Ticket #2: 0000002-xmlrpc.php

<?php

# fix for mozBlog and other cases where '<?xml' isn't on the very first line
$HTTP_RAW_POST_DATA = trim($HTTP_RAW_POST_DATA);

include('wp-config.php');

require_once(ABSPATH.WPINC."/class-xmlrpc.php");
require_once(ABSPATH.WPINC."/class-xmlrpcs.php");
require_once(ABSPATH.WPINC."/template-functions.php");
require_once(ABSPATH.WPINC."/functions.php");
require_once(ABSPATH.WPINC."/vars.php");

$use_cache = 1;
$post_autobr = 0;
$post_default_title = ""; // posts submitted via the xmlrpc interface get that title
$post_default_category = 1; // posts submitted via the xmlrpc interface go into that category

$xmlrpc_logging = 0;

function logIO($io,$msg) {
    global $xmlrpc_logging;
    if ($xmlrpc_logging) {
        $fp = fopen("./xmlrpc.log","a+");
        $date = date("Y-m-d H:i:s ");
        $iot = ($io == "I") ? " Input: " : " Output: ";
        fwrite($fp, "\n\n".$date.$iot.$msg);
        fclose($fp);
    }
    return true;
    }

function starify($string) {
    $i = strlen($string);
    return str_repeat('*', $i);
}

logIO("I",$HTTP_RAW_POST_DATA);

/**** DB Functions ****/

/*
 * These really should be moved into wp-includes/functions.php,
 * and re-used throughout the code, where possible. -- emc3
 */

/*
 * generic function for inserting data into the posts table.
 */
function wp_insert_post($postarr = array()) {
    global $wpdb, $tableposts;

    // export array as variables
    extract($postarr);
    
    // Do some escapes for safety
    $post_content = $wpdb->escape($post_content);
    $post_title = $wpdb->escape($post_title);
    
    $post_cat = $post_category[0];
    
    $sql = "INSERT INTO $tableposts 
        (post_author, post_date, post_content, post_title, post_excerpt, post_category, post_status) 
        VALUES ('$post_author','$post_date','$post_content','$post_title', '$post_excerpt','$post_cat', '$post_status')";

    $result = $wpdb->query($sql);
    $post_ID = $wpdb->insert_id;
    
    wp_set_post_cats('',$post_ID,$post_category);

    // Return insert_id if we got a good result, otherwise return zero.
    return $result?$post_ID:0;
}

function wp_get_single_post($postid = 0, $mode = OBJECT) {
    global $wpdb, $tableposts;

    $sql = "SELECT * FROM $tableposts WHERE ID=$postid";
    $result = $wpdb->get_row($sql, $mode);

    return $result;
}

function wp_get_recent_posts($num = 10) {
    global $wpdb, $tableposts;

    // Set the limit clause, if we got a limit
    if ($num) {
        $limit = "LIMIT $num";
    }

    $sql = "SELECT * FROM $tableposts ORDER BY post_date DESC $limit";
    $result = $wpdb->get_results($sql,ARRAY_A);

    return $result?$result:array();
}

function wp_update_post($postarr = array()) {
    global $wpdb, $tableposts;

    // First get all of the original fields
    extract(wp_get_single_post($postarr['ID']));    

    // Now overwrite any changed values being passed in
    extract($postarr);
    
    // Do some escapes for safety
    $post_content = $wpdb->escape($post_content);
    $post_title = $wpdb->escape($post_title);
    $post_excerpt = $wpdb->escape($post_excerpt);
    
    $sql = "UPDATE $tableposts 
        SET post_content = '$post_content',
        post_title = '$post_title',
        post_category = $post_category[0],
        post_status = '$post_status',
        post_date = '$post_date',
        post_excerpt = '$post_excerpt',
        ping_status = '$ping_status',
        comment_status = '$comment_status'
        WHERE ID = $ID";
        
    $result = $wpdb->query($sql);

    wp_set_post_cats('',$ID,$post_category);
    
    return $wpdb->rows_affected;
}

function wp_get_post_cats($blogid = '1', $post_ID = 0) {
    global $wpdb, $tablepost2cat;
    
    $sql = "SELECT category_id FROM $tablepost2cat WHERE post_id = $post_ID ORDER BY category_id";

