Changeset 40677 for trunk

Timestamp:

05/16/2017 08:08:27 AM (9 years ago)

Author:

swissspidy

Message:

Whitelist post arguments in XML-RPC

File:

• trunk/src/wp-includes/class-wp-xmlrpc-server.php (modified) (2 diffs)

trunk/src/wp-includes/class-wp-xmlrpc-server.php

@@ -1296 +1296 @@
          */
         protected function _insert_post( $user, $content_struct ) {
-                $defaults = array( 'post_status' => 'draft', 'post_type' => 'post', 'post_author' => 0,
-                        'post_password' => '', 'post_excerpt' => '', 'post_content' => '', 'post_title' => '' );
-
-                $post_data = wp_parse_args( $content_struct, $defaults );
+                $defaults = array(
+                        'post_status'    => 'draft',
+                        'post_type'      => 'post',
+                        'post_author'    => null,
+                        'post_password'  => null,
+                        'post_excerpt'   => null,
+                        'post_content'   => null,
+                        'post_title'     => null,
+                        'post_date'      => null,
+                        'post_date_gmt'  => null,
+                        'post_format'    => null,
+                        'post_name'      => null,
+                        'post_thumbnail' => null,
+                        'post_parent'    => null,
+                        'ping_status'    => null,
+                        'comment_status' => null,
+                        'custom_fields'  => null,
+                        'terms_names'    => null,
+                        'terms'          => null,
+                        'sticky'         => null,
+                        'enclosure'      => null,
+                        'ID'             => null,
+                );
+
+                $post_data = wp_parse_args( array_intersect_key( $content_struct, $defaults ), $defaults );
 
                 $post_type = get_post_type_object( $post_data['post_type'] );
@@ -1489 +1510 @@
                         $post_data['tax_input'] = $terms;
                         unset( $post_data['terms'], $post_data['terms_names'] );
-                } else {
-                        // Do not allow direct submission of 'tax_input', clients must use 'terms' and/or 'terms_names'.
-                        unset( $post_data['tax_input'], $post_data['post_category'], $post_data['tags_input'] );
                 }