Ticket #18428: 18428.combo.2.patch

wp-includes/class-wp-xmlrpc-server.php

@@ -48 +48 @@
                         'wp.getTerms'                   => 'this:wp_getTerms',
                         'wp.getTaxonomy'                => 'this:wp_getTaxonomy',
                         'wp.getTaxonomies'              => 'this:wp_getTaxonomies',
+                        'wp.newUser'                    => 'this:wp_newUser',
+                        'wp.editUser'                   => 'this:wp_editUser',
+                        'wp.deleteUser'                 => 'this:wp_deleteUser',
+                        'wp.getUser'                    => 'this:wp_getUser',
+                        'wp.getUsers'                   => 'this:wp_getUsers',
+                        'wp.getUserInfo'                => 'this:wp_getUserInfo',
                         'wp.getPage'                    => 'this:wp_getPage',
                         'wp.getPages'                   => 'this:wp_getPages',
                         'wp.newPage'                    => 'this:wp_newPage',
@@ -873 +879 @@
         }
 
         /**
+         * Prepares user data for return in an XML-RPC object.
+         *
+         * @access protected
+         *
+         * @param WP_User $user The unprepared user object
+         * @param array $fields The subset of user fields to return
+         * @return array The prepared user data
+         */
+        protected function _prepare_user( $user, $fields ) {
+                $contact_methods = _wp_get_user_contactmethods();
+
+                $user_contacts = array();
+                foreach ( $contact_methods as $key => $value ) {
+                        $user_contacts[$key] = $user->$key;
+                }
+
+                $_user = array( 'user_id' => strval( $user->ID ) );
+
+                $user_fields = array(
+                        'username'          => $user->user_login,
+                        'first_name'        => $user->user_firstname,
+                        'last_name'         => $user->user_lastname,
+                        'registered'        => $this->_convert_date( $user->user_registered ),
+                        'bio'               => $user->user_description,
+                        'email'             => $user->user_email,
+                        'nickname'          => $user->nickname,
+                        'nicename'          => $user->user_nicename,
+                        'url'               => $user->user_url,
+                        'display_name'      => $user->display_name,
+                        'capabilities'      => $user->caps,
+                        'roles'             => $user->roles,
+                        'user_contacts'     => $user_contacts
+                );
+
+                if ( in_array( 'all', $fields ) ) {
+                        $_user = array_merge( $_user, $user_fields );
+                }
+                else {
+                        if ( in_array( 'basic', $fields ) ) {
+                                $basic_fields = array( 'username', 'email', 'registered', 'display_name', 'nicename' );
+                                $fields = array_merge( $fields, $basic_fields );
+                        }
+                        $requested_fields = array_intersect_key( $user_fields, array_flip( $fields ) );
+                        $_user = array_merge( $_user, $requested_fields );
+                }
+
+                return apply_filters( 'xmlrpc_prepare_user', $_user, $user, $fields );
+        }
+
+        /**
          * Create a new post for any registered post type.
          *
          * @since 3.4.0
@@ -1920 +1976 @@
         }
 
         /**
+         * Create a new user.
