![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 12 years ago
Closed 11 years ago
#27447 closed defect (bug) (fixed)
'XML-RPC server accepts POST requests only.' returned by xml-rpc.php while doing_wp_cron.
| Reported by: | sduval | Owned by: | wonderboymusic |
|---|---|---|---|
| Priority: | normal | Milestone: | 4.4 |
| Component: | XML-RPC | Version: | 3.8.1 |
| Severity: | normal | Keywords: | has-patch |
| Cc: | Focuses: |
Description
While using ALTERNATE_WP_CRON, there is a redirect to a modified url including doing_wp_cron whenever a cron must be performed.
A condition prevents the redirection from happening on POST, but when an xmlrpc is posted, the guard (!empty($_POST)) fails to prevent the redirection because the content does not get parsed into $_POST.
In cron.php, spawn_cron, I propose replacing
function spawn_cron( $gmt_time = 0 ) {
...
if ( defined('ALTERNATE_WP_CRON') && ALTERNATE_WP_CRON ) {
if ( !empty($_POST) || defined('DOING_AJAX') )
return;
by
function spawn_cron( $gmt_time = 0 ) {
...
if ( defined('ALTERNATE_WP_CRON') && ALTERNATE_WP_CRON ) {
if ( 'POST' == $_SERVER['REQUEST_METHOD'] || defined('DOING_AJAX') )
return;
Attachments (3)
Change History (13)
#3
@
12 years ago
- Resolution fixed
- Status closed → reopened
I think switching to SERVER_METHOD is probably a bit better here. $_POST is fine when we want to be naïve, but this case shows we need to expect that people will sometimes use raw POST data. php://input isn't re-readable until PHP 5.6 and that's overkill anyway. If we're receiving POST data, then it has to be a POST method. (The reverse isn't true: you can still receive query variables that get parsed into $_GET in a POST request.)
Checking XMLRPC_REQUEST is fine, but we should probably do a direct method check instead.
#4
@
12 years ago
Agreed on changing this, but I'd probably just make it filterable instead. The REST API sets XMLRPC_REQUEST right now for compatibility, but I could see that disappearing in the future.
#5
@
12 years ago
- Keywords has-patch added
Totally forgot about raw POST data. Included a new patch that fixes it and includes a filter.
#6
@
12 years ago
If we switch to 'POST' != $_SERVER['REQUEST_METHOD'], do we still need the other checks and the filter?
Sorry for the late response. I'm unsure why you would have seen it. Added a check when using XML-RPC which would also prevent issues when using JSON REST API.
Moving to 4.1.