Ticket #18429: wp.newPost.11.patch

class-wp-xmlrpc-server.php

@@ -596 +596 @@
 
                 do_action( 'xmlrpc_call', 'wp.newPost' );
 
-                unset( $content_struct['ID'] );
-
-                return $this->_wp_insertPost( $user, $content_struct );
-        }
-
-        /*
-         * Helper method for filtering out elements from an array.
-         */
-        function _is_greater_than_one( $count ){
-                return $count > 1;
-        }
-
-        /*
-         * Helper method for wp_newPost and wp_editPost, containing shared logic.
-         */
-        function _wp_insertPost( $user, $content_struct ) {
-                $defaults = array( 'post_status' => 'draft', 'post_type' => 'post', 'post_author' => 0,
-                        'post_password' => '', 'post_excerpt' => '', 'post_content' => '', 'post_title' => '', 'sticky' => 0 );
-
-                $post_data = wp_parse_args( $content_struct, $defaults );
-
-                $post_type = get_post_type_object( $post_data['post_type'] );
+                $post_type = get_post_type_object( $content_struct['post_type'] );
                 if( ! ( (bool) $post_type ) )
                         return new IXR_Error( 403, __( 'Invalid post type' ) );
 
                 if( ! current_user_can( $post_type->cap->edit_posts ) )
                         return new IXR_Error( 401, __( 'Sorry, you are not allowed to post on this site.' ) );
 
-                switch ( $post_data['post_status'] ) {
+                switch ( $content_struct['post_status'] ) {
                         case 'draft':
                         case 'pending':
                                 break;
@@ -638 +617 @@
                                         return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish posts in this post type' ));
                                 break;
                         default:
-                                $post_data['post_status'] = 'draft';
+                                $content_struct['post_status'] = 'draft';
                         break;
                 }
 
-                if ( ! empty( $post_data['post_password'] ) && ! current_user_can( $post_type->cap->publish_posts ) )
+                if ( ! empty( $content_struct['post_password'] ) && ! current_user_can( $post_type->cap->publish_posts ) )
                         return new IXR_Error( 401, __( 'Sorry, you are not allowed to create password protected posts in this post type' ) );
 
+                unset( $content_struct['ID'] );
 
+                return $this->_wp_insertPost( $user, $content_struct );
+        }
+
+        /*
+         * Helper method for filtering out elements from an array.
+         */
+        function _is_greater_than_one( $count ){
+                return $count > 1;
+        }
+
+        /*
+         * Helper method for wp_newPost and wp_editPost, containing shared logic.
+         */
+        function _wp_insertPost( $user, $content_struct ) {
+                $defaults = array( 'post_status' => 'draft', 'post_type' => 'post', 'post_author' => 0,
+                        'post_password' => '', 'post_excerpt' => '', 'post_content' => '', 'post_title' => '', 'sticky' => 0 );
+
+                $post_data = wp_parse_args( $content_struct, $defaults );
+
                 $post_data['post_author'] = absint( $post_data['post_author'] );
                 if( ! empty( $post_data['post_author'] ) && $post_data['post_author'] != $user->ID ) {
                         if( ! current_user_can( $post_type->cap->edit_others_posts ) )
@@ -852 +851 @@
 
                 do_action( 'xmlrpc_call', 'wp.editPost' );
 
-                // User Capabilities are checked in _wp_insertPost.
-
                 $post = get_post( $post_id, ARRAY_A );
-
                 if ( empty( $post["ID"] ) )
                         return new IXR_Error( 404, __( 'Invalid post ID.' ) );
 
@@ -872 +868 @@
                 $this->escape( $post );
                 $merged_content_struct = array_merge( $post, $content_struct );
 
+                $post_type = get_post_type_object( $merged_content_struct['post_type'] );
+                if( ! ( (bool) $post_type ) )
+                        return new IXR_Error( 403, __( 'Invalid post type' ) );
+
+                if( ! current_user_can( $post_type->cap->edit_post, $post_id ) )
+                        return new IXR_Error( 401, __( 'Sorry, you are not allowed to post on this site.' ) );
+
+                switch ( $merged_content_struct['post_status'] ) {
+                        case 'draft':
+                        case 'pending':
+                                break;
+                        case 'private':
+                                if( ! current_user_can( $post_type->cap->publish_post, $post_id ) )
+                                        return new IXR_Error( 401, __( 'Sorry, you are not allowed to create private posts in this post type' ));
+                                break;
+                        case 'publish':
+                        case 'future':
+                                if( ! current_user_can( $post_type->cap->publish_post, $post_id ) )
+                                        return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish posts in this post type' ));
+                                break;
+                        default:
+                                $post_data['post_status'] = 'draft';
+                        break;
+                }
+
+                if ( ! empty( $merged_content_struct['post_password'] ) && ! current_user_can( $post_type->cap->publish_post, $post_id ) )
+                        return new IXR_Error( 401, __( 'Sorry, you are not allowed to create password protected posts in this post type' ) );
+
                 $retval = $this->_wp_insertPost( $user, $merged_content_struct );
                 if ( $retval instanceof IXR_Error )
                         return $retval;