root/trunk/xmlrpc.php

<?php
/**
 * XML-RPC protocol support for WordPress
 *
 * @license GPL v2 <./license.txt>
 * @package WordPress
 */

/**
 * Whether this is a XMLRPC Request
 *
 * @var bool
 */
define('XMLRPC_REQUEST', true);

// Some browser-embedded clients send cookies. We don't want them.
$_COOKIE = array();

// A bug in PHP < 5.2.2 makes $HTTP_RAW_POST_DATA not set by default,
// but we can do it ourself.
if ( !isset( $HTTP_RAW_POST_DATA ) ) {
    $HTTP_RAW_POST_DATA = file_get_contents( 'php://input' );
}

// fix for mozBlog and other cases where '<?xml' isn't on the very first line
if ( isset($HTTP_RAW_POST_DATA) )
    $HTTP_RAW_POST_DATA = trim($HTTP_RAW_POST_DATA);

/** Include the bootstrap for setting up WordPress environment */
include('./wp-load.php');

if ( isset( $_GET['rsd'] ) ) { // http://archipelago.phrasewise.com/rsd
header('Content-Type: text/xml; charset=' . get_option('blog_charset'), true);
?>
<?php echo '<?xml version="1.0" encoding="'.get_option('blog_charset').'"?'.'>'; ?>
<rsd version="1.0" xmlns="http://archipelago.phrasewise.com/rsd">
  <service>
    <engineName>WordPress</engineName>
    <engineLink>http://wordpress.org/</engineLink>
    <homePageLink><?php bloginfo_rss('url') ?></homePageLink>
    <apis>
      <api name="WordPress" blogID="1" preferred="true" apiLink="<?php bloginfo_rss('wpurl') ?>/xmlrpc.php" />
      <api name="Movable Type" blogID="1" preferred="false" apiLink="<?php bloginfo_rss('wpurl') ?>/xmlrpc.php" />
      <api name="MetaWeblog" blogID="1" preferred="false" apiLink="<?php bloginfo_rss('wpurl') ?>/xmlrpc.php" />
      <api name="Blogger" blogID="1" preferred="false" apiLink="<?php bloginfo_rss('wpurl') ?>/xmlrpc.php" />
      <api name="Atom" blogID="" preferred="false" apiLink="<?php echo apply_filters('atom_service_url', (get_bloginfo('url')."/wp-app.php/service"))?>" />
    </apis>
  </service>
</rsd>
<?php
exit;
}

include_once(ABSPATH . 'wp-admin/includes/admin.php');
include_once(ABSPATH . WPINC . '/class-IXR.php');

// Turn off all warnings and errors.
// error_reporting(0);

/**
 * Posts submitted via the xmlrpc interface get that title
 * @name post_default_title
 * @var string
 */
$post_default_title = "";

/**
 * Whether to enable XMLRPC Logging.
 *
 * @name xmlrpc_logging
 * @var int|bool
 */
$xmlrpc_logging = 0;

/**
 * logIO() - Writes logging info to a file.
 *
 * @uses $xmlrpc_logging
 * @package WordPress
 * @subpackage Logging
 *
 * @param string $io Whether input or output
 * @param string $msg Information describing logging reason.
 * @return bool Always return true
 */
function logIO($io,$msg) {
    global $xmlrpc_logging;
    if ($xmlrpc_logging) {
        $fp = fopen("../xmlrpc.log","a+");
        $date = gmdate("Y-m-d H:i:s ");
        $iot = ($io == "I") ? " Input: " : " Output: ";
        fwrite($fp, "\n\n".$date.$iot.$msg);
        fclose($fp);
    }
    return true;
}

if ( isset($HTTP_RAW_POST_DATA) )
    logIO("I", $HTTP_RAW_POST_DATA);