    $result = $wpdb->get_col($sql);

    return $result;
}

function wp_set_post_cats($blogid = '1', $post_ID = 0, $post_categories = array()) {
    global $wpdb, $tablepost2cat;
    // If $post_categories isn't already an array, make it one:
    if (!is_array($post_categories)) {
        if (!$post_categories) {
            $post_categories = 1;
        }
        $post_categories = array($post_categories);
    }

    // First the old categories
    $old_categories = $wpdb->get_col("SELECT category_id FROM $tablepost2cat WHERE post_id = $post_ID");

    // Delete any?
    foreach ($old_categories as $old_cat) {
        if (!in_array($old_cat, $post_categories)) // If a category was there before but isn't now
            $wpdb->query("DELETE FROM $tablepost2cat WHERE category_id = $old_cat AND post_id = $post_ID LIMIT 1");
logio("O","deleting post/cat: $post_ID, $old_cat");
    }

    // Add any?
    foreach ($post_categories as $new_cat) {
        if (!in_array($new_cat, $old_categories))
            $wpdb->query("INSERT INTO $tablepost2cat (post_id, category_id) VALUES ($post_ID, $new_cat)");
logio("O","adding post/cat: $post_ID, $new_cat");
    }
}

function wp_delete_post($postid = 0) {
    global $wpdb, $tableposts, $tablepost2cat;
    
    $sql = "DELETE FROM $tablepost2cat WHERE post_id = $postid";
    $wpdb->query($sql);
        
    $sql = "DELETE FROM $tableposts WHERE ID = $postid";
    
    $wpdb->query($sql);

    $result = $wpdb->rows_affected;
    
    return $result;
}

/**** /DB Functions ****/

/**** Misc ****/

// get permalink from post ID
function post_permalink($post_ID=0, $mode = 'id') {
    global $wpdb;
    global $tableposts;
    global $siteurl, $blogfilename, $querystring_start, $querystring_equal, $querystring_separator;

    $blog_URL = $siteurl.'/'.$blogfilename;

    $postdata = get_postdata($post_ID);

    // this will probably change to $blog_ID = $postdata['Blog_ID'] one day.
    $blog_ID = 1;

    if (!($postdata===false)) {
    
        switch(strtolower($mode)) {
            case 'title':
                $title = preg_replace('/[^a-zA-Z0-9_\.-]/', '_', $postdata['Title']);
                break;
            case 'id':
            default:
                $title = "post-$post_ID";
                break;
        }

        // this code is blatantly derived from permalink_link()
        $archive_mode = get_settings('archive_mode');
        switch($archive_mode) {
            case 'daily':
                $post_URL = $blog_URL.$querystring_start.'m'.$querystring_equal.substr($postdata['Date'],0,4).substr($postdata['Date'],5,2).substr($postdata['Date'],8,2).'#'.$title;
                break;
            case 'monthly':
                $post_URL = $blog_URL.$querystring_start.'m'.$querystring_equal.substr($postdata['Date'],0,4).substr($postdata['Date'],5,2).'#'.$title;
                break;
            case 'weekly':
                if((!isset($cacheweekly)) || (empty($cacheweekly[$postdata['Date']]))) {
                    $sql = "SELECT WEEK('".$postdata['Date']."') as wk";
                        $row = $wpdb->get_row($sql);
                    $cacheweekly[$postdata['Date']] = $row->wk;
                }
                $post_URL = $blog_URL.$querystring_start.'m'.$querystring_equal.substr($postdata['Date'],0,4).$querystring_separator.'w'.$querystring_equal.$cacheweekly[$postdata['Date']].'#'.$title;
                break;
            case 'postbypost':
                $post_URL = $blog_URL.$querystring_start.'p'.$querystring_equal.$post_ID;
                break;
        }
    } 

    return $post_URL;
}

// Get the name of a category from its ID
function get_cat_name($cat_id) {
    global $wpdb,$tablecategories;
    
    $cat_id -= 0;     // force numeric
    $name = $wpdb->get_var("SELECT cat_name FROM $tablecategories WHERE cat_ID=$cat_id");
    
    return $name;
}

// Get the ID of a category from its name
function get_cat_ID($cat_name='General') {
    global $wpdb,$tablecategories;
    
