<?php

/**

 * XML-RPC protocol support for WordPress.

 *

 * @package WordPress

 * @subpackage Publishing

 */

/**

 * WordPress XMLRPC server implementation.

 *

 * Implements compatibility for Blogger API, MetaWeblog API, MovableType, and

 * pingback. Additional WordPress API for managing comments, pages, posts,

 * options, etc.

 *

 * As of WordPress 3.5.0, XML-RPC is enabled by default. It can be disabled

 * via the {@see 'xmlrpc_enabled'} filter found in wp_xmlrpc_server::set_is_enabled().

 *

 * @since 1.5.0

 *

 * @see IXR_Server

 */

#[AllowDynamicProperties]

class wp_xmlrpc_server extends IXR_Server {

	/**

	 * Methods.

	 *

	 * @var array

	 */

	public $methods;

	/**

	 * Blog options.

	 *

	 * @var array

	 */

	public $blog_options;

	/**

	 * IXR_Error instance.

	 *

	 * @var IXR_Error

	 */

	public $error;

	/**

	 * Flags that the user authentication has failed in this instance of wp_xmlrpc_server.

	 *

	 * @var bool

	 */

	protected $auth_failed = false;

	/**

	 * Flags that XML-RPC is enabled

	 *

	 * @var bool

	 */

	private $is_enabled;

	/**

	 * Registers all of the XMLRPC methods that XMLRPC server understands.

	 *

	 * Sets up server and method property. Passes XMLRPC methods through the

	 * {@see 'xmlrpc_methods'} filter to allow plugins to extend or replace

	 * XML-RPC methods.

	 *

	 * @since 1.5.0

	 */

	public function __construct() {

		$this->methods = array(

			// WordPress API.

			'wp.getUsersBlogs'                 => 'this:wp_getUsersBlogs',

			'wp.newPost'                       => 'this:wp_newPost',

			'wp.editPost'                      => 'this:wp_editPost',

			'wp.deletePost'                    => 'this:wp_deletePost',

			'wp.getPost'                       => 'this:wp_getPost',

			'wp.getPosts'                      => 'this:wp_getPosts',

			'wp.newTerm'                       => 'this:wp_newTerm',

			'wp.editTerm'                      => 'this:wp_editTerm',

			'wp.deleteTerm'                    => 'this:wp_deleteTerm',

			'wp.getTerm'                       => 'this:wp_getTerm',

			'wp.getTerms'                      => 'this:wp_getTerms',

			'wp.getTaxonomy'                   => 'this:wp_getTaxonomy',

			'wp.getTaxonomies'                 => 'this:wp_getTaxonomies',

			'wp.getUser'                       => 'this:wp_getUser',

			'wp.getUsers'                      => 'this:wp_getUsers',

			'wp.getProfile'                    => 'this:wp_getProfile',

			'wp.editProfile'                   => 'this:wp_editProfile',

			'wp.getPage'                       => 'this:wp_getPage',

			'wp.getPages'                      => 'this:wp_getPages',

			'wp.newPage'                       => 'this:wp_newPage',

			'wp.deletePage'                    => 'this:wp_deletePage',

			'wp.editPage'                      => 'this:wp_editPage',

			'wp.getPageList'                   => 'this:wp_getPageList',

			'wp.getAuthors'                    => 'this:wp_getAuthors',

			'wp.getCategories'                 => 'this:mw_getCategories',     // Alias.

			'wp.getTags'                       => 'this:wp_getTags',

			'wp.newCategory'                   => 'this:wp_newCategory',

			'wp.deleteCategory'                => 'this:wp_deleteCategory',

			'wp.suggestCategories'             => 'this:wp_suggestCategories',

			'wp.uploadFile'                    => 'this:mw_newMediaObject',    // Alias.

			'wp.deleteFile'                    => 'this:wp_deletePost',        // Alias.