/**
 * @internal
 * Left undocumented to work on later. If you want to finish, then please do so.
 *
 * @package WordPress
 * @subpackage Publishing
 */
class wp_xmlrpc_server extends IXR_Server {

    function wp_xmlrpc_server() {
        $this->methods = array(
            // WordPress API
            'wp.getUsersBlogs'        => 'this:wp_getUsersBlogs',
            'wp.getPage'            => 'this:wp_getPage',
            'wp.getPages'            => 'this:wp_getPages',
            'wp.newPage'            => 'this:wp_newPage',
            'wp.deletePage'            => 'this:wp_deletePage',
            'wp.editPage'            => 'this:wp_editPage',
            'wp.getPageList'        => 'this:wp_getPageList',
            'wp.getAuthors'            => 'this:wp_getAuthors',
            'wp.getCategories'        => 'this:mw_getCategories',        // Alias
            'wp.newCategory'        => 'this:wp_newCategory',
            'wp.deleteCategory'        => 'this:wp_deleteCategory',
            'wp.suggestCategories'    => 'this:wp_suggestCategories',
            'wp.uploadFile'            => 'this:mw_newMediaObject',    // Alias
            'wp.getCommentCount'    => 'this:wp_getCommentCount',
            'wp.getPostStatusList'    => 'this:wp_getPostStatusList',
            'wp.getPageStatusList'    => 'this:wp_getPageStatusList',
            'wp.getPageTemplates'    => 'this:wp_getPageTemplates',
            'wp.getOptions'            => 'this:wp_getOptions',
            'wp.setOptions'            => 'this:wp_setOptions',

            // Blogger API
            'blogger.getUsersBlogs' => 'this:blogger_getUsersBlogs',
            'blogger.getUserInfo' => 'this:blogger_getUserInfo',
            'blogger.getPost' => 'this:blogger_getPost',
            'blogger.getRecentPosts' => 'this:blogger_getRecentPosts',
            'blogger.getTemplate' => 'this:blogger_getTemplate',
            'blogger.setTemplate' => 'this:blogger_setTemplate',
            'blogger.newPost' => 'this:blogger_newPost',
            'blogger.editPost' => 'this:blogger_editPost',
            'blogger.deletePost' => 'this:blogger_deletePost',

            // MetaWeblog API (with MT extensions to structs)
            'metaWeblog.newPost' => 'this:mw_newPost',
            'metaWeblog.editPost' => 'this:mw_editPost',
            'metaWeblog.getPost' => 'this:mw_getPost',
            'metaWeblog.getRecentPosts' => 'this:mw_getRecentPosts',
            'metaWeblog.getCategories' => 'this:mw_getCategories',
            'metaWeblog.newMediaObject' => 'this:mw_newMediaObject',

            // MetaWeblog API aliases for Blogger API
            // see http://www.xmlrpc.com/stories/storyReader$2460
            'metaWeblog.deletePost' => 'this:blogger_deletePost',
            'metaWeblog.getTemplate' => 'this:blogger_getTemplate',
            'metaWeblog.setTemplate' => 'this:blogger_setTemplate',
            'metaWeblog.getUsersBlogs' => 'this:blogger_getUsersBlogs',

            // MovableType API
            'mt.getCategoryList' => 'this:mt_getCategoryList',
            'mt.getRecentPostTitles' => 'this:mt_getRecentPostTitles',
            'mt.getPostCategories' => 'this:mt_getPostCategories',
            'mt.setPostCategories' => 'this:mt_setPostCategories',
            'mt.supportedMethods' => 'this:mt_supportedMethods',
            'mt.supportedTextFilters' => 'this:mt_supportedTextFilters',
            'mt.getTrackbackPings' => 'this:mt_getTrackbackPings',
            'mt.publishPost' => 'this:mt_publishPost',

            // PingBack
            'pingback.ping' => 'this:pingback_ping',
            'pingback.extensions.getPingbacks' => 'this:pingback_extensions_getPingbacks',

            'demo.sayHello' => 'this:sayHello',
            'demo.addTwoNumbers' => 'this:addTwoNumbers'
        );

        $this->initialise_blog_option_info( );
        $this->methods = apply_filters('xmlrpc_methods', $this->methods);
        $this->IXR_Server($this->methods);
    }

    function sayHello($args) {
        return 'Hello!';
    }

    function addTwoNumbers($args) {
        $number1 = $args[0];
        $number2 = $args[1];
        return $number1 + $number2;
    }

    function login_pass_ok($user_login, $user_pass) {
        if ( !get_option( 'enable_xmlrpc' ) ) {
            $this->error = new IXR_Error( 405, sprintf( __( 'XML-RPC services are disabled on this blog.  An admin user can enable them at %s'),  admin_url('options-writing.php') ) );
            return false;
        }

        if (!user_pass_ok($user_login, $user_pass)) {
            $this->error = new IXR_Error(403, __('Bad login/pass combination.'));
            return false;
        }
        return true;
    }

    function escape(&$array) {
        global $wpdb;

        if(!is_array($array)) {
            return($wpdb->escape($array));
        }
        else {
            foreach ( (array) $array as $k => $v ) {
                if (is_array($v)) {
                    $this->escape($array[$k]);
                } else if (is_object($v)) {
                    //skip
                } else {
                    $array[$k] = $wpdb->escape($v);
                }
            }
        }
    }

    function get_custom_fields($post_id) {
        $post_id = (int) $post_id;

