root/tags/2.1/xmlrpc.php

<?php

define('XMLRPC_REQUEST', true);

// Some browser-embedded clients send cookies. We don't want them.
$_COOKIE = array();

# fix for mozBlog and other cases where '<?xml' isn't on the very first line
if ( isset($HTTP_RAW_POST_DATA) )
    $HTTP_RAW_POST_DATA = trim($HTTP_RAW_POST_DATA);

include('./wp-config.php');

if ( isset( $_GET['rsd'] ) ) { // http://archipelago.phrasewise.com/rsd 
header('Content-type: text/xml; charset=' . get_option('blog_charset'), true);

?>
<?php echo '<?xml version="1.0" encoding="'.get_option('blog_charset').'"?'.'>'; ?>
<rsd version="1.0" xmlns="http://archipelago.phrasewise.com/rsd">
  <service>
    <engineName>WordPress</engineName>
    <engineLink>http://wordpress.org/</engineLink>
    <homePageLink><?php bloginfo_rss('url') ?></homePageLink>
    <apis>
      <api name="Movable Type" blogID="1" preferred="true" apiLink="<?php bloginfo_rss('url') ?>/xmlrpc.php" />
      <api name="MetaWeblog" blogID="1" preferred="false" apiLink="<?php bloginfo_rss('url') ?>/xmlrpc.php" />
      <api name="Blogger" blogID="1" preferred="false" apiLink="<?php bloginfo_rss('url') ?>/xmlrpc.php" />
    </apis>
  </service>
</rsd>
<?php
exit;
}

include_once(ABSPATH . 'wp-admin/admin-functions.php');
include_once(ABSPATH . WPINC . '/class-IXR.php');

// Turn off all warnings and errors.
// error_reporting(0);

$post_default_title = ""; // posts submitted via the xmlrpc interface get that title

$xmlrpc_logging = 0;

function logIO($io,$msg) {
    global $xmlrpc_logging;
    if ($xmlrpc_logging) {
        $fp = fopen("../xmlrpc.log","a+");
        $date = gmdate("Y-m-d H:i:s ");
        $iot = ($io == "I") ? " Input: " : " Output: ";
        fwrite($fp, "\n\n".$date.$iot.$msg);
        fclose($fp);
    }
    return true;
    }

function starify($string) {
    $i = strlen($string);
    return str_repeat('*', $i);
}

if ( isset($HTTP_RAW_POST_DATA) )
  logIO("I", $HTTP_RAW_POST_DATA);


class wp_xmlrpc_server extends IXR_Server {

    function wp_xmlrpc_server() {
        $this->methods = array(
            // Blogger API
            'blogger.getUsersBlogs' => 'this:blogger_getUsersBlogs',
            'blogger.getUserInfo' => 'this:blogger_getUserInfo',
            'blogger.getPost' => 'this:blogger_getPost',
            'blogger.getRecentPosts' => 'this:blogger_getRecentPosts',
            'blogger.getTemplate' => 'this:blogger_getTemplate',
            'blogger.setTemplate' => 'this:blogger_setTemplate',
            'blogger.newPost' => 'this:blogger_newPost',
            'blogger.editPost' => 'this:blogger_editPost',
            'blogger.deletePost' => 'this:blogger_deletePost',

            // MetaWeblog API (with MT extensions to structs)
            'metaWeblog.newPost' => 'this:mw_newPost',
            'metaWeblog.editPost' => 'this:mw_editPost',
            'metaWeblog.getPost' => 'this:mw_getPost',
            'metaWeblog.getRecentPosts' => 'this:mw_getRecentPosts',
            'metaWeblog.getCategories' => 'this:mw_getCategories',
            'metaWeblog.newMediaObject' => 'this:mw_newMediaObject',

            // MetaWeblog API aliases for Blogger API
            // see http://www.xmlrpc.com/stories/storyReader$2460
            'metaWeblog.deletePost' => 'this:blogger_deletePost',
            'metaWeblog.getTemplate' => 'this:blogger_getTemplate',
            'metaWeblog.setTemplate' => 'this:blogger_setTemplate',
            'metaWeblog.getUsersBlogs' => 'this:blogger_getUsersBlogs',

