<?php

/**

 * XML-RPC protocol support for WordPress

 *

 * @package WordPress

 */

/**

 * WordPress XMLRPC server implementation.

 *

 * Implements compatibility for Blogger API, MetaWeblog API, MovableType, and

 * pingback. Additional WordPress API for managing comments, pages, posts,

 * options, etc.

 *

 * Since WordPress 2.6.0, WordPress XMLRPC server can be disabled in the

 * administration panels.

 *

 * @package WordPress

 * @subpackage Publishing

 * @since 1.5.0

 */

class wp_xmlrpc_server extends IXR_Server {

	/**

	 * Register all of the XMLRPC methods that XMLRPC server understands.

	 *

	 * Sets up server and method property. Passes XMLRPC

	 * methods through the 'xmlrpc_methods' filter to allow plugins to extend

	 * or replace XMLRPC methods.

	 *

	 * @since 1.5.0

	 *

	 * @return wp_xmlrpc_server

	 */

	function __construct() {

		$this->methods = array(

			// WordPress API

			'wp.getUsersBlogs'		=> 'this:wp_getUsersBlogs',

			'wp.newPost'			=> 'this:wp_newPost',

			'wp.editPost'			=> 'this:wp_editPost',

			'wp.deletePost'			=> 'this:wp_deletePost',

			'wp.getPost'			=> 'this:wp_getPost',

			'wp.getPosts'			=> 'this:wp_getPosts',

			'wp.newTerm'			=> 'this:wp_newTerm',

			'wp.editTerm'			=> 'this:wp_editTerm',

			'wp.deleteTerm'			=> 'this:wp_deleteTerm',

			'wp.getTerm'			=> 'this:wp_getTerm',

			'wp.getTerms'			=> 'this:wp_getTerms',

			'wp.getTaxonomy'		=> 'this:wp_getTaxonomy',

			'wp.getTaxonomies'		=> 'this:wp_getTaxonomies',

			'wp.getUser'			=> 'this:wp_getUser',

			'wp.getUsers'			=> 'this:wp_getUsers',

			'wp.getProfile'			=> 'this:wp_getProfile',

			'wp.editProfile'		=> 'this:wp_editProfile',

			'wp.getPage'			=> 'this:wp_getPage',

			'wp.getPages'			=> 'this:wp_getPages',

			'wp.newPage'			=> 'this:wp_newPage',

			'wp.deletePage'			=> 'this:wp_deletePage',

			'wp.editPage'			=> 'this:wp_editPage',

			'wp.getPageList'		=> 'this:wp_getPageList',

			'wp.getAuthors'			=> 'this:wp_getAuthors',

			'wp.getCategories'		=> 'this:mw_getCategories',		// Alias

			'wp.getTags'			=> 'this:wp_getTags',

			'wp.newCategory'		=> 'this:wp_newCategory',

			'wp.deleteCategory'		=> 'this:wp_deleteCategory',

			'wp.suggestCategories'	=> 'this:wp_suggestCategories',

			'wp.uploadFile'			=> 'this:mw_newMediaObject',	// Alias

			'wp.getCommentCount'	=> 'this:wp_getCommentCount',

			'wp.getPostStatusList'	=> 'this:wp_getPostStatusList',

			'wp.getPageStatusList'	=> 'this:wp_getPageStatusList',

			'wp.getPageTemplates'	=> 'this:wp_getPageTemplates',

			'wp.getOptions'			=> 'this:wp_getOptions',

			'wp.setOptions'			=> 'this:wp_setOptions',

			'wp.getComment'			=> 'this:wp_getComment',

			'wp.getComments'		=> 'this:wp_getComments',

			'wp.deleteComment'		=> 'this:wp_deleteComment',

			'wp.editComment'		=> 'this:wp_editComment',

			'wp.newComment'			=> 'this:wp_newComment',

			'wp.getCommentStatusList' => 'this:wp_getCommentStatusList',

			'wp.getMediaItem'		=> 'this:wp_getMediaItem',

			'wp.getMediaLibrary'	=> 'this:wp_getMediaLibrary',

			'wp.getPostFormats'     => 'this:wp_getPostFormats',

			'wp.getPostType'		=> 'this:wp_getPostType',

			'wp.getPostTypes'		=> 'this:wp_getPostTypes',

			'wp.getRevisions'		=> 'this:wp_getRevisions',

			'wp.restoreRevision'	=> 'this:wp_restoreRevision',

			// Blogger API

			'blogger.getUsersBlogs' => 'this:blogger_getUsersBlogs',

			'blogger.getUserInfo' => 'this:blogger_getUserInfo',

			'blogger.getPost' => 'this:blogger_getPost',

			'blogger.getRecentPosts' => 'this:blogger_getRecentPosts',

			'blogger.newPost' => 'this:blogger_newPost',

			'blogger.editPost' => 'this:blogger_editPost',

			'blogger.deletePost' => 'this:blogger_deletePost',

			// MetaWeblog API (with MT extensions to structs)