        $custom_fields = array();

        foreach ( (array) has_meta($post_id) as $meta ) {
            // Don't expose protected fields.
            if ( strpos($meta['meta_key'], '_wp_') === 0 ) {
                continue;
            }

            $custom_fields[] = array(
                "id"    => $meta['meta_id'],
                "key"   => $meta['meta_key'],
                "value" => $meta['meta_value']
            );
        }

        return $custom_fields;
    }

    function set_custom_fields($post_id, $fields) {
        $post_id = (int) $post_id;

        foreach ( (array) $fields as $meta ) {
            if ( isset($meta['id']) ) {
                $meta['id'] = (int) $meta['id'];

                if ( isset($meta['key']) ) {
                    update_meta($meta['id'], $meta['key'], $meta['value']);
                }
                else {
                    delete_meta($meta['id']);
                }
            }
            else {
                $_POST['metakeyinput'] = $meta['key'];
                $_POST['metavalue'] = $meta['value'];
                add_meta($post_id);
            }
        }
    }

    function initialise_blog_option_info( ) {
        global $wp_version;

        $this->blog_options = array(
            // Read only options
            'software_name'        => array(
                'desc'            => __( 'Software Name' ),
                'readonly'        => true,
                'value'            => 'WordPress'
            ),
            'software_version'    => array(
                'desc'            => __( 'Software Version' ),
                'readonly'        => true,
                'value'            => $wp_version
            ),
            'blog_url'            => array(
                'desc'            => __( 'Blog URL' ),
                'readonly'        => true,
                'option'        => 'siteurl'
            ),

            // Updatable options
            'time_zone'            => array(
                'desc'            => __( 'Time Zone' ),
                'readonly'        => false,
                'option'        => 'gmt_offset'
            ),
            'blog_title'        => array(
                'desc'            => __( 'Blog Title' ),
                'readonly'        => false,
                'option'            => 'blogname'
            ),
            'blog_tagline'        => array(
                'desc'            => __( 'Blog Tagline' ),
                'readonly'        => false,
                'option'        => 'blogdescription'
            ),
            'date_format'        => array(
                'desc'            => __( 'Date Format' ),
                'readonly'        => false,
                'option'        => 'date_format'
            ),
            'time_format'        => array(
                'desc'            => __( 'Time Format' ),
                'readonly'        => false,
                'option'        => 'time_format'
            )
        );

        $this->blog_options = apply_filters( 'xmlrpc_blog_options', $this->blog_options );
    }

    /**
     * WordPress XML-RPC API
     * wp_getUsersBlogs
     */
    function wp_getUsersBlogs( $args ) {
        // If this isn't on WPMU then just use blogger_getUsersBlogs
        if( !function_exists( 'is_site_admin' ) ) {
            array_unshift( $args, 1 );
            return $this->blogger_getUsersBlogs( $args );
        }

        $this->escape( $args );

        $username = $args[0];
        $password = $args[1];

        if( !$this->login_pass_ok( $username, $password ) )
            return $this->error;

        do_action( 'xmlrpc_call', 'wp.getUsersBlogs' );

        $user = set_current_user( 0, $username );

        $blogs = (array) get_blogs_of_user( $user->ID );
        $struct = array( );

        foreach( $blogs as $blog ) {
            // Don't include blogs that aren't hosted at this site
            if( $blog->site_id != 1 )
                continue;

            $blog_id = $blog->userblog_id;
            switch_to_blog($blog_id);
            $is_admin = current_user_can('level_8');

            $struct[] = array(
                'isAdmin'        => $is_admin,
                'url'            => get_option( 'home' ) . '/',
                'blogid'        => $blog_id,
                'blogName'        => get_option( 'blogname' ),
                'xmlrpc'        => get_option( 'home' ) . '/xmlrpc.php'
            );
        }

        return $struct;
    }

    /**
     * WordPress XML-RPC API
     * wp_getPage
     */
    function wp_getPage($args) {
        $this->escape($args);