            // MovableType API
            'mt.getCategoryList' => 'this:mt_getCategoryList',
            'mt.getRecentPostTitles' => 'this:mt_getRecentPostTitles',
            'mt.getPostCategories' => 'this:mt_getPostCategories',
            'mt.setPostCategories' => 'this:mt_setPostCategories',
            'mt.supportedMethods' => 'this:mt_supportedMethods',
            'mt.supportedTextFilters' => 'this:mt_supportedTextFilters',
            'mt.getTrackbackPings' => 'this:mt_getTrackbackPings',
            'mt.publishPost' => 'this:mt_publishPost',

            // PingBack
            'pingback.ping' => 'this:pingback_ping',
            'pingback.extensions.getPingbacks' => 'this:pingback_extensions_getPingbacks',

            'demo.sayHello' => 'this:sayHello',
            'demo.addTwoNumbers' => 'this:addTwoNumbers'
        );
        $this->methods = apply_filters('xmlrpc_methods', $this->methods);
        $this->IXR_Server($this->methods);
    }

    function sayHello($args) {
        return 'Hello!';
    }

    function addTwoNumbers($args) {
        $number1 = $args[0];
        $number2 = $args[1];
        return $number1 + $number2;
    }

    function login_pass_ok($user_login, $user_pass) {
        if (!user_pass_ok($user_login, $user_pass)) {
            $this->error = new IXR_Error(403, 'Bad login/pass combination.');
            return false;
        }
        return true;
    }

    function escape(&$array) {
        global $wpdb;

        foreach ( (array) $array as $k => $v ) {
            if (is_array($v)) {
                $this->escape($array[$k]);
            } else if (is_object($v)) {
                //skip
            } else {
                $array[$k] = $wpdb->escape($v);
            }
        }
    }

    /* Blogger API functions
     * specs on http://plant.blogger.com/api and http://groups.yahoo.com/group/bloggerDev/
     */


    /* blogger.getUsersBlogs will make more sense once we support multiple blogs */
    function blogger_getUsersBlogs($args) {

        $this->escape($args);

      $user_login = $args[1];
      $user_pass  = $args[2];

      if (!$this->login_pass_ok($user_login, $user_pass)) {
        return $this->error;
      }

      set_current_user(0, $user_login);
      $is_admin = current_user_can('level_8');

      $struct = array(
        'isAdmin'  => $is_admin,
        'url'      => get_option('home') . '/',
        'blogid'   => '1',
        'blogName' => get_option('blogname')
      );

      return array($struct);
    }


    /* blogger.getUsersInfo gives your client some info about you, so you don't have to */
    function blogger_getUserInfo($args) {

        $this->escape($args);

        $user_login = $args[1];
        $user_pass  = $args[2];

        if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
        }

        $user_data = get_userdatabylogin($user_login);

        $struct = array(
            'nickname'  => $user_data->nickname,
            'userid'    => $user_data->ID,
            'url'       => $user_data->user_url,
            'email'     => $user_data->user_email,
            'lastname'  => $user_data->last_name,
            'firstname' => $user_data->first_name
        );

        return $struct;
    }


    /* blogger.getPost ...gets a post */
    function blogger_getPost($args) {

        $this->escape($args);

        $post_ID    = $args[1];
        $user_login = $args[2];
        $user_pass  = $args[3];

        if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
        }

        $user_data = get_userdatabylogin($user_login);
        $post_data = wp_get_single_post($post_ID, ARRAY_A);

        $categories = implode(',', wp_get_post_categories($post_ID));

        $content  = '<title>'.stripslashes($post_data['post_title']).'</title>';
        $content .= '<category>'.$categories.'</category>';
        $content .= stripslashes($post_data['post_content']);

        $struct = array(
            'userid'    => $post_data['post_author'],
            'dateCreated' => new IXR_Date(mysql2date('Ymd\TH:i:s', $post_data['post_date'])),
            'content'     => $content,
            'postid'  => $post_data['ID']
        );

        return $struct;
    }


    /* blogger.getRecentPosts ...gets recent posts */
    function blogger_getRecentPosts($args) {

        global $wpdb;