			'metaWeblog.newPost' => 'this:mw_newPost',

			'metaWeblog.editPost' => 'this:mw_editPost',

			'metaWeblog.getPost' => 'this:mw_getPost',

			'metaWeblog.getRecentPosts' => 'this:mw_getRecentPosts',

			'metaWeblog.getCategories' => 'this:mw_getCategories',

			'metaWeblog.newMediaObject' => 'this:mw_newMediaObject',

			// MetaWeblog API aliases for Blogger API

			// see http://www.xmlrpc.com/stories/storyReader$2460

			'metaWeblog.deletePost' => 'this:blogger_deletePost',

			'metaWeblog.getUsersBlogs' => 'this:blogger_getUsersBlogs',

			// MovableType API

			'mt.getCategoryList' => 'this:mt_getCategoryList',

			'mt.getRecentPostTitles' => 'this:mt_getRecentPostTitles',

			'mt.getPostCategories' => 'this:mt_getPostCategories',

			'mt.setPostCategories' => 'this:mt_setPostCategories',

			'mt.supportedMethods' => 'this:mt_supportedMethods',

			'mt.supportedTextFilters' => 'this:mt_supportedTextFilters',

			'mt.getTrackbackPings' => 'this:mt_getTrackbackPings',

			'mt.publishPost' => 'this:mt_publishPost',

			// PingBack

			'pingback.ping' => 'this:pingback_ping',

			'pingback.extensions.getPingbacks' => 'this:pingback_extensions_getPingbacks',

			'demo.sayHello' => 'this:sayHello',

			'demo.addTwoNumbers' => 'this:addTwoNumbers'

		);

		$this->initialise_blog_option_info();

		$this->methods = apply_filters('xmlrpc_methods', $this->methods);

	}

	function serve_request() {

		$this->IXR_Server($this->methods);

	}

	/**

	 * Test XMLRPC API by saying, "Hello!" to client.

	 *

	 * @since 1.5.0

	 *

	 * @param array $args Method Parameters.

	 * @return string

	 */

	function sayHello($args) {

		return 'Hello!';

	}

	/**

	 * Test XMLRPC API by adding two numbers for client.

	 *

	 * @since 1.5.0

	 *

	 * @param array $args Method Parameters.

	 * @return int

	 */

	function addTwoNumbers($args) {

		$number1 = $args[0];

		$number2 = $args[1];

		return $number1 + $number2;

	}

	/**

	 * Log user in.

	 *

	 * @since 2.8.0

	 *

	 * @param string $username User's username.

	 * @param string $password User's password.

	 * @return mixed WP_User object if authentication passed, false otherwise

	 */

	function login( $username, $password ) {

		// Respect any old filters against get_option() for 'enable_xmlrpc'.

		$enabled = apply_filters( 'pre_option_enable_xmlrpc', false ); // Deprecated

		if ( false === $enabled )

			$enabled = apply_filters( 'option_enable_xmlrpc', true ); // Deprecated

		// Proper filter for turning off XML-RPC. It is on by default.

		$enabled = apply_filters( 'xmlrpc_enabled', $enabled );

		if ( ! $enabled ) {

			$this->error = new IXR_Error( 405, sprintf( __( 'XML-RPC services are disabled on this site.' ) ) );

			return false;

		}

		$user = wp_authenticate($username, $password);

		if (is_wp_error($user)) {

			$this->error = new IXR_Error( 403, __( 'Incorrect username or password.' ) );

			$this->error = apply_filters( 'xmlrpc_login_error', $this->error, $user );

			return false;

		}

		wp_set_current_user( $user->ID );

		return $user;

	}

	/**

	 * Check user's credentials. Deprecated.

	 *

	 * @since 1.5.0

	 * @deprecated 2.8.0

	 * @deprecated use wp_xmlrpc_server::login

	 * @see wp_xmlrpc_server::login

	 *

	 * @param string $username User's username.

	 * @param string $password User's password.

	 * @return bool Whether authentication passed.

	 */

	function login_pass_ok( $username, $password ) {

		return (bool) $this->login( $username, $password );

	}

	/**

	 * Sanitize string or array of strings for database.

	 *

	 * @since 1.5.2

	 *

	 * @param string|array $array Sanitize single string or array of strings.

