Changeset 50954 for trunk/src/wp-includes/class-wp-xmlrpc-server.php

Timestamp:

05/24/2021 02:17:36 AM (5 years ago)

Author:

peterwilsoncc

Message:

XML-RPC: Set HTTP status code in accordance with the spec.

When the XML-RPC endpoint is enabled, always return a HTTP 200 OK status code in accordance with the XML-RPC specification. Continue to return an HTTP 405 Method Not Allowed status code when the endpoint is disabled.

Props ariskataoka, johnbillion.
Fixes #52958.

File:

• trunk/src/wp-includes/class-wp-xmlrpc-server.php (modified) (5 diffs)

trunk/src/wp-includes/class-wp-xmlrpc-server.php

@@ -15 +15 @@
  *
  * As of WordPress 3.5.0, XML-RPC is enabled by default. It can be disabled
- * via the {@see 'xmlrpc_enabled'} filter found in wp_xmlrpc_server::login().
+ * via the {@see 'xmlrpc_enabled'} filter found in wp_xmlrpc_server::set_is_enabled().
  *
  * @since 1.5.0
@@ -49 +49 @@
          */
         protected $auth_failed = false;
+
+        /**
+         * Flags that XML-RPC is enabled
+         *
+         * @var bool
+         */
+        private $is_enabled;
 
         /**
@@ -165 +172 @@
                  */
                 $this->methods = apply_filters( 'xmlrpc_methods', $this->methods );
-        }
-
-        /**
-         * Make private/protected methods readable for backward compatibility.
-         *
-         * @since 4.0.0
-         *
-         * @param string $name      Method to call.
-         * @param array  $arguments Arguments to pass when calling.
-         * @return array|IXR_Error|false Return value of the callback, false otherwise.
-         */
-        public function __call( $name, $arguments ) {
-                if ( '_multisite_getUsersBlogs' === $name ) {
-                        return $this->_multisite_getUsersBlogs( ...$arguments );
-                }
-                return false;
-        }
-
-        /**
-         * Serves the XML-RPC request.
-         *
-         * @since 2.9.0
-         */
-        public function serve_request() {
-                $this->IXR_Server( $this->methods );
-        }
-
-        /**
-         * Test XMLRPC API by saying, "Hello!" to client.
-         *
-         * @since 1.5.0
-         *
-         * @return string Hello string response.
-         */
-        public function sayHello() {
-                return 'Hello!';
-        }
-
-        /**
-         * Test XMLRPC API by adding two numbers for client.
-         *
-         * @since 1.5.0
-         *
-         * @param array $args {
-         *     Method arguments. Note: arguments must be ordered as documented.
-         *
-         *     @type int $number1 A number to add.
-         *     @type int $number2 A second number to add.
-         * }
-         * @return int Sum of the two given numbers.
-         */
-        public function addTwoNumbers( $args ) {
-                $number1 = $args[0];
-                $number2 = $args[1];
-                return $number1 + $number2;
-        }
-
-        /**
-         * Log user in.
-         *
-         * @since 2.8.0
-         *
-         * @param string $username User's username.
-         * @param string $password User's password.
-         * @return WP_User|false WP_User object if authentication passed, false otherwise
-         */
-        public function login( $username, $password ) {
+
+                $this->set_is_enabled();
+        }
+
+        /**
+         * Set wp_xmlrpc_server::$is_enabled property.
+         *
+         * Determine whether the xmlrpc server is enabled on this WordPress install
+         * and set the is_enabled property accordingly.
+         *
+         * @since 5.7.3
+         */
+        private function set_is_enabled() {
                 /*
                  * Respect old get_option() filters left for back-compat when the 'enable_xmlrpc'
                  * option was deprecated in 3.5.0. Use the 'xmlrpc_enabled' hook instead.
                  */
-                $enabled = apply_filters( 'pre_option_enable_xmlrpc', false );
-                if ( false === $enabled ) {
-                        $enabled = apply_filters( 'option_enable_xmlrpc', true );
+                $is_enabled = apply_filters( 'pre_option_enable_xmlrpc', false );
+                if ( false === $is_enabled ) {
+                        $is_enabled = apply_filters( 'option_enable_xmlrpc', true );
                 }
 
@@ -261 +214 @@
                  * @since 3.5.0
                  *
-                 * @param bool $enabled Whether XML-RPC is enabled. Default true.
+                 * @param bool $is_enabled Whether XML-RPC is enabled. Default true.
                  */
-                $enabled = apply_filters( 'xmlrpc_enabled', $enabled );
-
-                if ( ! $enabled ) {
+                $this->is_enabled = apply_filters( 'xmlrpc_enabled', $is_enabled );
+        }
+
+        /**
+         * Make private/protected methods readable for backward compatibility.
+         *
+         * @since 4.0.0
+         *
+         * @param string $name      Method to call.
+         * @param array  $arguments Arguments to pass when calling.
+         * @return array|IXR_Error|false Return value of the callback, false otherwise.
+         */
+        public function __call( $name, $arguments ) {
+                if ( '_multisite_getUsersBlogs' === $name ) {
+                        return $this->_multisite_getUsersBlogs( ...$arguments );
+                }
+                return false;
+        }
+
+        /**
+         * Serves the XML-RPC request.
+         *
+         * @since 2.9.0
+         */
+        public function serve_request() {
+                $this->IXR_Server( $this->methods );
+        }
+
+        /**
+         * Test XMLRPC API by saying, "Hello!" to client.
+         *
+         * @since 1.5.0
+         *
+         * @return string Hello string response.
+         */
+        public function sayHello() {
+                return 'Hello!';
+        }
+
+        /**
+         * Test XMLRPC API by adding two numbers for client.
+         *
+         * @since 1.5.0
+         *
+         * @param array $args {
+         *     Method arguments. Note: arguments must be ordered as documented.
+         *
+         *     @type int $number1 A number to add.
+         *     @type int $number2 A second number to add.
+         * }
+         * @return int Sum of the two given numbers.
+         */
+        public function addTwoNumbers( $args ) {
+                $number1 = $args[0];
+                $number2 = $args[1];
+                return $number1 + $number2;
+        }
+
+        /**
+         * Log user in.
+         *
+         * @since 2.8.0
+         *
+         * @param string $username User's username.
+         * @param string $password User's password.
+         * @return WP_User|false WP_User object if authentication passed, false otherwise
+         */
+        public function login( $username, $password ) {
+                if ( ! $this->is_enabled ) {
                         $this->error = new IXR_Error( 405, sprintf( __( 'XML-RPC services are disabled on this site.' ) ) );
                         return false;
@@ -334 +353 @@
                         }
                 }
+        }
+
+        /**
+         * Send error response to client.
+         *
+         * Send an XML error response to the client. If the endpoint is enabled
+         * an HTTP 200 response is always sent per the XML-RPC specification.
+         *
+         * @since 5.7.3
+         *
+         * @param IXR_Error|string $error   Error code or an error object.
+         * @param false            $message Error message. Optional.
+         */
+        public function error( $error, $message = false ) {
+                // Accepts either an error object or an error code and message
+                if ( $message && ! is_object( $error ) ) {
+                        $error = new IXR_Error( $error, $message );
+                }
+
+                if ( ! $this->is_enabled ) {
+                        status_header( $error->code );
+                }
+
+                $this->output( $error->getXml() );
         }