Changeset 16798

Timestamp:

12/08/2010 03:31:17 PM (14 years ago)

Author:

westi

Message:

Ensure that we always check the right cap when posts are added or edited.

File:

• trunk/wp-includes/class-wp-xmlrpc-server.php (modified) (5 diffs)

trunk/wp-includes/class-wp-xmlrpc-server.php

@@ -2081 +2081 @@
         $password   = $args[2];
         $content_struct = $args[3];
-        $publish     = $args[4];
+        $publish     = isset( $args[4] ) ? $args[4] : 0;
 
         if ( !$user = $this->login($username, $password) )
@@ -2087 +2087 @@
 
         do_action('xmlrpc_call', 'metaWeblog.newPost');
-
-        $cap = ( $publish ) ? 'publish_posts' : 'edit_posts';
-        $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
-        $post_type = 'post';
+        
         $page_template = '';
         if ( !empty( $content_struct['post_type'] ) ) {
             if ( $content_struct['post_type'] == 'page' ) {
-                $cap = ( $publish ) ? 'publish_pages' : 'edit_pages';
+                if ( $publish )
+                    $cap  = 'publish_pages';
+                elseif ('publish' == $content_struct['page_status'])
+                    $cap  = 'publish_pages';
+                else
+                    $cap = 'edit_pages';
                 $error_message = __( 'Sorry, you are not allowed to publish pages on this site.' );
                 $post_type = 'page';
@@ -2100 +2102 @@
                     $page_template = $content_struct['wp_page_template'];
             } elseif ( $content_struct['post_type'] == 'post' ) {
-                // This is the default, no changes needed
+                if ( $publish )
+                    $cap  = 'publish_posts';
+                elseif ('publish' == $content_struct['post_status'])
+                    $cap  = 'publish_posts';
+                else
+                    $cap = 'edit_posts';
+                $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
+                $post_type = 'post';
             } else {
                 // No other post_type values are allowed here
                 return new IXR_Error( 401, __( 'Invalid post type.' ) );
             }
+        } else {
+            if ( $publish )
+                $cap  = 'publish_posts';
+            elseif ('publish' == $content_struct['post_status'])
+                $cap  = 'publish_posts';
+            else
+                $cap = 'edit_posts';
+            $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
+            $post_type = 'post';            
         }
 
@@ -2382 +2400 @@
         if ( !empty( $content_struct['post_type'] ) ) {
             if ( $content_struct['post_type'] == 'page' ) {
-                $cap = ( $publish ) ? 'publish_pages' : 'edit_pages';
+                if ( $publish )
+                    $cap  = 'publish_pages';
+                elseif ('publish' == $content_struct['page_status'])
+                    $cap  = 'publish_pages';
+                else
+                    $cap = 'edit_pages';
                 $error_message = __( 'Sorry, you are not allowed to publish pages on this site.' );
                 $post_type = 'page';
@@ -2388 +2411 @@
                     $page_template = $content_struct['wp_page_template'];
             } elseif ( $content_struct['post_type'] == 'post' ) {
-                // This is the default, no changes needed
+                if ( $publish )
+                    $cap  = 'publish_posts';
+                elseif ('publish' == $content_struct['post_status'])
+                    $cap  = 'publish_posts';
+                else
+                    $cap = 'edit_posts';
+                $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
+                $post_type = 'post';
             } else {
                 // No other post_type values are allowed here
                 return new IXR_Error( 401, __( 'Invalid post type.' ) );
             }
+        } else {
+            if ( $publish )
+                $cap  = 'publish_posts';
+            elseif ('publish' == $content_struct['post_status'])
+                $cap  = 'publish_posts';
+            else
+                $cap = 'edit_posts';
+            $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
+            $post_type = 'post';            
         }