	 * @return string|array Type matches $array and sanitized for the database.

	 */

	function escape(&$array) {

		global $wpdb;

		if (!is_array($array)) {

			return($wpdb->escape($array));

		} else {

			foreach ( (array) $array as $k => $v ) {

				if ( is_array($v) ) {

					$this->escape($array[$k]);

				} else if ( is_object($v) ) {

					//skip

				} else {

					$array[$k] = $wpdb->escape($v);

				}

			}

		}

	}

	/**

	 * Retrieve custom fields for post.

	 *

	 * @since 2.5.0

	 *

	 * @param int $post_id Post ID.

	 * @return array Custom fields, if exist.

	 */

	function get_custom_fields($post_id) {

		$post_id = (int) $post_id;

		$custom_fields = array();

		foreach ( (array) has_meta($post_id) as $meta ) {

			// Don't expose protected fields.

			if ( ! current_user_can( 'edit_post_meta', $post_id , $meta['meta_key'] ) )

				continue;

			$custom_fields[] = array(

				"id"    => $meta['meta_id'],

				"key"   => $meta['meta_key'],

				"value" => $meta['meta_value']

			);

		}

		return $custom_fields;

	}

	/**

	 * Set custom fields for post.

	 *

	 * @since 2.5.0

	 *

	 * @param int $post_id Post ID.

	 * @param array $fields Custom fields.

	 */

	function set_custom_fields($post_id, $fields) {

		$post_id = (int) $post_id;

		foreach ( (array) $fields as $meta ) {

			if ( isset($meta['id']) ) {

				$meta['id'] = (int) $meta['id'];

				$pmeta = get_metadata_by_mid( 'post', $meta['id'] );

				if ( isset($meta['key']) ) {

					$meta['key'] = stripslashes( $meta['key'] );

					if ( $meta['key'] != $pmeta->meta_key )

						continue;

					$meta['value'] = stripslashes_deep( $meta['value'] );

					if ( current_user_can( 'edit_post_meta', $post_id, $meta['key'] ) )

						update_metadata_by_mid( 'post', $meta['id'], $meta['value'] );

				} elseif ( current_user_can( 'delete_post_meta', $post_id, $pmeta->meta_key ) ) {

					delete_metadata_by_mid( 'post', $meta['id'] );

				}

			} elseif ( current_user_can( 'add_post_meta', $post_id, stripslashes( $meta['key'] ) ) ) {

				add_post_meta( $post_id, $meta['key'], $meta['value'] );

			}

		}

	}

	/**

	 * Set up blog options property.

	 *

	 * Passes property through 'xmlrpc_blog_options' filter.

	 *

	 * @since 2.6.0

	 */

	function initialise_blog_option_info() {

		global $wp_version;

		$this->blog_options = array(

			// Read only options

			'software_name'     => array(

				'desc'          => __( 'Software Name' ),

				'readonly'      => true,

				'value'         => 'WordPress'

			),

			'software_version'  => array(

				'desc'          => __( 'Software Version' ),

				'readonly'      => true,

				'value'         => $wp_version

			),

			'blog_url'          => array(

				'desc'          => __( 'Site URL' ),

				'readonly'      => true,

				'option'        => 'siteurl'

			),

			'home_url'          => array(

				'desc'          => __( 'Home URL' ),

				'readonly'      => true,

				'option'        => 'home'

			),

			'image_default_link_type' => array(

				'desc'          => __( 'Image default link type' ),

				'readonly'      => true,

				'option'        => 'image_default_link_type'

			),

			'image_default_size' => array(

				'desc'          => __( 'Image default size' ),

				'readonly'      => true,

				'option'        => 'image_default_size'

			),

			'image_default_align' => array(

				'desc'          => __( 'Image default align' ),

				'readonly'      => true,

				'option'        => 'image_default_align'

			),

			'template'          => array(

				'desc'          => __( 'Template' ),

				'readonly'      => true,

				'option'        => 'template'

			),

			'stylesheet'        => array(

				'desc'          => __( 'Stylesheet' ),

				'readonly'      => true,

				'option'        => 'stylesheet'

			),

			'post_thumbnail'    => array(

				'desc'          => __('Post Thumbnail'),

				'readonly'      => true,

				'value'         => current_theme_supports( 'post-thumbnails' )

			),

			// Updatable options

			'time_zone'         => array(

				'desc'          => __( 'Time Zone' ),

				'readonly'      => false,

				'option'        => 'gmt_offset'

			),

			'blog_title'        => array(

				'desc'          => __( 'Site Title' ),

				'readonly'      => false,

				'option'        => 'blogname'

