Changeset 40682 for branches/4.3/src/wp-includes/class-wp-xmlrpc-server.php

Timestamp:

05/16/2017 08:21:23 AM (8 years ago)

Author:

swissspidy

Message:

Whitelist post arguments in XML-RPC

Merges [40677] to the 4.3 branch.

Location:

branches/4.3

Files:

• . (modified) (1 prop)
• src/wp-includes/class-wp-xmlrpc-server.php (modified) (2 diffs)

branches/4.3/src/wp-includes/class-wp-xmlrpc-server.php

@@ -1244 +1244 @@
      */
     protected function _insert_post( $user, $content_struct ) {
-        $defaults = array( 'post_status' => 'draft', 'post_type' => 'post', 'post_author' => 0,
-            'post_password' => '', 'post_excerpt' => '', 'post_content' => '', 'post_title' => '' );
-
-        $post_data = wp_parse_args( $content_struct, $defaults );
+        $defaults = array(
+            'post_status'    => 'draft',
+            'post_type'      => 'post',
+            'post_author'    => null,
+            'post_password'  => null,
+            'post_excerpt'   => null,
+            'post_content'   => null,
+            'post_title'     => null,
+            'post_date'      => null,
+            'post_date_gmt'  => null,
+            'post_format'    => null,
+            'post_name'      => null,
+            'post_thumbnail' => null,
+            'post_parent'    => null,
+            'ping_status'    => null,
+            'comment_status' => null,
+            'custom_fields'  => null,
+            'terms_names'    => null,
+            'terms'          => null,
+            'sticky'         => null,
+            'enclosure'      => null,
+            'ID'             => null,
+        );
+
+        $post_data = wp_parse_args( array_intersect_key( $content_struct, $defaults ), $defaults );
 
         $post_type = get_post_type_object( $post_data['post_type'] );
@@ -1431 +1452 @@
             $post_data['tax_input'] = $terms;
             unset( $post_data['terms'], $post_data['terms_names'] );
-        } else {
-            // Do not allow direct submission of 'tax_input', clients must use 'terms' and/or 'terms_names'.
-            unset( $post_data['tax_input'], $post_data['post_category'], $post_data['tags_input'] );
         }