+         *
+         * @uses wp_insert_user()
+         * @param array $args Method parameters. Contains:
+         *  - int     $blog_id
+         *  - string  $username
+         *  - string  $password
+         *  - array   $content_struct
+         *      The $content_struct must contain:
+         *      - 'username'
+         *      - 'password'
+         *      - 'email'
+         *      Also, it can optionally contain:
+         *      - 'role'
+         *      - 'first_name'
+         *      - 'last_name'
+         *      - 'url'
+         *      - 'display_name'
+         *      - 'nickname'
+         *      - 'nicename'
+         *      - 'bio'
+         *  - boolean $send_mail optional. Defaults to false
+         * @return int user_id
+         */
+        function wp_newUser( $args ) {
+                if ( ! $this->minimum_args( $args, 4 ) )
+                        return $this->error;
+
+                $this->escape( $args );
+
+                $blog_id        = (int) $args[0];
+                $username       = $args[1];
+                $password       = $args[2];
+                $content_struct = $args[3];
+                $send_mail      = isset( $args[4] ) ? $args[4] : false;
+
+                if ( ! $user = $this->login( $username, $password ) )
+                        return $this->error;
+
+                do_action( 'xmlrpc_call', 'wp.newUser' );
+
+                if ( ! current_user_can( 'create_users' ) )
+                        return new IXR_Error( 401, __( 'You are not allowed to create users.' ) );
+
+                // this hold all the user data
+                $user_data = array();
+
+                if ( empty( $content_struct['username'] ) )
+                        return new IXR_Error( 403, __( 'Username cannot be empty.' ) );
+                $user_data['user_login'] = $content_struct['username'];
+
+                if ( empty( $content_struct['password'] ) )
+                        return new IXR_Error( 403, __( 'Password cannot be empty.' ) );
+                $user_data['user_pass'] = $content_struct['password'];
+
+                if ( empty( $content_struct['email'] ) )
+                        return new IXR_Error( 403, __( 'Email cannot be empty.' ) );
+
+                if ( ! is_email( $content_struct['email'] ) )
+                        return new IXR_Error( 403, __( 'This email address is not valid.' ) );
+
+                if ( email_exists( $content_struct['email'] ) )
+                        return new IXR_Error( 403, __( 'This email address is already registered.' ) );
+
+                $user_data['user_email'] = $content_struct['email'];
+
+                if ( isset( $content_struct['role'] ) ) {
+                        if ( get_role( $content_struct['role'] ) === null )
+                                return new IXR_Error( 403, __( 'The role specified is not valid.' ) );
+
+                        $user_data['role'] = $content_struct['role'];
+                }
+
+                if ( isset( $content_struct['first_name'] ) )
+                        $user_data['first_name'] = $content_struct['first_name'];
+
+                if ( isset( $content_struct['last_name'] ) )
+                        $user_data['last_name'] = $content_struct['last_name'];
+
+                if ( isset( $content_struct['url'] ) )
+                        $user_data['user_url'] = $content_struct['url'];
+
+                if ( isset( $content_struct['display_name'] ) )
+                        $user_data['display_name'] = $content_struct['display_name'];
+
+                if ( isset( $content_struct['nickname'] ) )
+                        $user_data['nickname'] = $content_struct['nickname'];
+
+                if ( isset( $content_struct['nicename'] ) )
+                        $user_data['user_nicename'] = $content_struct['nicename'];
+
+                if ( isset( $content_struct['bio'] ) )
+                        $user_data['description'] = $content_struct['bio'];
+
+                $user_id = wp_insert_user( $user_data );
+
+                if ( is_wp_error( $user_id ) )
+                        return new IXR_Error( 500, $user_id->get_error_message() );
+
+                if ( ! $user_id )
+                        return new IXR_Error( 500, __( 'Sorry, the new user creation failed.' ) );
+
+                if ( $send_mail ) {
+                        wp_new_user_notification( $user_id, $user_data['user_pass'] );
+                }
+
+                return $user_id;
+        }
+
+        /**
+         * Edit a user.
+         *
+         * @uses wp_update_user()
+         * @param array $args Method parameters. Contains:
+         *  - int     $blog_id
+         *  - string  $username
+         *  - string  $password
+         *  - int     $user_id
+         *  - array   $content_struct
+         *      It can optionally contain:
+         *      - 'email'
+         *      - 'first_name'
+         *      - 'last_name'
+         *      - 'website'
+         *      - 'role'
+         *      - 'display_name'
+         *      - 'nickname'
+         *      - 'nicename'
+         *      - 'bio'
+         *      - 'usercontacts'
+         *      - 'password'
+         *  - boolean $send_mail optional. Defaults to false
+         * @return bool True, on success.