    $cid = $wpdb->get_var("SELECT cat_ID FROM $tablecategories WHERE cat_name='$cat_name'");

    return $cid?$cid:1;    // default to cat 1
}

// Get author's preferred display name
function get_author_name($auth_id) {
    $authordata = get_userdata($auth_id);

    switch($authordata["user_idmode"]) {
        case "nickname":
            $authorname = $authordata["user_nickname"];

        case "login":
            $authorname = $authordata["user_login"];
            break;
    
        case "firstname":
            $authorname = $authordata["user_firstname"];
            break;

        case "lastname":
            $authorname = $authordata["user_lastname"];
            break;

        case "namefl":
            $authorname = $authordata["user_firstname"]." ".$authordata["user_lastname"];
            break;

        case "namelf":
            $authorname = $authordata["user_lastname"]." ".$authordata["user_firstname"];
            break;

        default:
            $authorname = $authordata["user_nickname"];
            break;
    }

    return $authorname;
}

// get extended entry info (<!--more-->)
function get_extended($post) {
    list($main,$extended) = explode('<!--more-->',$post);

    // Strip leading and trailing whitespace
    $main = preg_replace('/^[\s]*(.*)[\s]*$/','\\1',$main);
    $extended = preg_replace('/^[\s]*(.*)[\s]*$/','\\1',$extended);

    return array('main' => $main, 'extended' => $extended);
}

// do trackbacks for a list of urls
// borrowed from edit.php
// accepts a comma-separated list of trackback urls and a post id
function trackback_url_list($tb_list, $post_id) {
    if (!empty($tb_list)) {
        // get post data
        $postdata = wp_get_single_post($post_id, ARRAY_A);

        // import postdata as variables
        extract($postdata);
        
        // form an excerpt
        $excerpt = strip_tags($post_excerpt?$post_excerpt:$post_content);
        
        if (strlen($excerpt) > 255) {
            $exerpt = substr($excerpt,0,252) . '...';
        }
        
        $trackback_urls = explode(',', $tb_list);
        foreach($trackback_urls as $tb_url) {
            $tb_url = trim($tb_url);
            trackback($tb_url, stripslashes($post_title), $excerpt, $post_id);
        }
    }
}

/**** /Misc ****/

/**** B2 API ****/


# note: the b2 API currently consists of the Blogger API,
#       plus the following methods:
#
# b2.newPost , b2.getCategories

# Note: the b2 API will be replaced by the standard Weblogs.API once the specs are defined.


### b2.newPost ###

$wpnewpost_sig=array(array($xmlrpcString, $xmlrpcString, $xmlrpcString, $xmlrpcString, $xmlrpcString, $xmlrpcString, $xmlrpcBoolean, $xmlrpcString, $xmlrpcString, $xmlrpcString));

$wpnewpost_doc='Adds a post, blogger-api like, +title +category +postdate';

function b2newpost($m) {
    global $wpdb;

    global $xmlrpcerruser; // import user errcode value
    global $blog_ID,$cache_userdata,$tableposts,$use_rss,$use_weblogsping,$post_autobr;
    global $post_default_title,$post_default_category;
    global $cafelogID, $sleep_after_edit;
    $err="";


    $username=$m->getParam(2);
    $password=$m->getParam(3);
    $content=$m->getParam(4);
    $title=$m->getParam(6);
    $category=$m->getParam(7);
    $postdate=$m->getParam(8);

    $username = $username->scalarval();
    $password = $password->scalarval();
    $content = $content->scalarval();
    $title = $title->scalarval();
    $post_category = $category->scalarval();
    $postdate = $postdate->scalarval();


    if (user_pass_ok($username,$password)) {

        $userdata = get_userdatabylogin($username);
        $post_author = $userdata->ID;
        $user_level = $userdata->user_level;
        if ($user_level < 1) {
            return new xmlrpcresp(0, $xmlrpcerruser+1, // user error 1
       "Sorry, level 0 users can not post");
        }


        $post_content = format_to_post($content);
        $post_title = addslashes($title);


        $time_difference = get_settings("time_difference");
        if ($postdate != "") {
            $post_date = $postdate;
        } else {
            $post_date = date("Y-m-d H:i:s",(time() + ($time_difference * 3600)));
        }

        $post_data = compact('post_content','post_title','post_date','post_author','post_category');
        
        $result = wp_insert_post($post_data);

        if (!$result)
            return new xmlrpcresp(0, $xmlrpcerruser+2, // user error 2
       "For some strange yet very annoying reason, your entry couldn't be posted.");


