-
Index: xmlrpc.php
===================================================================
--- xmlrpc.php (.../2.3.1) (revision 6582)
+++ xmlrpc.php (.../2.3.2) (revision 6582)
@@ -187,6 +187,12 @@
return($this->error);
}
+ set_current_user( 0, $username );
+ if( !current_user_can( 'edit_page', $page_id ) )
+ return new IXR_Error( 401, __( 'Sorry, you can not edit this page.' ) );
+
+ do_action('xmlrpc_call', 'wp.getPage');
+
// Lookup page info.
$page = get_page($page_id);
@@ -268,6 +274,12 @@
return($this->error);
}
+ set_current_user( 0, $username );
+ if( !current_user_can( 'edit_pages' ) )
+ return new IXR_Error( 401, __( 'Sorry, you can not edit pages.' ) );
+
+ do_action('xmlrpc_call', 'wp.getPages');
+
// Lookup info on pages.
$pages = get_pages();
$num_pages = count($pages);
@@ -426,6 +438,12 @@
return($this->error);
}
+ set_current_user( 0, $username );
+ if( !current_user_can( 'edit_pages' ) )
+ return new IXR_Error( 401, __( 'Sorry, you can not edit pages.' ) );
+
+ do_action('xmlrpc_call', 'wp.getPageList');
+
// Get list of pages ids and titles
$page_list = $wpdb->get_results("
SELECT ID page_id,
@@ -459,7 +477,6 @@
* wp_getAuthors
*/
function wp_getAuthors($args) {
- global $wpdb;
$this->escape($args);
@@ -471,7 +488,23 @@
return($this->error);
}
- return(get_users_of_blog());
+ set_current_user(0, $username);
+ if(!current_user_can("edit_posts")) {
+ return(new IXR_Error(401, __("Sorry, you can not edit posts on this blog.")));
+ }
+
+ do_action('xmlrpc_call', 'wp.getAuthors');
+
+ $authors = array();
+ foreach( (array) get_users_of_blog() as $row ) {
+ $authors[] = array(
+ "user_id" => $row->user_id,
+ "user_login" => $row->user_login,
+ "display_name" => $row->display_name
+ );
+ }
+
+ return($authors);
}
/**
@@ -493,7 +526,7 @@
// Set the user context and make sure they are
// allowed to add a category.
set_current_user(0, $username);
- if(!current_user_can("manage_categories", $page_id)) {
+ if(!current_user_can("manage_categories")) {
return(new IXR_Error(401, __("Sorry, you do not have the right to add a category.")));
}
@@ -547,6 +580,12 @@
return($this->error);
}
+ set_current_user(0, $username);
+ if( !current_user_can( 'edit_posts' ) )
+ return new IXR_Error( 401, __( 'Sorry, you must be able to publish to this blog in order to view categories.' ) );
+
+ do_action('xmlrpc_call', 'wp.suggestCategories');
+
$args = array('get' => 'all', 'number' => $max_results, 'name__like' => $category);
$category_suggestions = get_categories($args);
@@ -597,13 +636,18 @@
return $this->error;
}
+ set_current_user( 0, $user_login );
+ if( !current_user_can( 'edit_posts' ) )
+ return new IXR_Error( 401, __( 'Sorry, you do not have access to user data on this blog.' ) );
+
+ do_action('xmlrpc_call', 'blogger.getUserInfo');
+
$user_data = get_userdatabylogin($user_login);
$struct = array(
'nickname' => $user_data->nickname,
'userid' => $user_data->ID,
'url' => $user_data->user_url,
- 'email' => $user_data->user_email,
'lastname' => $user_data->last_name,
'firstname' => $user_data->first_name
);
@@ -625,7 +669,12 @@
return $this->error;
}
- $user_data = get_userdatabylogin($user_login);