+         */
+        function wp_editUser( $args ) {
+                if ( ! $this->minimum_args( $args, 5 ) )
+                        return $this->error;
+
+                $this->escape( $args );
+
+                $blog_id        = (int) $args[0];
+                $username       = $args[1];
+                $password       = $args[2];
+                $user_id        = (int) $args[3];
+                $content_struct = $args[4];
+
+                if ( ! $user = $this->login( $username, $password ) )
+                        return $this->error;
+
+                do_action( 'xmlrpc_call', 'wp.editUser' );
+
+                $user_info = get_userdata( $user_id );
+
+                if ( ! $user_info )
+                        return new IXR_Error( 404, __( 'Invalid user ID.' ) );
+
+                if ( ! ( $user_id == $user->ID || current_user_can( 'edit_user', $user_id ) ) )
+                        return new IXR_Error( 401, __( 'Sorry, you cannot edit this user.' ) );
+
+                // holds data of the user
+                $user_data = array();
+                $user_data['ID'] = $user_id;
+
+                if ( isset( $content_struct['username'] ) && $content_struct['username'] !== $user_info->user_login )
+                        return new IXR_Error( 401, __( 'Username cannot be changed.' ) );
+
+                if ( isset( $content_struct['email'] ) ) {
+                        if ( ! is_email( $content_struct['email'] ) )
+                                return new IXR_Error( 403, __( 'This email address is not valid.' ) );
+
+                        // check whether it is already registered
+                        if ( $content_struct['email'] !== $user_info->user_email && email_exists( $content_struct['email'] ) )
+                                return new IXR_Error( 403, __( 'This email address is already registered.' ) );
+
+                        $user_data['user_email'] = $content_struct['email'];
+                }
+
+                if ( isset( $content_struct['role'] ) ) {
+                        if ( ! current_user_can( 'edit_users' ) )
+                                return new IXR_Error( 401, __( 'You are not allowed to change roles for this user.' ) );
+
+                        if ( get_role( $content_struct['role'] ) === null )
+                                return new IXR_Error( 403, __( 'The role specified is not valid' ) );
+
+                        $user_data['role'] = $content_struct['role'];
+                }
+
+                // only set the user details if it was given
+                if ( isset( $content_struct['first_name'] ) )
+                        $user_data['first_name'] = $content_struct['first_name'];
+
+                if ( isset( $content_struct['last_name'] ) )
+                        $user_data['last_name'] = $content_struct['last_name'];
+
+                if ( isset( $content_struct['website'] ) )
+                        $user_data['user_url'] = $content_struct['url'];
+
+                if ( isset( $content_struct['display_name'] ) )
+                        $user_data['display_name'] = $content_struct['display_name'];
+
+                if ( isset( $content_struct['nickname'] ) )
+                        $user_data['nickname'] = $content_struct['nickname'];
+
+                if ( isset( $content_struct['nicename'] ) )
+                        $user_data['user_nicename'] = $content_struct['nicename'];
+
+                if ( isset( $content_struct['bio'] ) )
+                        $user_data['description'] = $content_struct['bio'];
+
+                if ( isset( $content_struct['user_contacts'] ) ) {
+                        $user_contacts = _wp_get_user_contactmethods( $user_data );
+                        foreach ( $content_struct['user_contacts'] as $key => $value ) {
+                                if ( ! array_key_exists( $key, $user_contacts ) )
+                                        return new IXR_Error( 403, __( 'One of the contact method specified is not valid' ) );
+
+                                $user_data[ $key ] = $value;
+                        }
+                }
+
+                if ( isset ( $content_struct['password'] ) )
+                        $user_data['user_pass'] = $content_struct['password'];
+
+                $result = wp_update_user( $user_data );
+
+                if ( is_wp_error( $result ) )
+                        return new IXR_Error( 500, $result->get_error_message() );
+
+                if ( ! $result )
+                        return new IXR_Error( 500, __( 'Sorry, the user cannot be updated.' ) );
+
+                return true;
+        }
+
+        /**
+         * Delete a user.
