Changeset 16803 for branches/3.0/xmlrpc.php

Timestamp:

12/08/2010 05:50:05 PM (14 years ago)

Author:

westi

Message:

Improve the capabilites checking in the XMLRPC code.

File:

• branches/3.0/xmlrpc.php (modified) (10 diffs)

branches/3.0/xmlrpc.php

@@ -1157 +1157 @@
         do_action('xmlrpc_call', 'wp.deleteComment');
 
-        if ( ! get_comment($comment_ID) )
+        if ( !$comment = get_comment( $comment_ID ) )
             return new IXR_Error( 404, __( 'Invalid comment ID.' ) );
+
+        if ( !current_user_can( 'edit_post', $comment->comment_post_ID ) )
+            return new IXR_Error( 403, __( 'You are not allowed to moderate comments on this site.' ) );
 
         return wp_delete_comment($comment_ID);
@@ -1185 +1188 @@
         if ( !current_user_can( 'moderate_comments' ) )
             return new IXR_Error( 403, __( 'You are not allowed to moderate comments on this site.' ) );
+            
+        if ( !$comment = get_comment( $comment_ID ) )
+            return new IXR_Error( 404, __( 'Invalid comment ID.' ) );
+
+        if ( !current_user_can( 'edit_post', $comment->comment_post_ID ) )
+            return new IXR_Error( 403, __( 'You are not allowed to moderate comments on this site.' ) );
 
         do_action('xmlrpc_call', 'wp.editComment');
-
-        if ( ! get_comment($comment_ID) )
-            return new IXR_Error( 404, __( 'Invalid comment ID.' ) );
 
         if ( isset($content_struct['status']) ) {
@@ -1418 +1424 @@
             return $this->error;
 
-        if ( !current_user_can( 'edit_posts' ) )
+        if ( !current_user_can( 'edit_pages' ) )
             return new IXR_Error( 403, __( 'You are not allowed access to details about this site.' ) );
 
@@ -1958 +1964 @@
             return new IXR_Error(404, __('Sorry, no such post.'));
 
-        if ( !current_user_can('edit_post', $post_ID) )
+        if ( !current_user_can('delete_post', $post_ID) )
             return new IXR_Error(401, __('Sorry, you do not have the right to delete this post.'));
 
@@ -1988 +1994 @@
         $password   = $args[2];
         $content_struct = $args[3];
-        $publish     = $args[4];
+        $publish     = isset( $args[4] ) ? $args[4] : 0;
 
         if ( !$user = $this->login($username, $password) )
@@ -1994 +2000 @@
 
         do_action('xmlrpc_call', 'metaWeblog.newPost');
-
-        $cap = ( $publish ) ? 'publish_posts' : 'edit_posts';
-        $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
-        $post_type = 'post';
+        
         $page_template = '';
         if ( !empty( $content_struct['post_type'] ) ) {
             if ( $content_struct['post_type'] == 'page' ) {
-                $cap = ( $publish ) ? 'publish_pages' : 'edit_pages';
+                if ( $publish || 'publish' == $content_struct['page_status'])
+                    $cap  = 'publish_pages';
+                else
+                    $cap = 'edit_pages';
                 $error_message = __( 'Sorry, you are not allowed to publish pages on this site.' );
                 $post_type = 'page';
@@ -2007 +2013 @@
                     $page_template = $content_struct['wp_page_template'];
             } elseif ( $content_struct['post_type'] == 'post' ) {
-                // This is the default, no changes needed
+                if ( $publish || 'publish' == $content_struct['post_status'])
+                    $cap  = 'publish_posts';
+                else
+                    $cap = 'edit_posts';
+                $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
+                $post_type = 'post';
             } else {
                 // No other post_type values are allowed here
                 return new IXR_Error( 401, __( 'Invalid post type.' ) );
             }
+        } else {
+            if ( $publish || 'publish' == $content_struct['post_status'])
+                $cap  = 'publish_posts';
+            else
+                $cap = 'edit_posts';
+            $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
+            $post_type = 'post';            
         }
 
@@ -2276 +2294 @@
         if ( !empty( $content_struct['post_type'] ) ) {
             if ( $content_struct['post_type'] == 'page' ) {
-                $cap = ( $publish ) ? 'publish_pages' : 'edit_pages';
+                if ( $publish || 'publish' == $content_struct['page_status'] )
+                    $cap  = 'publish_pages';
+                else
+                    $cap = 'edit_pages';
                 $error_message = __( 'Sorry, you are not allowed to publish pages on this site.' );
                 $post_type = 'page';
@@ -2282 +2303 @@
                     $page_template = $content_struct['wp_page_template'];
             } elseif ( $content_struct['post_type'] == 'post' ) {
-                // This is the default, no changes needed
+                if ( $publish || 'publish' == $content_struct['post_status'] )
+                    $cap  = 'publish_posts';
+                else
+                    $cap = 'edit_posts';
+                $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
+                $post_type = 'post';
             } else {
                 // No other post_type values are allowed here
                 return new IXR_Error( 401, __( 'Invalid post type.' ) );
             }
+        } else {
+            if ( $publish || 'publish' == $content_struct['post_status'] )
+                $cap  = 'publish_posts';
+            else
+                $cap = 'edit_posts';
+            $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
+            $post_type = 'post';            
         }
 
@@ -3102 +3135 @@
         do_action('xmlrpc_call', 'mt.publishPost');
 
-        if ( !current_user_can('edit_post', $post_ID) )
+        if ( !current_user_can('publish_posts') || !current_user_can('edit_post', $post_ID) )
             return new IXR_Error(401, __('Sorry, you cannot edit this post.'));