← All changes | includes/common/xmlrpc.php +97 -6 2.6.18 → 2.6.19 View file →

		@@ -12,18 +12,54 @@
12	12
13	13	/**
14	14	* Validate an XML-RPC edit against bbPress posting rules.
15	15	*
16		- * @since 2.6.17 bbPress
	16	+ * @since 2.6.17 bbPress (r7486)
	17	+ * @since 2.6.19 bbPress (r7684) Validate publication and date changes.
17	18	*
18	19	* @param string $method XML-RPC method name.
19	20	* @param array $args XML-RPC method arguments.
20	21	*/
21	22	function bbp_validate_xmlrpc_post( $method = '', $args = array() ) {
22		- global $bbp_xmlrpc_error_post_id;
	23	+ global $bbp_xmlrpc_error_post_id, $bbp_xmlrpc_error_post_type;
23	24
24	25	$bbp_xmlrpc_error_post_id = 0;
	26	+ $bbp_xmlrpc_error_post_type = '';
25	27
	28	+ // WordPress handles create permissions, but not bbPress's strict block list.
	29	+ if ( 'wp.newPost' === $method ) {
	30	+ if ( empty( $args[3] ) || ! is_array( $args[3] ) ) {
	31	+ return;
	32	+ }
	33	+
	34	+ $post_data = $args[3];
	35	+ $post_type = isset( $post_data['post_type'] ) ? $post_data['post_type'] : '';
	36	+ if ( ! in_array( $post_type, array( bbp_get_topic_post_type(), bbp_get_reply_post_type() ), true ) ) {
	37	+ return;
	38	+ }
	39	+
	40	+ $title = isset( $post_data['post_title'] ) ? wp_unslash( $post_data['post_title'] ) : '';
	41	+ $content = isset( $post_data['post_content'] ) ? wp_unslash( $post_data['post_content'] ) : '';
	42	+ if ( ! bbp_check_for_moderation( array(), bbp_get_current_user_id(), $title, $content, true ) ) {
	43	+ $bbp_xmlrpc_error_post_type = $post_type;
	44	+ }
	45	+
	46	+ return;
	47	+ }
	48	+
	49	+ // mt.publishPost sets a post status without bbPress lifecycle handling
	50	+ if ( 'mt.publishPost' === $method ) {
	51	+ $post_id = ! empty( $args[0] ) ? (int) $args[0] : 0;
	52	+ $post = get_post( $post_id );
	53	+ $types = array( bbp_get_forum_post_type(), bbp_get_topic_post_type(), bbp_get_reply_post_type() );
	54	+
	55	+ if ( ! empty( $post ) && in_array( $post->post_type, $types, true ) && ( 'publish' !== $post->post_status ) ) {
	56	+ $bbp_xmlrpc_error_post_id = $post_id;
	57	+ }
	58	+
	59	+ return;
	60	+ }
	61	+
26	62	$is_restore = ( 'wp.restoreRevision' === $method );
27	63
28	64	// Validate an edit or resolve its revision back to a bbPress post
29	65	if ( 'wp.editPost' === $method ) {
		@@ -67,10 +103,29 @@
67	103	: (int) $post->post_parent;
68	104	$parent_changed = ( $post_parent !== (int) $post->post_parent );
69	105	$status_changed = isset( $post_data['post_status'] ) && ( $post_data['post_status'] !== $post->post_status );
70	106	$order_changed = isset( $post_data['menu_order'] ) && ( (int) $post_data['menu_order'] !== (int) $post->menu_order );
71		- $invalid = false;
	107	+ $invalid = false;
	108	+ $is_forum_content = in_array( $post_type, array( bbp_get_topic_post_type(), bbp_get_reply_post_type() ), true );
	109	+ $can_moderate = current_user_can( 'moderate', $post_id );
72	110
	111	+ // Keep non-moderators from moving the edit window through XML-RPC dates
	112	+ if ( $is_forum_content && ! $can_moderate && bbp_xmlrpc_post_date_changed( $post_data, $post ) ) {
	113	+ $invalid = true;
	114	+ }
	115	+
	116	+ // XML-RPC does not set the front-end query flags used by the topic and
	117	+ // reply capability mappings to enforce the author edit window.
	118	+ if ( $is_forum_content && ( bbp_get_current_user_id() === (int) $post->post_author ) && ! $can_moderate ) {
	119	+ $post_date_gmt = ( '0000-00-00 00:00:00' === $post->post_date_gmt )
	120	+ ? get_gmt_from_date( $post->post_date )
	121	+ : $post->post_date_gmt;
	122	+
	123	+ if ( bbp_past_edit_lock( $post_date_gmt ) ) {
	124	+ $invalid = true;
	125	+ }
	126	+ }
	127	+
73	128	// Validate forum structure and visibility changes
74	129	if ( bbp_get_forum_post_type() === $post_type ) {
75	130	if ( ! $is_restore && $parent_changed && ! current_user_can( 'assign_moderators' ) ) {
76	131	$invalid = true;
		@@ -138,11 +193,44 @@
138	193	}
139	194	}
140	195
141	196	/**
	197	+ * Check whether XML-RPC date fields would change a post's publication date.
