enmi-conf.org: comparison wp/wp-includes/class-IXR.php

equal deleted inserted replaced

-:346c88efed21
+:5e2f62d02dcd
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
 * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * @package IXR
-* @since 1.5
+* @since 1.5.0
 *
 * @copyright  Incutio Ltd 2010 (http://www.incutio.com)
 * @version    1.7.4 7th September 2010
 * @author     Simon Willison
 * @link       http://scripts.incutio.com/xmlrpc/ Site/manual
 /**
 * IXR_Value
 *
 * @package IXR
-* @since 1.5
+* @since 1.5.0
 */
 class IXR_Value {
 var $data;
 var $type;
 }
 /**
 * Checks whether or not the supplied array is a struct or not
 *
-* @param unknown_type $array
+* @param array $array
 * @return boolean
 */
 function isStruct($array)
 {
 $expected = 0;
 /**
 * IXR_MESSAGE
 *
 * @package IXR
-* @since 1.5
+* @since 1.5.0
 *
 */
 class IXR_Message
 {
 var $message;
 function parse()
 {
 // first remove the XML declaration
 // merged from WP #10698 - this method avoids the RAM usage of preg_replace on very large messages
-$header = preg_replace( '/<\?xml.*?\?'.'>/', '', substr($this->message, 0, 100), 1);
+$header = preg_replace( '/<\?xml.*?\?'.'>/s', '', substr( $this->message, 0, 100 ), 1 );
-$this->message = substr_replace($this->message, $header, 0, 100);
+$this->message = trim( substr_replace( $this->message, $header, 0, 100 ) );
-if (trim($this->message) == '') {
+if ( '' == $this->message ) {
 return false;
 }
+// Then remove the DOCTYPE
+$header = preg_replace( '/^<!DOCTYPE[^>]*+>/i', '', substr( $this->message, 0, 200 ), 1 );
+$this->message = trim( substr_replace( $this->message, $header, 0, 200 ) );
+if ( '' == $this->message ) {
+return false;
+}
+// Check that the root tag is valid
+$root_tag = substr( $this->message, 0, strcspn( substr( $this->message, 0, 20 ), "> \t\r\n" ) );
+if ( '<!DOCTYPE' === strtoupper( $root_tag ) ) {
+return false;
+}
+if ( ! in_array( $root_tag, array( '<methodCall', '<methodResponse', '<fault' ) ) ) {
+return false;
+}
+// Bail if there are too many elements to parse
+$element_limit = 30000;
+if ( function_exists( 'apply_filters' ) ) {
+/**
+* Filter the number of elements to parse in an XML-RPC response.
+*
+* @since 4.0.0
+*
+* @param int $element_limit Default elements limit.
+*/
+$element_limit = apply_filters( 'xmlrpc_element_limit', $element_limit );
+}
+if ( $element_limit && 2 * $element_limit < substr_count( $this->message, '<' ) ) {
+return false;
+}
 $this->_parser = xml_parser_create();
 // Set XML parser to take the case of tags in to account
 xml_parser_set_option($this->_parser, XML_OPTION_CASE_FOLDING, false);
 // Set XML parser callback functions
 xml_set_object($this->_parser, $this);
 } else {
 // Add to array
 $this->_arraystructs[count($this->_arraystructs)-1][] = $value;
 }
 } else {
-// Just add as a paramater
+// Just add as a parameter
 $this->params[] = $value;
 }
 }
 $this->_currentTagContents = '';
 }
 /**
 * IXR_Server
 *
 * @package IXR
-* @since 1.5
+* @since 1.5.0
 */
 class IXR_Server
 {
 var $data;
 var $callbacks = array();
 function serve($data = false)
 {
 if (!$data) {
 if (isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] !== 'POST') {
-	header('Content-Type: text/plain'); // merged from WP #9093
+if ( function_exists( 'status_header' ) ) {
+status_header( 405 ); // WP #20986
+header( 'Allow: POST' );
+}
+header('Content-Type: text/plain'); // merged from WP #9093
 die('XML-RPC server accepts POST requests only.');
 }
 global $HTTP_RAW_POST_DATA;
 if (empty($HTTP_RAW_POST_DATA)) {
 }
 $method = $this->callbacks[$methodname];
 // Perform the callback and send the response
 if (count($args) == 1) {
-// If only one paramater just send that instead of the whole array
+// If only one parameter just send that instead of the whole array
 $args = $args[0];
 }
 // Are we dealing with a function or a method?
 if (is_string($method) && substr($method, 0, 5) == 'this:') {
 /**
 * IXR_Request
 *
 * @package IXR
-* @since 1.5
+* @since 1.5.0
 */
 class IXR_Request
 {
 var $method;
 var $args;
 /**
 * IXR_Client
 *
 * @package IXR
-* @since 1.5
+* @since 1.5.0
 *
 */
 class IXR_Client
 {
 var $server;
 $this->path = isset($bits['path']) ? $bits['path'] : '/';
 // Make absolutely sure we have a path
 if (!$this->path) {
 $this->path = '/';
+}
+if ( ! empty( $bits['query'] ) ) {
+$this->path .= '?' . $bits['query'];
 }
 } else {
 $this->server = $server;
 $this->path = $path;
 $this->port = $port;
 /**
 * IXR_Error
 *
 * @package IXR
-* @since 1.5
+* @since 1.5.0
 */
 class IXR_Error
 {
 var $code;
 var $message;
 /**
 * IXR_Date
 *
 * @package IXR
-* @since 1.5
+* @since 1.5.0
 */
 class IXR_Date {
 var $year;
 var $month;
 var $day;
 /**
 * IXR_Base64
 *
 * @package IXR
-* @since 1.5
+* @since 1.5.0
 */
 class IXR_Base64
 {
 var $data;
 /**
 * IXR_IntrospectionServer
 *
 * @package IXR
-* @since 1.5
+* @since 1.5.0
 */
 class IXR_IntrospectionServer extends IXR_Server
 {
 var $signatures;
 var $help;
 /**
 * IXR_ClientMulticall
 *
 * @package IXR
-* @since 1.5
+* @since 1.5.0
 */
 class IXR_ClientMulticall extends IXR_Client
 {
 var $calls = array();

changeset 5	5e2f62d02dcd
parent 0	d970ebf37754
child 7	cf61fcea0001