * Retrieve array of URLs that pingbacked the given URL.
  5411. *
  5412. * Specs on http://www.aquarionics.com/misc/archives/blogite/0198.html
  5413. *
  5414. * @since 1.5.0
  5415. *
  5416. * @global wpdb $wpdb WordPress database abstraction object.
  5417. *
  5418. * @param string $url
  5419. * @return array|IXR_Error
  5420. */
  5421. public function pingback_extensions_getPingbacks( $url ) {
  5422. global $wpdb;
  5423. /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
  5424. do_action( 'xmlrpc_call', 'pingback.extensions.getPingbacks' );
  5425. $url = $this->escape( $url );
  5426. $post_ID = url_to_postid($url);
  5427. if ( !$post_ID ) {
  5428. // We aren't sure that the resource is available and/or pingback enabled
  5429. return $this->pingback_error( 33, __( 'The specified target URL cannot be used as a target. It either doesn&#8217;t exist, or it is not a pingback-enabled resource.' ) );
  5430. }
  5431. $actual_post = get_post($post_ID, ARRAY_A);
  5432. if ( !$actual_post ) {
  5433. // No such post = resource not found
  5434. return $this->pingback_error( 32, __('The specified target URL does not exist.' ) );
  5435. }
  5436. $comments = $wpdb->get_results( $wpdb->prepare("SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID) );
  5437. if ( !$comments )
  5438. return array();
  5439. $pingbacks = array();
  5440. foreach ( $comments as $comment ) {
  5441. if ( 'pingback' == $comment->comment_type )
  5442. $pingbacks[] = $comment->comment_author_url;
  5443. }
  5444. return $pingbacks;
  5445. }
  5446. /**
  5447. * Sends a pingback error based on the given error code and message.
  5448. *
  5449. * @since 3.6.0
  5450. *
  5451. * @param int $code Error code.
  5452. * @param string $message Error message.
  5453. * @return IXR_Error Error object.
  5454. */
  5455. protected function pingback_error( $code, $message ) {
  5456. /**
  5457. * Filters the XML-RPC pingback error return.
  5458. *
  5459. * @since 3.5.1
  5460. *
  5461. * @param IXR_Error $error An IXR_Error object containing the error code and message.
  5462. */
  5463. return apply_filters( 'xmlrpc_pingback_error', new IXR_Error( $code, $message ) );
  5464. }
  5465. }