	198	+ *
	199	+ * Match the date conversion used by WordPress's wp.editPost method.
	200	+ *
	201	+ * @since 2.6.19 bbPress (r7684)
	202	+ *
	203	+ * @param array $post_data Submitted post fields.
	204	+ * @param WP_Post $post Existing post.
	205	+ * @return bool Whether the publication date would change.
	206	+ */
	207	+function bbp_xmlrpc_post_date_changed( $post_data, $post ) {
	208	+ if ( ! isset( $post_data['post_date'] ) && ! isset( $post_data['post_date_gmt'] ) ) {
	209	+ return false;
	210	+ }
	211	+
	212	+ if ( ! empty( $post_data['post_date_gmt'] ) && ( $post_data['post_date_gmt'] instanceof IXR_Date ) ) {
	213	+ $iso_date = rtrim( $post_data['post_date_gmt']->getIso(), 'Z' ) . 'Z';
	214	+ } elseif ( ! empty( $post_data['post_date'] ) && ( $post_data['post_date'] instanceof IXR_Date ) ) {
	215	+ $iso_date = $post_data['post_date']->getIso();
	216	+ } else {
	217	+ return true;
	218	+ }
	219	+
	220	+ $local = ! empty( $iso_date ) ? iso8601_to_datetime( $iso_date ) : false;
	221	+ $gmt = ! empty( $iso_date ) ? iso8601_to_datetime( $iso_date, 'gmt' ) : false;
	222	+ $post_date_gmt = ( '0000-00-00 00:00:00' === $post->post_date_gmt )
	223	+ ? get_gmt_from_date( $post->post_date )
	224	+ : $post->post_date_gmt;
	225	+
	226	+ return empty( $local ) || empty( $gmt ) || ( $post->post_date !== $local ) || ( $post_date_gmt !== $gmt );
	227	+}
	228	+
	229	+/**
142	230	* Deny a post capability when an XML-RPC edit failed bbPress validation.
143	231	*
144		- * @since 2.6.17 bbPress
	232	+ * @since 2.6.17 bbPress (r7486)
145	233	*
146	234	* @param array $caps Required capabilities.
147	235	* @param string $cap Requested capability.
148	236	* @param int $user_id User ID.
		@@ -149,9 +237,9 @@
149	237	* @param array $args Capability arguments.
150	238	* @return array Required capabilities.
151	239	*/
152	240	function bbp_map_xmlrpc_meta_caps( $caps = array(), $cap = '', $user_id = 0, $args = array() ) {
153		- global $bbp_xmlrpc_error_post_id;
	241	+ global $bbp_xmlrpc_error_post_id, $bbp_xmlrpc_error_post_type;
154	242
155	243	$edit_caps = array( 'edit_post', 'edit_topic', 'edit_reply' );
156	244
157	245	if ( ! empty( $bbp_xmlrpc_error_post_id ) && in_array( $cap, $edit_caps, true ) && ! empty( $args[0] ) && ( (int) $args[0] === $bbp_xmlrpc_error_post_id ) ) {
		@@ -156,8 +244,11 @@
156	244
157	245	if ( ! empty( $bbp_xmlrpc_error_post_id ) && in_array( $cap, $edit_caps, true ) && ! empty( $args[0] ) && ( (int) $args[0] === $bbp_xmlrpc_error_post_id ) ) {
158	246	$caps[] = 'do_not_allow';
159	247	}
	248	+ if ( ( ( bbp_get_topic_post_type() === $bbp_xmlrpc_error_post_type ) && ( 'edit_topics' === $cap ) ) || ( ( bbp_get_reply_post_type() === $bbp_xmlrpc_error_post_type ) && ( 'edit_replies' === $cap ) ) ) {
	249	+ $caps[] = 'do_not_allow';
	250	+ }
160	251
161	252	return $caps;
162	253	}
163	254
		@@ -163,9 +254,9 @@
163	254
164	255	/**
165	256	* Apply bbPress moderation to XML-RPC post data.
166	257	*
167		- * @since 2.6.17 bbPress
	258	+ * @since 2.6.17 bbPress (r7486)
168	259	*
169	260	* @param array $post_data Parsed post data.
170	261	* @return array Parsed post data.
171	262	*/