Ticket #36055: 36055.2.patch

src/wp-includes/class-wp-xmlrpc-server.php

@@ -198 +198 @@
         }
 
         /**
+         * Check if the XML-RPC is enabled before calling the method.
+         *
+         * @since 4.5.0
+         * @access public
+         */
+        public function call( $methodname, $args ) {
+                if ( 'pingback.' != substr( $methodname, 0, 9) ) {
+                        /*
+                         * Respect old get_option() filters left for back-compat when the 'enable_xmlrpc'
+                         * option was deprecated in 3.5.0. Use the 'xmlrpc_enabled' hook instead.
+                         */
+                        $enabled = apply_filters( 'pre_option_enable_xmlrpc', false );
+                        if ( false === $enabled ) {
+                                $enabled = apply_filters( 'option_enable_xmlrpc', true );
+                        }
+
+                        /**
+                         * Filter whether XML-RPC is enabled.
+                         *
+                         * This is the proper filter for turning off XML-RPC.
+                         *
+                         * @since 3.5.0
+                         *
+                         * @param bool $enabled Whether XML-RPC is enabled. Default true.
+                         */
+                        $enabled = apply_filters( 'xmlrpc_enabled', $enabled );
+
+                        if ( ! $enabled ) {
+                                return new IXR_Error( 405, sprintf( __( 'XML-RPC services are disabled on this site.' ) ) );
+                        }
+                }
+
+                return parent::call( $methodname, $args );
+        }
+
+        /**
          * Test XMLRPC API by saying, "Hello!" to client.
          *
          * @since 1.5.0
@@ -237 +273 @@
          * @return WP_User|bool WP_User object if authentication passed, false otherwise
          */
         public function login( $username, $password ) {
-                /*
-                 * Respect old get_option() filters left for back-compat when the 'enable_xmlrpc'
-                 * option was deprecated in 3.5.0. Use the 'xmlrpc_enabled' hook instead.
-                 */
-                $enabled = apply_filters( 'pre_option_enable_xmlrpc', false );
-                if ( false === $enabled ) {
-                        $enabled = apply_filters( 'option_enable_xmlrpc', true );
-                }
-
-                /**
-                 * Filter whether XML-RPC is enabled.
-                 *
-                 * This is the proper filter for turning off XML-RPC.
-                 *
-                 * @since 3.5.0
-                 *
-                 * @param bool $enabled Whether XML-RPC is enabled. Default true.
-                 */
-                $enabled = apply_filters( 'xmlrpc_enabled', $enabled );
-
-                if ( ! $enabled ) {
-                        $this->error = new IXR_Error( 405, sprintf( __( 'XML-RPC services are disabled on this site.' ) ) );
-                        return false;
-                }
-
                 if ( $this->auth_failed ) {
                         $user = new WP_Error( 'login_prevented' );
                 } else {