			'wp.getCommentCount'               => 'this:wp_getCommentCount',

			'wp.getPostStatusList'             => 'this:wp_getPostStatusList',

			'wp.getPageStatusList'             => 'this:wp_getPageStatusList',

			'wp.getPageTemplates'              => 'this:wp_getPageTemplates',

			'wp.getOptions'                    => 'this:wp_getOptions',

			'wp.setOptions'                    => 'this:wp_setOptions',

			'wp.getComment'                    => 'this:wp_getComment',

			'wp.getComments'                   => 'this:wp_getComments',

			'wp.deleteComment'                 => 'this:wp_deleteComment',

			'wp.editComment'                   => 'this:wp_editComment',

			'wp.newComment'                    => 'this:wp_newComment',

			'wp.getCommentStatusList'          => 'this:wp_getCommentStatusList',

			'wp.getMediaItem'                  => 'this:wp_getMediaItem',

			'wp.getMediaLibrary'               => 'this:wp_getMediaLibrary',

			'wp.getPostFormats'                => 'this:wp_getPostFormats',

			'wp.getPostType'                   => 'this:wp_getPostType',

			'wp.getPostTypes'                  => 'this:wp_getPostTypes',

			'wp.getRevisions'                  => 'this:wp_getRevisions',

			'wp.restoreRevision'               => 'this:wp_restoreRevision',

			// Blogger API.

			'blogger.getUsersBlogs'            => 'this:blogger_getUsersBlogs',

			'blogger.getUserInfo'              => 'this:blogger_getUserInfo',

			'blogger.getPost'                  => 'this:blogger_getPost',

			'blogger.getRecentPosts'           => 'this:blogger_getRecentPosts',

			'blogger.newPost'                  => 'this:blogger_newPost',

			'blogger.editPost'                 => 'this:blogger_editPost',

			'blogger.deletePost'               => 'this:blogger_deletePost',

			// MetaWeblog API (with MT extensions to structs).

			'metaWeblog.newPost'               => 'this:mw_newPost',

			'metaWeblog.editPost'              => 'this:mw_editPost',

			'metaWeblog.getPost'               => 'this:mw_getPost',

			'metaWeblog.getRecentPosts'        => 'this:mw_getRecentPosts',

			'metaWeblog.getCategories'         => 'this:mw_getCategories',

			'metaWeblog.newMediaObject'        => 'this:mw_newMediaObject',

			/*

			 * MetaWeblog API aliases for Blogger API.

			 * See http://www.xmlrpc.com/stories/storyReader$2460

			 */

			'metaWeblog.deletePost'            => 'this:blogger_deletePost',

			'metaWeblog.getUsersBlogs'         => 'this:blogger_getUsersBlogs',

			// MovableType API.

			'mt.getCategoryList'               => 'this:mt_getCategoryList',

			'mt.getRecentPostTitles'           => 'this:mt_getRecentPostTitles',

			'mt.getPostCategories'             => 'this:mt_getPostCategories',

			'mt.setPostCategories'             => 'this:mt_setPostCategories',

			'mt.supportedMethods'              => 'this:mt_supportedMethods',

			'mt.supportedTextFilters'          => 'this:mt_supportedTextFilters',

			'mt.getTrackbackPings'             => 'this:mt_getTrackbackPings',

			'mt.publishPost'                   => 'this:mt_publishPost',

			// Pingback.

			'pingback.ping'                    => 'this:pingback_ping',

			'pingback.extensions.getPingbacks' => 'this:pingback_extensions_getPingbacks',

			'demo.sayHello'                    => 'this:sayHello',

			'demo.addTwoNumbers'               => 'this:addTwoNumbers',

		);

		$this->initialise_blog_option_info();

		/**

		 * Filters the methods exposed by the XML-RPC server.

		 *

		 * This filter can be used to add new methods, and remove built-in methods.

		 *

		 * @since 1.5.0

		 *

		 * @param string[] $methods An array of XML-RPC methods, keyed by their methodName.

		 */

		$this->methods = apply_filters( 'xmlrpc_methods', $this->methods );

		$this->set_is_enabled();

	}

	/**

	 * Sets wp_xmlrpc_server::$is_enabled property.

	 *

	 * Determines whether the xmlrpc server is enabled on this WordPress install

	 * and set the is_enabled property accordingly.

	 *

	 * @since 5.7.3

	 */

	private function set_is_enabled() {

		/*

		 * Respect old get_option() filters left for back-compat when the 'enable_xmlrpc'

		 * option was deprecated in 3.5.0. Use the {@see 'xmlrpc_enabled'} hook instead.

		 */

		$is_enabled = apply_filters( 'pre_option_enable_xmlrpc', false );

		if ( false === $is_enabled ) {

			$is_enabled = apply_filters( 'option_enable_xmlrpc', true );

		}

		/**

		 * Filters whether XML-RPC methods requiring authentication are enabled.

