Changeset 6503 for trunk/xmlrpc.php

Timestamp:

12/27/2007 10:14:27 PM (17 years ago)

Author:

ryan

Message:

Some xmlrpc cap checks from josephscott.

File:

• trunk/xmlrpc.php (modified) (15 diffs)

trunk/xmlrpc.php

@@ -231 +231 @@
             return($this->error);
         }
+
+        set_current_user( 0, $username );
+        if( !current_user_can( 'edit_page', $page_id ) )
+            return new IXR_Error( 401, __( 'Sorry, you can not edit this page.' ) );
 
         do_action('xmlrpc_call', 'wp.getPage');
@@ -316 +320 @@
         }
 
+        set_current_user( 0, $username );
+        if( !current_user_can( 'edit_pages' ) )
+            return new IXR_Error( 401, __( 'Sorry, you can not edit pages.' ) );
+
         do_action('xmlrpc_call', 'wp.getPages');
 
@@ -482 +490 @@
         }
 
+        set_current_user( 0, $username );
+        if( !current_user_can( 'edit_pages' ) )
+            return new IXR_Error( 401, __( 'Sorry, you can not edit pages.' ) );
+
         do_action('xmlrpc_call', 'wp.getPageList');
 
@@ -647 +659 @@
         }
 
+        set_current_user(0, $username);
+        if( !current_user_can( 'edit_posts' ) ) 
+            return new IXR_Error( 401, __( 'Sorry, you must be able to publish to this blog in order to view categories.' ) );
+
         do_action('xmlrpc_call', 'wp.suggestCategories');
 
@@ -707 +723 @@
         }
 
+        set_current_user( 0, $user_login );
+        if( !current_user_can( 'edit_posts' ) ) 
+            return new IXR_Error( 401, __( 'Sorry, you do not have access to user data on this blog.' ) );
+
         do_action('xmlrpc_call', 'blogger.getUserInfo');
 
@@ -715 +735 @@
             'userid'    => $user_data->ID,
             'url'       => $user_data->user_url,
-            'email'     => $user_data->user_email,
             'lastname'  => $user_data->last_name,
             'firstname' => $user_data->first_name
@@ -736 +755 @@
             return $this->error;
         }
+
+        set_current_user( 0, $user_login );
+        if( !current_user_can( 'edit_post', $post_ID ) ) 
+            return new IXR_Error( 401, __( 'Sorry, you can not edit this post.' ) );
 
         do_action('xmlrpc_call', 'blogger.getPost');
@@ -776 +799 @@
         $posts_list = wp_get_recent_posts($num_posts);
 
+        set_current_user( 0, $user_login );
+
         if (!$posts_list) {
             $this->error = new IXR_Error(500, __('Either there are no posts, or something went wrong.'));
@@ -782 +807 @@
 
         foreach ($posts_list as $entry) {
+            if( !current_user_can( 'edit_post', $entry['ID'] ) )
+                continue;
 
             $post_date = mysql2date('Ymd\TH:i:s', $entry['post_date']);
@@ -1462 +1489 @@
             return $this->error;
         }
+
+        set_current_user( 0, $user_login );
+        if( !current_user_can( 'edit_post', $post_ID ) )
+            return new IXR_Error( 401, __( 'Sorry, you can not edit this post.' ) );
 
         do_action('xmlrpc_call', 'metaWeblog.getPost');
@@ -1550 +1581 @@
         }
 
-        $this_user = set_current_user( 0, $user_login );
+        set_current_user( 0, $user_login );
 
         foreach ($posts_list as $entry) {
-            if ( 
-                !empty( $entry['post_password'] ) 
-                && !current_user_can( 'edit_post', $entry['ID'] )
-            ) {
-                unset( $entry['post_password'] );
-            }
+            if( !current_user_can( 'edit_post', $entry['ID'] ) )
+                continue;
 
             $post_date = mysql2date('Ymd\TH:i:s', $entry['post_date']);
@@ -1638 +1665 @@
         }
 
+        set_current_user( 0, $user_login );
+        if( !current_user_can( 'edit_posts' ) )
+            return new IXR_Error( 401, __( 'Sorry, you must be able to edit posts on this blog in order to view categories.' ) );
+
         do_action('xmlrpc_call', 'metaWeblog.getCategories');
 
@@ -1761 +1792 @@
         }
 
+        set_current_user( 0, $user_login );
+
         foreach ($posts_list as $entry) {
+            if( !current_user_can( 'edit_post', $entry['ID'] ) ) 
+                continue;
 
             $post_date = mysql2date('Ymd\TH:i:s', $entry['post_date']);
@@ -1798 +1833 @@
         }
 
+        set_current_user( 0, $user_login );
+        if( !current_user_can( 'edit_posts' ) )
+            return new IXR_Error( 401, __( 'Sorry, you must be able to edit posts on this blog in order to view categories.' ) );
+
         do_action('xmlrpc_call', 'mt.getCategoryList');
 
         $categories_struct = array();
 
-        // FIXME: can we avoid using direct SQL there?
         if ( $cats = get_categories('hide_empty=0&hierarchical=0') ) {
             foreach ($cats as $cat) {
@@ -1828 +1866 @@
             return $this->error;
         }
+
+        set_current_user( 0, $user_login );
+        if( !current_user_can( 'edit_post', $post_ID ) )
+            return new IXR_Error( 401, __( 'Sorry, you can not edit this post.' ) );
 
         do_action('xmlrpc_call', 'mt.getPostCategories');