Make WordPress Core

Changeset 40678


Ignore:
Timestamp:
05/16/2017 08:16:13 AM (7 years ago)
Author:
swissspidy
Message:

Whitelist post arguments in XML-RPC

Merges [40677] to the 4.7 branch.

Location:
branches/4.7
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.7

  • branches/4.7/src/wp-includes/class-wp-xmlrpc-server.php

    r39312 r40678  
    12961296     */
    12971297    protected function _insert_post( $user, $content_struct ) {
    1298         $defaults = array( 'post_status' => 'draft', 'post_type' => 'post', 'post_author' => 0,
    1299             'post_password' => '', 'post_excerpt' => '', 'post_content' => '', 'post_title' => '' );
    1300 
    1301         $post_data = wp_parse_args( $content_struct, $defaults );
     1298        $defaults = array(
     1299            'post_status'    => 'draft',
     1300            'post_type'      => 'post',
     1301            'post_author'    => null,
     1302            'post_password'  => null,
     1303            'post_excerpt'   => null,
     1304            'post_content'   => null,
     1305            'post_title'     => null,
     1306            'post_date'      => null,
     1307            'post_date_gmt'  => null,
     1308            'post_format'    => null,
     1309            'post_name'      => null,
     1310            'post_thumbnail' => null,
     1311            'post_parent'    => null,
     1312            'ping_status'    => null,
     1313            'comment_status' => null,
     1314            'custom_fields'  => null,
     1315            'terms_names'    => null,
     1316            'terms'          => null,
     1317            'sticky'         => null,
     1318            'enclosure'      => null,
     1319            'ID'             => null,
     1320        );
     1321
     1322        $post_data = wp_parse_args( array_intersect_key( $content_struct, $defaults ), $defaults );
    13021323
    13031324        $post_type = get_post_type_object( $post_data['post_type'] );
     
    14891510            $post_data['tax_input'] = $terms;
    14901511            unset( $post_data['terms'], $post_data['terms_names'] );
    1491         } else {
    1492             // Do not allow direct submission of 'tax_input', clients must use 'terms' and/or 'terms_names'.
    1493             unset( $post_data['tax_input'], $post_data['post_category'], $post_data['tags_input'] );
    14941512        }
    14951513
Note: See TracChangeset for help on using the changeset viewer.