        $this->escape($args);

        $blog_ID    = $args[1]; /* though we don't use it yet */
        $user_login = $args[2];
        $user_pass  = $args[3];
        $num_posts  = $args[4];

        if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
        }

        $posts_list = wp_get_recent_posts($num_posts);

        if (!$posts_list) {
            $this->error = new IXR_Error(500, 'Either there are no posts, or something went wrong.');
            return $this->error;
        }

        foreach ($posts_list as $entry) {

            $post_date = mysql2date('Ymd\TH:i:s', $entry['post_date']);
            $categories = implode(',', wp_get_post_categories($entry['ID']));

            $content  = '<title>'.stripslashes($entry['post_title']).'</title>';
            $content .= '<category>'.$categories.'</category>';
            $content .= stripslashes($entry['post_content']);

            $struct[] = array(
                'userid' => $entry['post_author'],
                'dateCreated' => new IXR_Date($post_date),
                'content' => $content,
                'postid' => $entry['ID'],
            );

        }

        $recent_posts = array();
        for ($j=0; $j<count($struct); $j++) {
            array_push($recent_posts, $struct[$j]);
        }

        return $recent_posts;
    }


    /* blogger.getTemplate returns your blog_filename */
    function blogger_getTemplate($args) {

        $this->escape($args);

      $blog_ID    = $args[1];
      $user_login = $args[2];
      $user_pass  = $args[3];
      $template   = $args[4]; /* could be 'main' or 'archiveIndex', but we don't use it */

      if (!$this->login_pass_ok($user_login, $user_pass)) {
        return $this->error;
      }

      set_current_user(0, $user_login);
      if ( !current_user_can('edit_themes') ) {
        return new IXR_Error(401, 'Sorry, this user can not edit the template.');
      }

      /* warning: here we make the assumption that the weblog's URL is on the same server */
      $filename = get_option('home') . '/';
      $filename = preg_replace('#https?://.+?/#', $_SERVER['DOCUMENT_ROOT'].'/', $filename);

      $f = fopen($filename, 'r');
      $content = fread($f, filesize($filename));
      fclose($f);

      /* so it is actually editable with a windows/mac client */
      // FIXME: (or delete me) do we really want to cater to bad clients at the expense of good ones by BEEPing up their line breaks? commented.     $content = str_replace("\n", "\r\n", $content); 

      return $content;
    }


    /* blogger.setTemplate updates the content of blog_filename */
    function blogger_setTemplate($args) {

        $this->escape($args);

      $blog_ID    = $args[1];
      $user_login = $args[2];
      $user_pass  = $args[3];
      $content    = $args[4];
      $template   = $args[5]; /* could be 'main' or 'archiveIndex', but we don't use it */

      if (!$this->login_pass_ok($user_login, $user_pass)) {
        return $this->error;
      }

      set_current_user(0, $user_login);
      if ( !current_user_can('edit_themes') ) {
        return new IXR_Error(401, 'Sorry, this user can not edit the template.');
      }

      /* warning: here we make the assumption that the weblog's URL is on the same server */
      $filename = get_option('home') . '/';
      $filename = preg_replace('#https?://.+?/#', $_SERVER['DOCUMENT_ROOT'].'/', $filename);

      if ($f = fopen($filename, 'w+')) {
        fwrite($f, $content);
        fclose($f);
      } else {
        return new IXR_Error(500, 'Either the file is not writable, or something wrong happened. The file has not been updated.');
      }

      return true;
    }


    /* blogger.newPost ...creates a new post */
    function blogger_newPost($args) {

      global $wpdb;

        $this->escape($args);

      $blog_ID    = $args[1]; /* though we don't use it yet */
      $user_login = $args[2];
      $user_pass  = $args[3];
      $content    = $args[4];
      $publish    = $args[5];

      if (!$this->login_pass_ok($user_login, $user_pass)) {
        return $this->error;
      }
      
      $cap = ($publish) ? 'publish_posts' : 'edit_posts';
      $user = set_current_user(0, $user_login);
      if ( !current_user_can($cap) )
        return new IXR_Error(401, 'Sorry, you can not post on this weblog or category.');

