Make WordPress Core

Opened 15 years ago

Closed 14 years ago

#19774 closed defect (bug) (fixed)

Potential undefined array access in XML-RPC mw_newPost/mw_editPost

Reported by: maxcutler Owned by: westi
Priority: normal Milestone: 3.4
Component: XML-RPC Version: 3.3.1
Severity: trivial Keywords: has-patch
Cc: Focuses:

Description

When attempting to determine the appropriate cap check, some of the logic attempts to access members of the content_struct array that are not required to be set, resulting in 'undefined index' error/notice.

Specifically, this can occur when 'post_type' is supplied but not 'post_status'.

An example XML-RPC request that triggers one of the two if statements is in the test_call.txt attachment.

Attachments (3)

test_call.txt (927 bytes ) - added by maxcutler 15 years ago.
class-wp-xmlrpc-server.php.patch (952 bytes ) - added by maxcutler 15 years ago.
class-wp-xmlrpc-server.php.2.patch (1.8 KB ) - added by maxcutler 15 years ago.

Download all attachments as: .zip

Change History (6)

@maxcutler
15 years ago

#1 @maxcutler
15 years ago

  • Summary Potential undefined array access in XML-RPC mw_newPostPotential undefined array access in XML-RPC mw_newPost/mw_editPost

Discovered that the same logic was copy/pasted to mw_editPost, so patching that as well.

#2 @SergeyBiryukov
15 years ago

  • Milestone Awaiting Review3.4

#3 @westi
14 years ago

  • Owner set to westi
  • Resolutionfixed
  • Status newclosed

In [20323]:

XMLRPC: In mw_newPost check to see if the post_status has been supplied before trying to use it to avoid undefined array access notices. Fixes #19774 props maxcutler.

Note: See TracTickets for help on using tickets.