<?php

/**

 * XML-RPC protocol support for WordPress

 *

 * @package WordPress

 * @subpackage Publishing

 */

/**

 * WordPress XMLRPC server implementation.

 *

 * Implements compatibility for Blogger API, MetaWeblog API, MovableType, and

 * pingback. Additional WordPress API for managing comments, pages, posts,

 * options, etc.

 *

 * As of WordPress 3.5.0, XML-RPC is enabled by default. It can be disabled

 *

 * @since 1.5.0

 */

class wp_xmlrpc_server extends IXR_Server {

	/**

	 * @var array

	 */

	public $methods;

	/**

	 * @var array

	 */

	public $blog_options;

	/**

	 * @var IXR_Error

	 */

	public $error;

	/**

	 *

	 * Sets up server and method property. Passes XMLRPC

	 *

	 * @since 1.5.0

	 */

	public function __construct() {

		$this->methods = array(

			// WordPress API

			'wp.getUsersBlogs'		=> 'this:wp_getUsersBlogs',

			'wp.newPost'			=> 'this:wp_newPost',

			'wp.editPost'			=> 'this:wp_editPost',

			'wp.deletePost'			=> 'this:wp_deletePost',

			'wp.getPost'			=> 'this:wp_getPost',

			'wp.getPosts'			=> 'this:wp_getPosts',

			'wp.newTerm'			=> 'this:wp_newTerm',

			'wp.editTerm'			=> 'this:wp_editTerm',

			'wp.deleteTerm'			=> 'this:wp_deleteTerm',

			'wp.getTerm'			=> 'this:wp_getTerm',

			'wp.getTerms'			=> 'this:wp_getTerms',

			'wp.getTaxonomy'		=> 'this:wp_getTaxonomy',

			'wp.getTaxonomies'		=> 'this:wp_getTaxonomies',

			'wp.getUser'			=> 'this:wp_getUser',

			'wp.getUsers'			=> 'this:wp_getUsers',

			'wp.getProfile'			=> 'this:wp_getProfile',

			'wp.editProfile'		=> 'this:wp_editProfile',

			'wp.getPage'			=> 'this:wp_getPage',

			'wp.getPages'			=> 'this:wp_getPages',

			'wp.newPage'			=> 'this:wp_newPage',

			'wp.deletePage'			=> 'this:wp_deletePage',

			'wp.editPage'			=> 'this:wp_editPage',

			'wp.getPageList'		=> 'this:wp_getPageList',

			'wp.getAuthors'			=> 'this:wp_getAuthors',

			'wp.getCategories'		=> 'this:mw_getCategories',		// Alias

			'wp.getTags'			=> 'this:wp_getTags',

			'wp.newCategory'		=> 'this:wp_newCategory',

			'wp.deleteCategory'		=> 'this:wp_deleteCategory',

			'wp.suggestCategories'	=> 'this:wp_suggestCategories',

			'wp.uploadFile'			=> 'this:mw_newMediaObject',	// Alias

			'wp.deleteFile'			=> 'this:wp_deletePost',		// Alias

			'wp.getCommentCount'	=> 'this:wp_getCommentCount',

			'wp.getPostStatusList'	=> 'this:wp_getPostStatusList',

			'wp.getPageStatusList'	=> 'this:wp_getPageStatusList',

			'wp.getPageTemplates'	=> 'this:wp_getPageTemplates',

			'wp.getOptions'			=> 'this:wp_getOptions',

			'wp.setOptions'			=> 'this:wp_setOptions',

			'wp.getComment'			=> 'this:wp_getComment',

			'wp.getComments'		=> 'this:wp_getComments',

			'wp.deleteComment'		=> 'this:wp_deleteComment',

			'wp.editComment'		=> 'this:wp_editComment',

			'wp.newComment'			=> 'this:wp_newComment',

			'wp.getCommentStatusList' => 'this:wp_getCommentStatusList',

			'wp.getMediaItem'		=> 'this:wp_getMediaItem',

			'wp.getMediaLibrary'	=> 'this:wp_getMediaLibrary',

			'wp.getPostFormats'     => 'this:wp_getPostFormats',

			'wp.getPostType'		=> 'this:wp_getPostType',

			'wp.getPostTypes'		=> 'this:wp_getPostTypes',

			'wp.getRevisions'		=> 'this:wp_getRevisions',

			'wp.restoreRevision'	=> 'this:wp_restoreRevision',

			// Blogger API

			'blogger.getUsersBlogs' => 'this:blogger_getUsersBlogs',

			'blogger.getUserInfo' => 'this:blogger_getUserInfo',

			'blogger.getPost' => 'this:blogger_getPost',

			'blogger.getRecentPosts' => 'this:blogger_getRecentPosts',

			'blogger.newPost' => 'this:blogger_newPost',

			'blogger.editPost' => 'this:blogger_editPost',

			'blogger.deletePost' => 'this:blogger_deletePost',

			// MetaWeblog API (with MT extensions to structs)