        $post_ID = $result;

        if (!isset($blog_ID)) { $blog_ID = 1; }
        
        if (isset($sleep_after_edit) && $sleep_after_edit > 0) {
            sleep($sleep_after_edit);
        }



        pingWeblogs($blog_ID);
        pingCafelog($cafelogID, $post_title, $post_ID);
        pingBlogs($blog_ID);
        pingback($content, $post_ID);


        return new xmlrpcresp(new xmlrpcval("$post_ID"));

    } else {

        return new xmlrpcresp(0, $xmlrpcerruser+3, // user error 3
       'Wrong username/password combination '.$username.' / '.starify($password));
    }
}



### b2.getCategories ###

$wpgetcategories_sig=array(array($xmlrpcString, $xmlrpcString, $xmlrpcString, $xmlrpcString));

$wpgetcategories_doc='given a blogID, gives a struct that list categories in that blog, using categoryID and categoryName. categoryName is there so the user would choose a category name from the client, rather than just a number. however, when using b2.newPost, only the category ID number should be sent.';

function b2getcategories($m) {
    global $wpdb;
    global $xmlrpcerruser,$tablecategories;


    $blogid=$m->getParam(0);
    $blogid = $blogid->scalarval(); // we dot not use that yet, that will be used with multiple blogs

    $username=$m->getParam(1);
    $username = $username->scalarval();

    $password=$m->getParam(2);
    $password = $password->scalarval();

    $userdata = get_userdatabylogin($username);


    if (user_pass_ok($username,$password)) {

        $results = $wpdb->get_results("SELECT * FROM $tablecategories ORDER BY cat_ID ASC");
    if (!$results) die("Error getting data");
        $i = 0;
    foreach($results as $row) {
            $cat_name = $row->cat_name;
            $cat_ID = $row->cat_ID;

            $struct[$i] = new xmlrpcval(array("categoryID" => new xmlrpcval($cat_ID),
                                          "categoryName" => new xmlrpcval($cat_name)
                                          ),"struct");
            $i = $i + 1;
        }

        $data = array($struct[0]);
        for ($j=1; $j<$i; $j++) {
            array_push($data, $struct[$j]);
        }

        $resp = new xmlrpcval($data, "array");

        return new xmlrpcresp($resp);

    } else {
        return new xmlrpcresp(0, $xmlrpcerruser+3, // user error 3
       'Wrong username/password combination '.$username.' / '.starify($password));
    }
}



### b2.getPostURL ###

$wp_getPostURL_sig = array(array($xmlrpcString, $xmlrpcString, $xmlrpcString, $xmlrpcString, $xmlrpcString, $xmlrpcString));

$wp_getPostURL_doc = 'Given a blog ID, username, password, and a post ID, returns the URL to that post.';

function b2_getPostURL($m) {
    global $wpdb;
    global $xmlrpcerruser, $tableposts;
    global $siteurl, $blogfilename, $querystring_start, $querystring_equal, $querystring_separator;


    // ideally, this would be used:
    // $blog_ID = $m->getParam(0);
    // $blog_ID = $blog_ID->scalarval();
    // but right now, b2 handles only one blog, so... :P
    $blog_ID = 1;

    $username=$m->getParam(2);
    $username = $username->scalarval();

    $password=$m->getParam(3);
    $password = $password->scalarval();

    $post_ID = $m->getParam(4);
    $post_ID = intval($post_ID->scalarval());

    $userdata = get_userdatabylogin($username);

    if ($userdata->user_level < 1) {
        return new xmlrpcresp(0, $xmlrpcerruser+1, // user error 1
       "Sorry, users whose level is zero, can not use this method.");
    }

    if (user_pass_ok($username,$password)) {

        $blog_URL = $siteurl.'/'.$blogfilename;

        $postdata = get_postdata($post_ID);

        if (!($postdata===false)) {

            $title = preg_replace('/[^a-zA-Z0-9_\.-]/', '_', $postdata['Title']);

            // this code is blatantly derived from permalink_link()
            $archive_mode = get_settings('archive_mode');
            switch($archive_mode) {
                case 'daily':
                    $post_URL = $blog_URL.$querystring_start.'m'.$querystring_equal.substr($postdata['Date'],0,4).