			),

			'blog_tagline'      => array(

				'desc'          => __( 'Site Tagline' ),

				'readonly'      => false,

				'option'        => 'blogdescription'

			),

			'date_format'       => array(

				'desc'          => __( 'Date Format' ),

				'readonly'      => false,

				'option'        => 'date_format'

			),

			'time_format'       => array(

				'desc'          => __( 'Time Format' ),

				'readonly'      => false,

				'option'        => 'time_format'

			),

			'users_can_register' => array(

				'desc'          => __( 'Allow new users to sign up' ),

				'readonly'      => false,

				'option'        => 'users_can_register'

			),

			'thumbnail_size_w'  => array(

				'desc'          => __( 'Thumbnail Width' ),

				'readonly'      => false,

				'option'        => 'thumbnail_size_w'

			),

			'thumbnail_size_h'  => array(

				'desc'          => __( 'Thumbnail Height' ),

				'readonly'      => false,

				'option'        => 'thumbnail_size_h'

			),

			'thumbnail_crop'    => array(

				'desc'          => __( 'Crop thumbnail to exact dimensions' ),

				'readonly'      => false,

				'option'        => 'thumbnail_crop'

			),

			'medium_size_w'     => array(

				'desc'          => __( 'Medium size image width' ),

				'readonly'      => false,

				'option'        => 'medium_size_w'

			),

			'medium_size_h'     => array(

				'desc'          => __( 'Medium size image height' ),

				'readonly'      => false,

				'option'        => 'medium_size_h'

			),

			'large_size_w'      => array(

				'desc'          => __( 'Large size image width' ),

				'readonly'      => false,

				'option'        => 'large_size_w'

			),

			'large_size_h'      => array(

				'desc'          => __( 'Large size image height' ),

				'readonly'      => false,

				'option'        => 'large_size_h'

			),

			'default_comment_status' => array(

				'desc'          => __( 'Allow people to post comments on new articles' ),

				'readonly'      => false,

				'option'        => 'default_comment_status'

			),

			'default_ping_status' => array(

				'desc'          => __( 'Allow link notifications from other blogs (pingbacks and trackbacks)' ),

				'readonly'      => false,

				'option'        => 'default_ping_status'

			)

		);

		$this->blog_options = apply_filters( 'xmlrpc_blog_options', $this->blog_options );

	}

	/**

	 * Retrieve the blogs of the user.

	 *

	 * @since 2.6.0

	 *

	 * @param array $args Method parameters. Contains:

	 *  - username

	 *  - password

	 * @return array. Contains:

	 *  - 'isAdmin'

	 *  - 'url'

	 *  - 'blogid'

	 *  - 'blogName'

	 *  - 'xmlrpc' - url of xmlrpc endpoint

	 */

	function wp_getUsersBlogs( $args ) {

		global $current_site;

		// If this isn't on WPMU then just use blogger_getUsersBlogs

		if ( !is_multisite() ) {

			array_unshift( $args, 1 );

			return $this->blogger_getUsersBlogs( $args );

		}

		$this->escape( $args );

		$username = $args[0];

		$password = $args[1];

		if ( !$user = $this->login($username, $password) )

			return $this->error;

		do_action( 'xmlrpc_call', 'wp.getUsersBlogs' );

		$blogs = (array) get_blogs_of_user( $user->ID );

		$struct = array();

		foreach ( $blogs as $blog ) {

			// Don't include blogs that aren't hosted at this site

			if ( $blog->site_id != $current_site->id )

				continue;

			$blog_id = $blog->userblog_id;

			switch_to_blog( $blog_id );

			$is_admin = current_user_can( 'manage_options' );

			$struct[] = array(

				'isAdmin'		=> $is_admin,

				'url'			=> home_url( '/' ),

				'blogid'		=> (string) $blog_id,

				'blogName'		=> get_option( 'blogname' ),

				'xmlrpc'		=> site_url( 'xmlrpc.php', 'rpc' ),

			);

			restore_current_blog();

		}

		return $struct;

	}

	/**

	 * Checks if the method received at least the minimum number of arguments.

	 *

	 * @since 3.4.0

	 *

	 * @param string|array $args Sanitize single string or array of strings.

	 * @param int $count Minimum number of arguments.

	 * @return boolean if $args contains at least $count arguments.

	 */

	protected function minimum_args( $args, $count ) {

		if ( count( $args ) < $count ) {

			$this->error = new IXR_Error( 400, __( 'Insufficient arguments passed to this XML-RPC method.' ) );

			return false;

		}

		return true;

	}

	/**

	 * Prepares taxonomy data for return in an XML-RPC object.

	 *

	 * @access protected