Changeset 6503

Timestamp:

12/27/07 22:14:27 (6 months ago)

Author:

ryan

Message:

Some xmlrpc cap checks from josephscott.

Files:

• trunk/xmlrpc.php (modified) (15 diffs)

trunk/xmlrpc.php

@@ -231 +231 @@
-            return($this->error);
-        }
+
+        set_current_user( 0, $username );
+        if( !current_user_can( 'edit_page', $page_id ) )
+            return new IXR_Error( 401, __( 'Sorry, you can not edit this page.' ) );
-
-        do_action('xmlrpc_call', 'wp.getPage');
@@ -316 +320 @@
-        }
-
+        set_current_user( 0, $username );
+        if( !current_user_can( 'edit_pages' ) )
+            return new IXR_Error( 401, __( 'Sorry, you can not edit pages.' ) );
+
-        do_action('xmlrpc_call', 'wp.getPages');
-
@@ -482 +490 @@
-        }
-
+        set_current_user( 0, $username );
+        if( !current_user_can( 'edit_pages' ) )
+            return new IXR_Error( 401, __( 'Sorry, you can not edit pages.' ) );
+
-        do_action('xmlrpc_call', 'wp.getPageList');
-
@@ -647 +659 @@
-        }
-
+        set_current_user(0, $username);
+        if( !current_user_can( 'edit_posts' ) ) 
+            return new IXR_Error( 401, __( 'Sorry, you must be able to publish to this blog in order to view categories.' ) );
+
-        do_action('xmlrpc_call', 'wp.suggestCategories');
-
@@ -707 +723 @@
-        }
-
+        set_current_user( 0, $user_login );
+        if( !current_user_can( 'edit_posts' ) ) 
+            return new IXR_Error( 401, __( 'Sorry, you do not have access to user data on this blog.' ) );
+
-        do_action('xmlrpc_call', 'blogger.getUserInfo');
-
@@ -715 +735 @@
-            'userid'    => $user_data->ID,
-            'url'       => $user_data->user_url,
-            'email'     => $user_data->user_email,
-            'lastname'  => $user_data->last_name,
-            'firstname' => $user_data->first_name
@@ -736 +755 @@
-            return $this->error;
-        }
+
+        set_current_user( 0, $user_login );
+        if( !current_user_can( 'edit_post', $post_ID ) ) 
+            return new IXR_Error( 401, __( 'Sorry, you can not edit this post.' ) );
-
-        do_action('xmlrpc_call', 'blogger.getPost');
@@ -776 +799 @@
-        $posts_list = wp_get_recent_posts($num_posts);
-
+        set_current_user( 0, $user_login );
+
-        if (!$posts_list) {
-            $this->error = new IXR_Error(500, __('Either there are no posts, or something went wrong.'));
@@ -782 +807 @@
-
-        foreach ($posts_list as $entry) {
+            if( !current_user_can( 'edit_post', $entry['ID'] ) )
+                continue;
-
-            $post_date = mysql2date('Ymd\TH:i:s', $entry['post_date']);
@@ -1462 +1489 @@
-            return $this->error;
-        }
+
+        set_current_user( 0, $user_login );
+        if( !current_user_can( 'edit_post', $post_ID ) )
+            return new IXR_Error( 401, __( 'Sorry, you can not edit this post.' ) );
-
-        do_action('xmlrpc_call', 'metaWeblog.getPost');
@@ -1550 +1581 @@
-        }
-
-$this_user = 
+
-
-        foreach ($posts_list as $entry) {
-
-
-
-
-
-
+
+
-
-            $post_date = mysql2date('Ymd\TH:i:s', $entry['post_date']);
@@ -1638 +1665 @@
-        }
-
+        set_current_user( 0, $user_login );
+        if( !current_user_can( 'edit_posts' ) )
+            return new IXR_Error( 401, __( 'Sorry, you must be able to edit posts on this blog in order to view categories.' ) );
+
-        do_action('xmlrpc_call', 'metaWeblog.getCategories');
-
@@ -1761 +1792 @@
-        }
-
+        set_current_user( 0, $user_login );
+
-        foreach ($posts_list as $entry) {
+            if( !current_user_can( 'edit_post', $entry['ID'] ) ) 
+                continue;
-
-            $post_date = mysql2date('Ymd\TH:i:s', $entry['post_date']);
@@ -1798 +1833 @@
-        }
-
+        set_current_user( 0, $user_login );
+        if( !current_user_can( 'edit_posts' ) )
+            return new IXR_Error( 401, __( 'Sorry, you must be able to edit posts on this blog in order to view categories.' ) );
+
-        do_action('xmlrpc_call', 'mt.getCategoryList');
-
-        $categories_struct = array();
-
-        // FIXME: can we avoid using direct SQL there?
-        if ( $cats = get_categories('hide_empty=0&hierarchical=0') ) {
-            foreach ($cats as $cat) {
@@ -1828 +1866 @@
-            return $this->error;
-        }
+
+        set_current_user( 0, $user_login );
+        if( !current_user_can( 'edit_post', $post_ID ) )
+            return new IXR_Error( 401, __( 'Sorry, you can not edit this post.' ) );
-
-        do_action('xmlrpc_call', 'mt.getPostCategories');