		 *

		 * Contrary to the way it's named, this filter does not control whether XML-RPC is *fully*

		 * enabled, rather, it only controls whether XML-RPC methods requiring authentication -

		 * such as for publishing purposes - are enabled.

		 *

		 * Further, the filter does not control whether pingbacks or other custom endpoints that don't

		 * require authentication are enabled. This behavior is expected, and due to how parity was matched

		 * with the `enable_xmlrpc` UI option the filter replaced when it was introduced in 3.5.

		 *

		 * To disable XML-RPC methods that require authentication, use:

		 *

		 *     add_filter( 'xmlrpc_enabled', '__return_false' );

		 *

		 * For more granular control over all XML-RPC methods and requests, see the {@see 'xmlrpc_methods'}

		 * and {@see 'xmlrpc_element_limit'} hooks.

		 *

		 * @since 3.5.0

		 *

		 * @param bool $is_enabled Whether XML-RPC is enabled. Default true.

		 */

		$this->is_enabled = apply_filters( 'xmlrpc_enabled', $is_enabled );

	}

	/**

	 * Makes private/protected methods readable for backward compatibility.

	 *

	 * @since 4.0.0

	 *

	 * @param string $name      Method to call.

	 * @param array  $arguments Arguments to pass when calling.

	 * @return array|IXR_Error|false Return value of the callback, false otherwise.

	 */

	public function __call( $name, $arguments ) {

		if ( '_multisite_getUsersBlogs' === $name ) {

			return $this->_multisite_getUsersBlogs( ...$arguments );

		}

		return false;

	}

	/**

	 * Serves the XML-RPC request.

	 *

	 * @since 2.9.0

	 */

	public function serve_request() {

		$this->IXR_Server( $this->methods );

	}

	/**

	 * Tests XMLRPC API by saying, "Hello!" to client.

	 *

	 * @since 1.5.0

	 *

	 * @return string Hello string response.

	 */

	public function sayHello() {

		return 'Hello!';

	}

	/**

	 * Tests XMLRPC API by adding two numbers for client.

	 *

	 * @since 1.5.0

	 *

	 * @param array $args {

	 *     Method arguments. Note: arguments must be ordered as documented.

	 *

	 *     @type int $0 A number to add.

	 *     @type int $1 A second number to add.

	 * }

	 * @return int Sum of the two given numbers.

	 */

	public function addTwoNumbers( $args ) {

		$number1 = $args[0];

		$number2 = $args[1];

		return $number1 + $number2;

	}

	/**

	 * Logs user in.

	 *

	 * @since 2.8.0

	 *

	 * @param string $username User's username.

	 * @param string $password User's password.

	 * @return WP_User|false WP_User object if authentication passed, false otherwise.

	 */

	public function login(

		$username,

		#[\SensitiveParameter]

		$password

	) {

		if ( ! $this->is_enabled ) {

			$this->error = new IXR_Error( 405, sprintf( __( 'XML-RPC services are disabled on this site.' ) ) );

			return false;

		}

		if ( $this->auth_failed ) {

			$user = new WP_Error( 'login_prevented' );

		} else {

			$user = wp_authenticate( $username, $password );

		}

		if ( is_wp_error( $user ) ) {

			$this->error = new IXR_Error( 403, __( 'Incorrect username or password.' ) );

			// Flag that authentication has failed once on this wp_xmlrpc_server instance.

			$this->auth_failed = true;

			/**

			 * Filters the XML-RPC user login error message.

			 *

			 * @since 3.5.0

			 *

			 * @param IXR_Error $error The XML-RPC error message.

			 * @param WP_Error  $user  WP_Error object.

			 */

			$this->error = apply_filters( 'xmlrpc_login_error', $this->error, $user );

			return false;

		}

		wp_set_current_user( $user->ID );

		return $user;

	}

	/**

	 * Checks user's credentials. Deprecated.

	 *

	 * @since 1.5.0

	 * @deprecated 2.8.0 Use wp_xmlrpc_server::login()

	 * @see wp_xmlrpc_server::login()

	 *

	 * @param string $username User's username.

	 * @param string $password User's password.

	 * @return bool Whether authentication passed.

	 */

	public function login_pass_ok(

		$username,

		#[\SensitiveParameter]

		$password

	) {

		return (bool) $this->login( $username, $password );

	}

	/**

	 * Escapes string or array of strings for database.

