Make WordPress Core

Opened 4 years ago

Last modified 2 weeks ago

#32863 new defect (bug)

set_custom_fields function in wp_xmlrpc_server class

Reported by: marifamir Owned by:
Milestone: Priority: normal
Severity: trivial Version: 4.2.2
Component: XML-RPC Keywords:
Focuses: administration Cc:



I was working with wp_xmlrpc_server class to insert and update woocommerce products but i found that my custom fields are not working properly. When i inspected the code of function set_custom_fields , i noticed that we are using wp_unslash to remove underscores from custom field keys. So keys like _price , _quantity and _stock were not working for the product custom post type. Secondly we are using add_post_meta to insert the meta data. Can we change it to the update_post_meta ?

I have attached the updated function.Please test it and let me know.

public function set_custom_fields($post_id, $fields) {
	$post_id = (int) $post_id;

	foreach ( (array) $fields as $meta ) {
		if ( isset($meta['id']) ) {
			$meta['id'] = (int) $meta['id'];
			$pmeta = get_metadata_by_mid( 'post', $meta['id'] );
			if ( isset($meta['key']) ) {
				$meta['key'] = ( $meta['key'] );
				if ( $meta['key'] !== $pmeta->meta_key )
				$meta['value'] = ( $meta['value'] );
				if ( current_user_can( 'edit_post_meta', $post_id, $meta['key'] ) )
					update_metadata_by_mid( 'post', $meta['id'], $meta['value'] );
			} elseif ( current_user_can( 'delete_post_meta', $post_id, $pmeta->meta_key ) ) {
				delete_metadata_by_mid( 'post', $meta['id'] );
		} else{
			update_post_meta( $post_id, $meta['key'], $meta['value'] );

Skype: arifamir33

Attachments (1)

xml-rpc-server class updated function.php (814 bytes) - added by marifamir 4 years ago.
Updated set_custom_fields function of wp_xmlrpc_server class

Download all attachments as: .zip

Change History (3)

4 years ago

Updated set_custom_fields function of wp_xmlrpc_server class

#1 @marifamir
4 years ago

  • Severity changed from normal to major

#2 @markoheijnen
4 years ago

  • Focuses accessibility removed
  • Severity changed from major to trivial

Hey Muhammad,

Fields that start with an underscore are seen as private. That is the reason why you can't change them. This is intended behaviour. See #17850 for more information. If you want to change those values then you should use register_meta and handle it yourself. I suddenly do wonder if it works since I we maybe would need to use is_protected_meta(). Wondering if we have unit tests for this.

Also add_post_meta seems to be fine there since nothing needs to be updated.

Note: See TracTickets for help on using tickets.