+ set_current_user( 0, $user_login );
+ if( !current_user_can( 'edit_post', $post_ID ) )
+ return new IXR_Error( 401, __( 'Sorry, you can not edit this post.' ) );
+
+ do_action('xmlrpc_call', 'blogger.getPost');
+
$post_data = wp_get_single_post($post_ID, ARRAY_A);
$categories = implode(',', wp_get_post_categories($post_ID));
@@ -663,12 +712,16 @@
$posts_list = wp_get_recent_posts($num_posts);
+ set_current_user( 0, $user_login );
+
if (!$posts_list) {
$this->error = new IXR_Error(500, __('Either there are no posts, or something went wrong.'));
return $this->error;
}
foreach ($posts_list as $entry) {
+ if( !current_user_can( 'edit_post', $entry['ID'] ) )
+ continue;
$post_date = mysql2date('Ymd\TH:i:s', $entry['post_date']);
$categories = implode(',', wp_get_post_categories($entry['ID']));
@@ -1328,78 +1381,83 @@
/* metaweblog.getPost ...returns a post */
function mw_getPost($args) {
- global $wpdb;
+ global $wpdb;
$this->escape($args);
- $post_ID = (int) $args[0];
- $user_login = $args[1];
- $user_pass = $args[2];
+ $post_ID = (int) $args[0];
+ $user_login = $args[1];
+ $user_pass = $args[2];
- if (!$this->login_pass_ok($user_login, $user_pass)) {
- return $this->error;
- }
+ if (!$this->login_pass_ok($user_login, $user_pass)) {
+ return $this->error;
+ }
- $postdata = wp_get_single_post($post_ID, ARRAY_A);
+ set_current_user( 0, $user_login );
+ if( !current_user_can( 'edit_post', $post_ID ) )
+ return new IXR_Error( 401, __( 'Sorry, you can not edit this post.' ) );
- if ($postdata['post_date'] != '') {
+ do_action('xmlrpc_call', 'metaWeblog.getPost');
- $post_date = mysql2date('Ymd\TH:i:s', $postdata['post_date']);
- $post_date_gmt = mysql2date('Ymd\TH:i:s', $postdata['post_date_gmt']);
+ $postdata = wp_get_single_post($post_ID, ARRAY_A);
- $categories = array();
- $catids = wp_get_post_categories($post_ID);
- foreach($catids as $catid) {
- $categories[] = get_cat_name($catid);
- }
+ if ($postdata['post_date'] != '') {
+ $post_date = mysql2date('Ymd\TH:i:s', $postdata['post_date']);
+ $post_date_gmt = mysql2date('Ymd\TH:i:s', $postdata['post_date_gmt']);
- $tagnames = array();
- $tags = wp_get_post_tags( $post_ID );
- if ( !empty( $tags ) ) {
- foreach ( $tags as $tag ) {
- $tagnames[] = $tag->name;
+ $categories = array();
+ $catids = wp_get_post_categories($post_ID);
+ foreach($catids as $catid) {
+ $categories[] = get_cat_name($catid);
}
- $tagnames = implode( ', ', $tagnames );
- } else {
- $tagnames = '';
- }
- $post = get_extended($postdata['post_content']);
- $link = post_permalink($postdata['ID']);
+ $tagnames = array();
+ $tags = wp_get_post_tags( $post_ID );
+ if ( !empty( $tags ) ) {
+ foreach ( $tags as $tag ) {
+ $tagnames[] = $tag->name;
+ }
+ $tagnames = implode( ', ', $tagnames );
+ } else {
+ $tagnames = '';
+ }
- // Get the author info.
- $author = get_userdata($postdata['post_author']);
+ $post = get_extended($postdata['post_content']);
+ $link = post_permalink($postdata['ID']);
- $allow_comments = ('open' == $postdata['comment_status']) ? 1 : 0;
- $allow_pings = ('open' == $postdata['ping_status']) ? 1 : 0;
+ // Get the author info.
