WordPress.org

Make WordPress Core

Opened 8 months ago

Closed 8 months ago

#25146 closed defect (bug) (invalid)

XMLRPC wp.editPost doesn't use update_post_meta

Reported by: jmaimarc Owned by:
Milestone: Priority: normal
Severity: normal Version: 3.6
Component: XML-RPC Keywords: needs-patch
Focuses: Cc:

Description

file: wp-includes/class-wp-xmlrpc-server.php
line 287:
Currently, the code is:

add_post_meta( $post_id, $meta['key'], $meta['value'] );

Since it doesn't know if the key is unique I think the code should be:

update_post_meta( $post_id, $meta['key'], $meta['value'] );

so it checks for an existing meta_key for the post.

FWIW, I tested it locally and it works.

I also wasn't sure about the current_user_can capabilities, so I made the check:

current_user_can( 'edit_post_meta', $post_id, $meta['key'] ) || current_user_can( 'add_post_meta', $post_id, wp_unslash( $meta['key'] ) ) 

which might be overkill; I didn't see documentation on those capabilities. The wp_unslash is inconsistent, but I just copied from an earlier if statement.

Change History (2)

comment:2 nacin8 months ago

  • Milestone Awaiting Review deleted
  • Resolution set to invalid
  • Status changed from new to closed

In order to update a existing metadata you must pass the meta ID.

Note: See TracTickets for help on using tickets.