+         *
+         * @uses wp_delete_user()
+         * @param array $args Method parameters. Contains:
+         *  - int     $blog_id
+         *  - string  $username
+         *  - string  $password
+         *  - int     $user_id
+         *  - int     $reassign_id (optional)
+         * @return True when user is deleted.
+         */
+        function wp_deleteUser( $args ) {
+                if ( ! $this->minimum_args( $args, 4 ) )
+                        return $this->error;
+
+                $this->escape( $args );
+
+                $blog_id    = (int) $args[0];
+                $username   = $args[1];
+                $password   = $args[2];
+                $user_id    = (int) $args[3];
+
+                if ( ! $user = $this->login( $username, $password ) )
+                        return $this->error;
+
+                do_action( 'xmlrpc_call', 'wp.deleteUser' );
+
+                if ( ! current_user_can( 'delete_users' ) )
+                        return new IXR_Error( 401, __( 'You are not allowed to delete users.' ) );
+
+                if ( ! get_userdata( $user_id ) )
+                        return new IXR_Error( 404, __( 'Invalid user ID.' ) );
+
+                if ( $user->ID == $user_id )
+                        return new IXR_Error( 401, __( 'You cannot delete yourself.' ) );
+
+                $reassign_id = 'novalue';
+                if ( isset( $args[4] ) ) {
+                        $reassign_id = (int) $args[4];
+
+                        if ( ! get_userdata( $reassign_id ) )
+                                return new IXR_Error( 404, __( 'Invalid reassign user ID.' ) );
+
+                        if ( $reassign_id === $user_id )
+                                return new IXR_Error( 401, __( 'You cannot reassign to the user being deleted.' ) );
+                }
+
+                return wp_delete_user( $user_id, $reassign_id );
+        }
+
+        /**
+         * Retrieve a user.
+         *
+         * The optional $fields parameter specifies what fields will be included
+         * in the response array. This should be a list of field names. 'user_id' will
+         * always be included in the response regardless of the value of $fields.
+         *
+         * Instead of, or in addition to, individual field names, conceptual group
+         * names can be used to specify multiple fields. The available conceptual
+         * groups are 'basic' and 'all'.
+         *
+         * @uses get_userdata()
+         * @param array $args Method parameters. Contains:
+         *  - int     $blog_id
+         *  - string  $username
+         *  - string  $password
+         *  - int     $user_id
+         *  - array   $fields optional
+         * @return array contains (based on $fields parameter):
+         *  - 'user_id'
+         *  - 'username'
+         *  - 'first_name'
+         *  - 'last_name'
+         *  - 'registered'
+         *  - 'bio'
+         *  - 'email'
+         *  - 'nickname'
+         *  - 'nicename'
+         *  - 'url'
+         *  - 'display_name'
+         *  - 'capabilities'
+         *  - 'user_level'
+         *  - 'user_contacts'
+         */
+        function wp_getUser( $args ) {
+                if ( ! $this->minimum_args( $args, 4 ) )
+                        return $this->error;
+
+                $this->escape( $args );
+
+                $blog_id    = (int) $args[0];
+                $username   = $args[1];
+                $password   = $args[2];
+                $user_id    = (int) $args[3];
+
+                if ( isset( $args[4] ) )
+                        $fields = $args[4];
+                else
+                        $fields = apply_filters( 'xmlrpc_default_user_fields', array( 'all' ), 'wp.getUser' );
+
+                if ( ! $user = $this->login( $username, $password ) )
+                        return $this->error;
+
+                do_action( 'xmlrpc_call', 'wp.getUser' );
+
+                if ( ! ( $user_id == $user->ID || current_user_can( 'edit_user', $user_id ) ) )
+                        return new IXR_Error( 401, __( 'Sorry, you cannot edit users.' ) );
+
+                $user_data = get_userdata( $user_id );
+
+                if ( ! $user_data )
+                        return new IXR_Error( 404, __( 'Invalid user ID' ) );
+
+                return $this->_prepare_user( $user_data, $fields );
+        }
+
+        /**
+         * Retrieve users.