+ $author = get_userdata($postdata['post_author']);
- $resp = array(
- 'dateCreated' => new IXR_Date($post_date),
- 'userid' => $postdata['post_author'],
- 'postid' => $postdata['ID'],
- 'description' => $post['main'],
- 'title' => $postdata['post_title'],
- 'link' => $link,
- 'permaLink' => $link,
-// commented out because no other tool seems to use this
-// 'content' => $entry['post_content'],
- 'categories' => $categories,
- 'mt_excerpt' => $postdata['post_excerpt'],
- 'mt_text_more' => $post['extended'],
- 'mt_allow_comments' => $allow_comments,
- 'mt_allow_pings' => $allow_pings,
- 'mt_keywords' => $tagnames,
- 'wp_slug' => $postdata['post_name'],
- 'wp_password' => $postdata['post_password'],
- 'wp_author_id' => $author->ID,
- 'wp_author_display_name' => $author->display_name,
- 'date_created_gmt' => new IXR_Date($post_date_gmt)
- );
+ $allow_comments = ('open' == $postdata['comment_status']) ? 1 : 0;
+ $allow_pings = ('open' == $postdata['ping_status']) ? 1 : 0;
- return $resp;
- } else {
- return new IXR_Error(404, __('Sorry, no such post.'));
- }
+ $resp = array(
+ 'dateCreated' => new IXR_Date($post_date),
+ 'userid' => $postdata['post_author'],
+ 'postid' => $postdata['ID'],
+ 'description' => $post['main'],
+ 'title' => $postdata['post_title'],
+ 'link' => $link,
+ 'permaLink' => $link,
+ // commented out because no other tool seems to use this
+ // 'content' => $entry['post_content'],
+ 'categories' => $categories,
+ 'mt_excerpt' => $postdata['post_excerpt'],
+ 'mt_text_more' => $post['extended'],
+ 'mt_allow_comments' => $allow_comments,
+ 'mt_allow_pings' => $allow_pings,
+ 'mt_keywords' => $tagnames,
+ 'wp_slug' => $postdata['post_name'],
+ 'wp_password' => $postdata['post_password'],
+ 'wp_author_id' => $author->ID,
+ 'wp_author_display_name' => $author->display_name,
+ 'date_created_gmt' => new IXR_Date($post_date_gmt)
+ );
+
+ return $resp;
+ } else {
+ return new IXR_Error(404, __('Sorry, no such post.'));
+ }
}
@@ -1424,7 +1482,11 @@
return $this->error;
}
+ set_current_user( 0, $user_login );
+
foreach ($posts_list as $entry) {
+ if( !current_user_can( 'edit_post', $entry['ID'] ) )
+ continue;
$post_date = mysql2date('Ymd\TH:i:s', $entry['post_date']);
$post_date_gmt = mysql2date('Ymd\TH:i:s', $entry['post_date_gmt']);
@@ -1504,6 +1566,12 @@
return $this->error;
}
+ set_current_user( 0, $user_login );
+ if( !current_user_can( 'edit_posts' ) )
+ return new IXR_Error( 401, __( 'Sorry, you must be able to edit posts on this blog in order to view categories.' ) );
+
+ do_action('xmlrpc_call', 'metaWeblog.getCategories');
+
$categories_struct = array();
if ( $cats = get_categories('get=all') ) {
@@ -1623,7 +1691,11 @@
return $this->error;
}
+ set_current_user( 0, $user_login );
+
foreach ($posts_list as $entry) {
+ if( !current_user_can( 'edit_post', $entry['ID'] ) )
+ continue;
$post_date = mysql2date('Ymd\TH:i:s', $entry['post_date']);
$post_date_gmt = mysql2date('Ymd\TH:i:s', $entry['post_date_gmt']);
@@ -1662,9 +1734,14 @@
return $this->error;
}
+ set_current_user( 0, $user_login );
+ if( !current_user_can( 'edit_posts' ) )
+ return new IXR_Error( 401, __( 'Sorry, you must be able to edit posts on this blog in order to view categories.' ) );
+
+ do_action('xmlrpc_call', 'mt.getCategoryList');
+
$categories_struct = array();
- // FIXME: can we avoid using direct SQL there?