			'metaWeblog.newPost' => 'this:mw_newPost',

			'metaWeblog.editPost' => 'this:mw_editPost',

			'metaWeblog.getPost' => 'this:mw_getPost',

			'metaWeblog.getRecentPosts' => 'this:mw_getRecentPosts',

			'metaWeblog.getCategories' => 'this:mw_getCategories',

			'metaWeblog.newMediaObject' => 'this:mw_newMediaObject',

			// MetaWeblog API aliases for Blogger API

			// see http://www.xmlrpc.com/stories/storyReader$2460

			'metaWeblog.deletePost' => 'this:blogger_deletePost',

			'metaWeblog.getUsersBlogs' => 'this:blogger_getUsersBlogs',

			// MovableType API

			'mt.getCategoryList' => 'this:mt_getCategoryList',

			'mt.getRecentPostTitles' => 'this:mt_getRecentPostTitles',

			'mt.getPostCategories' => 'this:mt_getPostCategories',

			'mt.setPostCategories' => 'this:mt_setPostCategories',

			'mt.supportedMethods' => 'this:mt_supportedMethods',

			'mt.supportedTextFilters' => 'this:mt_supportedTextFilters',

			'mt.getTrackbackPings' => 'this:mt_getTrackbackPings',

			'mt.publishPost' => 'this:mt_publishPost',

			// PingBack

			'pingback.ping' => 'this:pingback_ping',

			'pingback.extensions.getPingbacks' => 'this:pingback_extensions_getPingbacks',

			'demo.sayHello' => 'this:sayHello',

			'demo.addTwoNumbers' => 'this:addTwoNumbers'

		);

		$this->initialise_blog_option_info();

		/**

		 *

		 * This filter can be used to add new methods, and remove built-in methods.

		 *

		 * @since 1.5.0

		 *

		 * @param array $methods An array of XML-RPC methods.

		 */

		$this->methods = apply_filters( 'xmlrpc_methods', $this->methods );

	}

	/**

	 *

	 * @since 4.0.0

	 *

	 * @param callable $name      Method to call.

	 * @param array    $arguments Arguments to pass when calling.

	 */

	public function __call( $name, $arguments ) {

		if ( '_multisite_getUsersBlogs' === $name ) {

			return call_user_func_array( array( $this, $name ), $arguments );

		}

		return false;

	}

	public function serve_request() {

		$this->IXR_Server($this->methods);

	}

	/**

	 * Test XMLRPC API by saying, "Hello!" to client.

	 *

	 * @since 1.5.0

	 *

	 */

		return 'Hello!';

	}

	/**

	 * Test XMLRPC API by adding two numbers for client.

	 *

	 * @since 1.5.0

	 *

	 */

		$number1 = $args[0];

		$number2 = $args[1];

		return $number1 + $number2;

	}

	/**

	 * Log user in.

	 *

	 * @since 2.8.0

	 *

	 * @param string $username User's username.

	 * @param string $password User's password.

	 * @return WP_User|bool WP_User object if authentication passed, false otherwise

	 */

	public function login( $username, $password ) {

		/*

		 * Respect old get_option() filters left for back-compat when the 'enable_xmlrpc'

		 * option was deprecated in 3.5.0. Use the 'xmlrpc_enabled' hook instead.

		 */

		$enabled = apply_filters( 'pre_option_enable_xmlrpc', false );

		if ( false === $enabled ) {

			$enabled = apply_filters( 'option_enable_xmlrpc', true );

		}

		/**

		 *

		 *

		 * @since 3.5.0

		 *

		 * @param bool $enabled Whether XML-RPC is enabled. Default true.

		 */

		$enabled = apply_filters( 'xmlrpc_enabled', $enabled );

		if ( ! $enabled ) {

			$this->error = new IXR_Error( 405, sprintf( __( 'XML-RPC services are disabled on this site.' ) ) );

			return false;

		}

			$this->error = new IXR_Error( 403, __( 'Incorrect username or password.' ) );

			/**

			 *

			 * @since 3.5.0

			 *

			 * @param string  $error The XML-RPC error message.