      $post_status = ($publish) ? 'publish' : 'draft';

      $post_author = $user->ID;

      $post_title = xmlrpc_getposttitle($content);
      $post_category = xmlrpc_getpostcategory($content);
      $post_content = xmlrpc_removepostdata($content);

      $post_date = current_time('mysql');
      $post_date_gmt = current_time('mysql', 1);

      $post_data = compact('blog_ID', 'post_author', 'post_date', 'post_date_gmt', 'post_content', 'post_title', 'post_category', 'post_status');

      $post_ID = wp_insert_post($post_data);

      if (!$post_ID) {
        return new IXR_Error(500, 'Sorry, your entry could not be posted. Something wrong happened.');
      }
      $this->attach_uploads( $post_ID, $post_content );

      logIO('O', "Posted ! ID: $post_ID");

      return $post_ID;
    }


    /* blogger.editPost ...edits a post */
    function blogger_editPost($args) {

      global $wpdb;

        $this->escape($args);

      $post_ID     = $args[1];
      $user_login  = $args[2];
      $user_pass   = $args[3];
      $content     = $args[4];
      $publish     = $args[5];

      if (!$this->login_pass_ok($user_login, $user_pass)) {
        return $this->error;
      }

      $actual_post = wp_get_single_post($post_ID,ARRAY_A);

      if (!$actual_post) {
          return new IXR_Error(404, 'Sorry, no such post.');
      }

        $this->escape($actual_post);

      set_current_user(0, $user_login);
      if ( !current_user_can('edit_post', $post_ID) )
        return new IXR_Error(401, 'Sorry, you do not have the right to edit this post.');

      extract($actual_post);

      $post_title = xmlrpc_getposttitle($content);
      $post_category = xmlrpc_getpostcategory($content);
      $post_content = xmlrpc_removepostdata($content);

      $postdata = compact('ID', 'post_content', 'post_title', 'post_category', 'post_status', 'post_excerpt');

      $result = wp_update_post($postdata);

      if (!$result) {
          return new IXR_Error(500, 'For some strange yet very annoying reason, this post could not be edited.');
      }
      $this->attach_uploads( $ID, $post_content );

      return true;
    }


    /* blogger.deletePost ...deletes a post */
    function blogger_deletePost($args) {

      global $wpdb;

        $this->escape($args);

      $post_ID     = $args[1];
      $user_login  = $args[2];
      $user_pass   = $args[3];
      $publish     = $args[4];

      if (!$this->login_pass_ok($user_login, $user_pass)) {
        return $this->error;
      }

      $actual_post = wp_get_single_post($post_ID,ARRAY_A);

      if (!$actual_post) {
          return new IXR_Error(404, 'Sorry, no such post.');
      }

      set_current_user(0, $user_login);
      if ( !current_user_can('edit_post', $post_ID) )
        return new IXR_Error(401, 'Sorry, you do not have the right to delete this post.');

      $result = wp_delete_post($post_ID);

      if (!$result) {
          return new IXR_Error(500, 'For some strange yet very annoying reason, this post could not be deleted.');
      }

      return true;
    }



    /* MetaWeblog API functions
     * specs on wherever Dave Winer wants them to be
     */

    /* metaweblog.newPost creates a post */
    function mw_newPost($args) {

      global $wpdb, $post_default_category;

        $this->escape($args);

      $blog_ID     = $args[0]; // we will support this in the near future
      $user_login  = $args[1];
      $user_pass   = $args[2];
      $content_struct = $args[3];
      $publish     = $args[4];

      if (!$this->login_pass_ok($user_login, $user_pass)) {
        return $this->error;
      }

      $user = set_current_user(0, $user_login);
      if ( !current_user_can('publish_posts') )
        return new IXR_Error(401, 'Sorry, you can not post on this weblog or category.');

      $post_author = $user->ID;

      $post_title = $content_struct['title'];
      $post_content = apply_filters( 'content_save_pre', $content_struct['description'] );
      $post_status = $publish ? 'publish' : 'draft';