if ( $cats = get_categories('hide_empty=0&hierarchical=0') ) {
foreach ($cats as $cat) {
$struct['categoryId'] = $cat->term_id;
@@ -1691,6 +1768,12 @@
return $this->error;
}
+ set_current_user( 0, $user_login );
+ if( !current_user_can( 'edit_post', $post_ID ) )
+ return new IXR_Error( 401, __( 'Sorry, you can not edit this post.' ) );
+
+ do_action('xmlrpc_call', 'mt.getPostCategories');
+
$categories = array();
$catids = wp_get_post_categories(intval($post_ID));
// first listed category will be the primary category
Index: wp-mail.php
===================================================================
--- wp-mail.php (.../2.3.1) (revision 6582)
+++ wp-mail.php (.../2.3.2) (revision 6582)
@@ -12,7 +12,7 @@
$pop3 = new POP3();
if (!$pop3->connect(get_option('mailserver_url'), get_option('mailserver_port')))
- wp_die($pop3->ERROR);
+ wp_die(wp_specialchars($pop3->ERROR));
$count = $pop3->login(get_option('mailserver_login'), get_option('mailserver_pass'));
if (0 == $count) wp_die(__('There doesn’t seem to be any new mail.'));
@@ -129,9 +129,6 @@
$content = explode($phone_delim, $content);
$content[1] ? $content = $content[1] : $content = $content[0];
- echo "Content-type: $content_type, Content-Transfer-Encoding: $content_transfer_encoding, boundary: $boundary
\n";
- echo "Raw content:
".$content.'
';
-
$content = trim($content);
$post_content = apply_filters('phone_content', $content);
@@ -161,12 +158,11 @@
do_action('publish_phone', $post_ID);
- echo "\nAuthor: $post_author
";
- echo "\nPosted title: $post_title
";
- echo "\nPosted content:
".$content.'
';
+ echo "\nAuthor: " . wp_specialchars($post_author) . "
";
+ echo "\nPosted title: " . wp_specialchars($post_title) . "
";
if(!$pop3->delete($i)) {
- echo '
Oops '.$pop3->ERROR.'
';
+ echo 'Oops '.wp_specialchars($pop3->ERROR).'
';
$pop3->reset();
exit;
} else {
Index: wp-settings.php
===================================================================
--- wp-settings.php (.../2.3.1) (revision 6582)
+++ wp-settings.php (.../2.3.2) (revision 6582)
@@ -122,6 +122,9 @@
else
require_once (ABSPATH . WPINC . '/wp-db.php');
+if ( !empty($wpdb->error) )
+ dead_db();
+
// $table_prefix is deprecated as of 2.1
$wpdb->prefix = $table_prefix;
Index: wp-admin/includes/file.php
===================================================================
--- wp-admin/includes/file.php (.../2.3.1) (revision 6582)
+++ wp-admin/includes/file.php (.../2.3.2) (revision 6582)
@@ -43,6 +43,9 @@
}
function validate_file( $file, $allowed_files = '' ) {
+ if ( false !== strpos( $file, '..' ))
+ return 1;
+
if ( false !== strpos( $file, './' ))
return 1;
Index: wp-admin/admin.php
===================================================================
--- wp-admin/admin.php (.../2.3.1) (revision 6582)
+++ wp-admin/admin.php (.../2.3.2) (revision 6582)
@@ -1,4 +1,6 @@
error) )
+ wp_die($wpdb->error->get_error_message());
+
$handle = fopen('../wp-config.php', 'w');
foreach ($configFile as $line_num => $line) {
Index: wp-admin/install.php
===================================================================
--- wp-admin/install.php (.../2.3.1) (revision 6582)
+++ wp-admin/install.php (.../2.3.2) (revision 6582)
@@ -13,6 +13,7 @@
$step = $_GET['step'];
else
$step = 0;
+function display_header(){
header( 'Content-Type: text/html; charset=utf-8' );
?>
@@ -24,13 +25,17 @@
+
'.__('Already Installed').''.__('You appear to have already installed WordPress. To reinstall please clear your old database tables first.').'