			 * @param WP_User $user  WP_User object.

			 */

			$this->error = apply_filters( 'xmlrpc_login_error', $this->error, $user );

			return false;

		}

		wp_set_current_user( $user->ID );

		return $user;

	}

	/**

	 * Check user's credentials. Deprecated.

	 *

	 * @since 1.5.0

	 *

	 * @param string $username User's username.

	 * @param string $password User's password.

	 * @return bool Whether authentication passed.

	 */

	public function login_pass_ok( $username, $password ) {

		return (bool) $this->login( $username, $password );

	}

	/**

	 * Escape string or array of strings for database.

	 *

	 * @since 1.5.2

	 *

	 * @param string|array $data Escape single string or array of strings.

	 */

	public function escape( &$data ) {

		if ( ! is_array( $data ) )

			return wp_slash( $data );

		foreach ( $data as &$v ) {

			if ( is_array( $v ) )

				$this->escape( $v );

			elseif ( ! is_object( $v ) )

				$v = wp_slash( $v );

		}

	}

	/**

	 * Retrieve custom fields for post.

	 *

	 * @since 2.5.0

	 *

	 * @param int $post_id Post ID.

	 * @return array Custom fields, if exist.

	 */

	public function get_custom_fields($post_id) {

		$post_id = (int) $post_id;

		$custom_fields = array();

		foreach ( (array) has_meta($post_id) as $meta ) {

			// Don't expose protected fields.

			if ( ! current_user_can( 'edit_post_meta', $post_id , $meta['meta_key'] ) )

				continue;

			$custom_fields[] = array(

				"id"    => $meta['meta_id'],

				"key"   => $meta['meta_key'],

				"value" => $meta['meta_value']

			);

		}

		return $custom_fields;

	}

	/**

	 * Set custom fields for post.

	 *

	 * @since 2.5.0

	 *

	 * @param int $post_id Post ID.

	 * @param array $fields Custom fields.

	 */

	public function set_custom_fields($post_id, $fields) {

		$post_id = (int) $post_id;

		foreach ( (array) $fields as $meta ) {

			if ( isset($meta['id']) ) {

				$meta['id'] = (int) $meta['id'];

				$pmeta = get_metadata_by_mid( 'post', $meta['id'] );

				if ( isset($meta['key']) ) {

					$meta['key'] = wp_unslash( $meta['key'] );

					if ( $meta['key'] !== $pmeta->meta_key )

						continue;

					$meta['value'] = wp_unslash( $meta['value'] );

					if ( current_user_can( 'edit_post_meta', $post_id, $meta['key'] ) )

						update_metadata_by_mid( 'post', $meta['id'], $meta['value'] );

				} elseif ( current_user_can( 'delete_post_meta', $post_id, $pmeta->meta_key ) ) {

					delete_metadata_by_mid( 'post', $meta['id'] );

				}

			} elseif ( current_user_can( 'add_post_meta', $post_id, wp_unslash( $meta['key'] ) ) ) {

				add_post_meta( $post_id, $meta['key'], $meta['value'] );

			}

		}

	}

	/**

	 * Set up blog options property.

	 *

	 *

	 * @since 2.6.0

	 */

	public function initialise_blog_option_info() {

		$this->blog_options = array(

			// Read only options

			'software_name'     => array(

				'desc'          => __( 'Software Name' ),

				'readonly'      => true,

				'value'         => 'WordPress'

			),

			'software_version'  => array(

				'desc'          => __( 'Software Version' ),

				'readonly'      => true,

			),

			'blog_url'          => array(

				'desc'          => __( 'WordPress Address (URL)' ),

				'readonly'      => true,

				'option'        => 'siteurl'

			),

			'home_url'          => array(

				'desc'          => __( 'Site Address (URL)' ),

				'readonly'      => true,

				'option'        => 'home'

			),

			'login_url'          => array(

				'desc'          => __( 'Login Address (URL)' ),

				'readonly'      => true,

				'value'         => wp_login_url( )

			),

			'admin_url'          => array(

				'desc'          => __( 'The URL to the admin area' ),

				'readonly'      => true,

				'value'         => get_admin_url( )

			),

			'image_default_link_type' => array(

				'desc'          => __( 'Image default link type' ),

				'readonly'      => true,

				'option'        => 'image_default_link_type'

			),

			'image_default_size' => array(

				'desc'          => __( 'Image default size' ),

				'readonly'      => true,