+         *
+         * The optional $filter parameter modifies the query used to retrieve users.
+         * Accepted keys are 'number' (default: 50), 'offset' (default: 0), 'role',
+         * 'orderby', and 'order'.
+         *
+         * The optional $fields parameter specifies what fields will be included
+         * in the response array.
+         *
+         * @uses get_users()
+         * @see wp_getUser() for more on $fields and return values
+         *
+         * @param array $args Method parameters. Contains:
+         *  - int     $blog_id
+         *  - string  $username
+         *  - string  $password
+         *  - array   $filter optional
+         *  - array   $fields optional
+         * @return array users data
+         */
+        function wp_getUsers( $args ) {
+                if ( ! $this->minimum_args( $args, 3 ) )
+                        return $this->error;
+
+                $this->escape( $args );
+
+                $blog_id    = (int) $args[0];
+                $username   = $args[1];
+                $password   = $args[2];
+                $filter     = isset( $args[3] ) ? $args[3] : array();
+
+                if ( isset( $args[4] ) )
+                        $fields = $args[4];
+                else
+                        $fields = apply_filters( 'xmlrpc_default_user_fields', array( 'all' ), 'wp.getUsers' );
+
+                if ( ! $user = $this->login( $username, $password ) )
+                        return $this->error;
+
+                do_action( 'xmlrpc_call', 'wp.getUsers' );
+
+                if ( ! current_user_can( 'edit_users' ) )
+                        return new IXR_Error( 401, __( 'Sorry, you cannot edit users.' ) );
+
+                $query = array();
+
+                $query['number'] = ( isset( $filter['number'] ) ) ? absint( $filter['number'] ) : 50;
+                $query['offset'] = ( isset( $filter['offset'] ) ) ? absint( $filter['offset'] ) : 0;
+
+                if ( isset( $filter['orderby'] ) ) {
+                        $query['orderby'] = $filter['orderby'];
+
+                        if ( isset( $filter['order'] ) )
+                                $query['order'] = $filter['order'];
+                }
+
+                if ( isset( $filter['role'] ) ) {
+                        if ( $filter['role'] == 'authors' ) {
+                                $query['who'] = 'authors';
+                        }
+                        else {
+                                if ( get_role( $filter['role'] ) === null )
+                                        return new IXR_Error( 403, __( 'The role specified is not valid' ) );
+
+                                $query['role'] = $filter['role'];
+                        }
+                }
+
+                $users = get_users( $query );
+
+                $_users = array();
+                foreach ( $users as $user_data ) {
+                        if ( current_user_can( 'edit_user', $user_data->ID ) )
+                                $_users[] = $this->_prepare_user( $user_data, $fields );
+                }
+                return $_users;
+        }
+
+        /**
+         * Retrieve information about the requesting user.
+         *
+         * @uses get_userdata()
+         * @param array $args Method parameters. Contains:
+         *  - int     $blog_id
+         *  - string  $username
+         *  - string  $password
+         *  - array   $fields optional
+         * @return array (@see wp_getUser)
+         */
+        function wp_getUserInfo( $args ) {
+                if ( ! $this->minimum_args( $args, 3 ) )
+                        return $this->error;
+
+                $this->escape( $args );
+
+                $blog_id    = (int) $args[0];
+                $username   = $args[1];
+                $password   = $args[2];
+
+                if ( isset( $args[3] ) )
+                        $fields = $args[3];
+                else
+                        $fields = apply_filters( 'xmlrpc_default_user_fields', array( 'all' ), 'wp.getUserInfo' );
+
+                if ( ! $user = $this->login( $username, $password ) )
+                        return $this->error;
+
+                do_action( 'xmlrpc_call', 'wp.getUserInfo' );
+
+                $user_data = get_userdata( $user->ID );
+
+                return $this->_prepare_user( $user_data, $fields );
+        }
+
+        /**
          * Retrieve page.
          *
          * @since 2.2.0