        $blog_id    = (int) $args[0];
        $page_id    = (int) $args[1];
        $username    = $args[2];
        $password    = $args[3];

        if(!$this->login_pass_ok($username, $password)) {
            return($this->error);
        }

        set_current_user( 0, $username );
        if( !current_user_can( 'edit_page', $page_id ) )
            return new IXR_Error( 401, __( 'Sorry, you can not edit this page.' ) );

        do_action('xmlrpc_call', 'wp.getPage');

        // Lookup page info.
        $page = get_page($page_id);

        // If we found the page then format the data.
        if($page->ID && ($page->post_type == "page")) {
            // Get all of the page content and link.
            $full_page = get_extended($page->post_content);
            $link = post_permalink($page->ID);

            // Get info the page parent if there is one.
            $parent_title = "";
            if(!empty($page->post_parent)) {
                $parent = get_page($page->post_parent);
                $parent_title = $parent->post_title;
            }

            // Determine comment and ping settings.
            $allow_comments = ("open" == $page->comment_status) ? 1 : 0;
            $allow_pings = ("open" == $page->ping_status) ? 1 : 0;

            // Format page date.
            $page_date = mysql2date("Ymd\TH:i:s", $page->post_date);
            $page_date_gmt = mysql2date("Ymd\TH:i:s", $page->post_date_gmt);

            // Pull the categories info together.
            $categories = array();
            foreach(wp_get_post_categories($page->ID) as $cat_id) {
                $categories[] = get_cat_name($cat_id);
            }

            // Get the author info.
            $author = get_userdata($page->post_author);

            $page_template = get_post_meta( $page->ID, '_wp_page_template', true );
            if( empty( $page_template ) )
                $page_template = 'default';

            $page_struct = array(
                "dateCreated"            => new IXR_Date($page_date),
                "userid"                => $page->post_author,
                "page_id"                => $page->ID,
                "page_status"            => $page->post_status,
                "description"            => $full_page["main"],
                "title"                    => $page->post_title,
                "link"                    => $link,
                "permaLink"                => $link,
                "categories"            => $categories,
                "excerpt"                => $page->post_excerpt,
                "text_more"                => $full_page["extended"],
                "mt_allow_comments"        => $allow_comments,
                "mt_allow_pings"        => $allow_pings,
                "wp_slug"                => $page->post_name,
                "wp_password"            => $page->post_password,
                "wp_author"                => $author->display_name,
                "wp_page_parent_id"        => $page->post_parent,
                "wp_page_parent_title"    => $parent_title,
                "wp_page_order"            => $page->menu_order,
                "wp_author_id"            => $author->ID,
                "wp_author_display_name"    => $author->display_name,
                "date_created_gmt"        => new IXR_Date($page_date_gmt),
                "custom_fields"            => $this->get_custom_fields($page_id),
                "wp_page_template"        => $page_template
            );

            return($page_struct);
        }
        // If the page doesn't exist indicate that.
        else {
            return(new IXR_Error(404, __("Sorry, no such page.")));
        }
    }

    /**
     * WordPress XML-RPC API
      * wp_getPages
     */
    function wp_getPages($args) {
        $this->escape($args);

        $blog_id    = (int) $args[0];
        $username    = $args[1];
        $password    = $args[2];

        if(!$this->login_pass_ok($username, $password)) {
            return($this->error);
        }

        set_current_user( 0, $username );
        if( !current_user_can( 'edit_pages' ) )
            return new IXR_Error( 401, __( 'Sorry, you can not edit pages.' ) );

        do_action('xmlrpc_call', 'wp.getPages');

        // Lookup info on pages.
        $pages = get_pages();
        $num_pages = count($pages);

        // If we have pages, put together their info.
        if($num_pages >= 1) {
            $pages_struct = array();

            for($i = 0; $i < $num_pages; $i++) {
                $page = wp_xmlrpc_server::wp_getPage(array(
                    $blog_id, $pages[$i]->ID, $username, $password
                ));
                $pages_struct[] = $page;
            }

            return($pages_struct);
        }
        // If no pages were found return an error.
        else {
            return(array());
        }
    }

    /**
     * WordPress XML-RPC API
      * wp_newPage
     */