Ticket #20336: 20336.diff

wp-includes/class-wp-xmlrpc-server.php

@@ -1760 +1760 @@
                         return $this->error;
                 }
 
+                $page = get_page($page_id);
+                if ( ! $page )
+                        return new IXR_Error( 404, __( 'Invalid post ID.' ) );
+
                 if ( !current_user_can( 'edit_page', $page_id ) )
                         return new IXR_Error( 401, __( 'Sorry, you cannot edit this page.' ) );
 
                 do_action('xmlrpc_call', 'wp.getPage');
 
-                // Lookup page info.
-                $page = get_page($page_id);
-
                 // If we found the page then format the data.
                 if ( $page->ID && ($page->post_type == 'page') ) {
                         // Get all of the page content and link.
@@ -3208 +3209 @@
                 if ( !$user = $this->login($username, $password) )
                         return $this->error;
 
+                $post_data = wp_get_single_post($post_ID, ARRAY_A);
+                if ( ! $post_data )
+                        return new IXR_Error( 404, __( 'Invalid post ID.' ) );
+                        
                 if ( !current_user_can( 'edit_post', $post_ID ) )
                         return new IXR_Error( 401, __( 'Sorry, you cannot edit this post.' ) );
 
                 do_action('xmlrpc_call', 'blogger.getPost');
 
-                $post_data = wp_get_single_post($post_ID, ARRAY_A);
-
                 $categories = implode(',', wp_get_post_categories($post_ID));
 
                 $content  = '<title>'.stripslashes($post_data['post_title']).'</title>';
@@ -4158 +4161 @@
                 if ( !$user = $this->login($username, $password) )
                         return $this->error;
 
+                $postdata = wp_get_single_post($post_ID, ARRAY_A);
+                if ( ! $postdata )
+                        return new IXR_Error( 404, __( 'Invalid post ID.' ) );
+
                 if ( !current_user_can( 'edit_post', $post_ID ) )
                         return new IXR_Error( 401, __( 'Sorry, you cannot edit this post.' ) );
 
                 do_action('xmlrpc_call', 'metaWeblog.getPost');
 
-                $postdata = wp_get_single_post($post_ID, ARRAY_A);
-
                 if ($postdata['post_date'] != '') {
                         $post_date = $this->_convert_date( $postdata['post_date'] );
                         $post_date_gmt = $this->_convert_date_gmt( $postdata['post_date_gmt'],  $postdata['post_date'] );
@@ -4626 +4631 @@
                 if ( !$user = $this->login($username, $password) )
                         return $this->error;
 
+                if ( ! get_post( $post_ID ) )
+                        return new IXR_Error( 404, __( 'Invalid post ID.' ) );
+
                 if ( !current_user_can( 'edit_post', $post_ID ) )
                         return new IXR_Error( 401, __( 'Sorry, you can not edit this post.' ) );
 
@@ -4669 +4677 @@
 
                 do_action('xmlrpc_call', 'mt.setPostCategories');
 
+                if ( ! get_post( $post_ID ) )
+                        return new IXR_Error( 404, __( 'Invalid post ID.' ) );
+
                 if ( !current_user_can('edit_post', $post_ID) )
                         return new IXR_Error(401, __('Sorry, you cannot edit this post.'));
 
@@ -4776 +4787 @@
 
                 do_action('xmlrpc_call', 'mt.publishPost');
 
+                $postdata = wp_get_single_post($post_ID,ARRAY_A);
+                if ( ! $postdata )
+                        return new IXR_Error( 404, __( 'Invalid post ID.' ) );
+
                 if ( !current_user_can('publish_posts') || !current_user_can('edit_post', $post_ID) )
                         return new IXR_Error(401, __('Sorry, you cannot publish this post.'));
 
-                $postdata = wp_get_single_post($post_ID,ARRAY_A);
-
                 $postdata['post_status'] = 'publish';
 
                 // retain old cats