	 *

	 * @since 1.5.2

	 *

	 * @param string|array $data Escape single string or array of strings.

	 * @return string|void Returns with string is passed, alters by-reference

	 *                     when array is passed.

	 */

	public function escape( &$data ) {

		if ( ! is_array( $data ) ) {

			return wp_slash( $data );

		}

		foreach ( $data as &$v ) {

			if ( is_array( $v ) ) {

				$this->escape( $v );

			} elseif ( ! is_object( $v ) ) {

				$v = wp_slash( $v );

			}

		}

	}

	/**

	 * Sends error response to client.

	 *

	 * Sends an XML error response to the client. If the endpoint is enabled

	 * an HTTP 200 response is always sent per the XML-RPC specification.

	 *

	 * @since 5.7.3

	 *

	 * @param IXR_Error|string $error   Error code or an error object.

	 * @param false            $message Error message. Optional.

	 */

	public function error( $error, $message = false ) {

		// Accepts either an error object or an error code and message

		if ( $message && ! is_object( $error ) ) {

			$error = new IXR_Error( $error, $message );

		}

		if ( ! $this->is_enabled ) {

			status_header( $error->code );

		}

		$this->output( $error->getXml() );

	}

	/**

	 * Retrieves custom fields for post.

	 *

	 * @since 2.5.0

	 *

	 * @param int $post_id Post ID.

	 * @return array Custom fields, if exist.

	 */

	public function get_custom_fields( $post_id ) {

		$post_id = (int) $post_id;

		$custom_fields = array();

		foreach ( (array) has_meta( $post_id ) as $meta ) {

			// Don't expose protected fields.

			if ( ! current_user_can( 'edit_post_meta', $post_id, $meta['meta_key'] ) ) {

				continue;

			}

			$custom_fields[] = array(

				'id'    => $meta['meta_id'],

				'key'   => $meta['meta_key'],

				'value' => $meta['meta_value'],

			);

		}

		return $custom_fields;

	}

	/**

	 * Sets custom fields for post.

	 *

	 * @since 2.5.0

	 *

	 * @param int   $post_id Post ID.

	 * @param array $fields  Custom fields.

	 */

	public function set_custom_fields( $post_id, $fields ) {

		$post_id = (int) $post_id;

		foreach ( (array) $fields as $meta ) {

			if ( isset( $meta['id'] ) ) {

				$meta['id'] = (int) $meta['id'];

				$pmeta      = get_metadata_by_mid( 'post', $meta['id'] );

				if ( ! $pmeta || (int) $pmeta->post_id !== $post_id ) {

					continue;

				}

				if ( isset( $meta['key'] ) ) {

					$meta['key'] = wp_unslash( $meta['key'] );

					if ( $meta['key'] !== $pmeta->meta_key ) {

						continue;

					}

					$meta['value'] = wp_unslash( $meta['value'] );

					if ( current_user_can( 'edit_post_meta', $post_id, $meta['key'] ) ) {

						update_metadata_by_mid( 'post', $meta['id'], $meta['value'] );

					}

				} elseif ( current_user_can( 'delete_post_meta', $post_id, $pmeta->meta_key ) ) {

					delete_metadata_by_mid( 'post', $meta['id'] );

				}

			} elseif ( current_user_can( 'add_post_meta', $post_id, wp_unslash( $meta['key'] ) ) ) {

				add_post_meta( $post_id, $meta['key'], $meta['value'] );

			}

		}

	}

	/**

	 * Retrieves custom fields for a term.

	 *

	 * @since 4.9.0

	 *

	 * @param int $term_id Term ID.

	 * @return array Array of custom fields, if they exist.

	 */

	public function get_term_custom_fields( $term_id ) {

		$term_id = (int) $term_id;

		$custom_fields = array();

		foreach ( (array) has_term_meta( $term_id ) as $meta ) {

			if ( ! current_user_can( 'edit_term_meta', $term_id ) ) {

				continue;

			}

			$custom_fields[] = array(

				'id'    => $meta['meta_id'],

				'key'   => $meta['meta_key'],

				'value' => $meta['meta_value'],

			);

		}

		return $custom_fields;

	}

	/**

	 * Sets custom fields for a term.

	 *

	 * @since 4.9.0

	 *

	 * @param int   $term_id Term ID.

	 * @param array $fields  Custom fields.