<?php

/**

 * WordPress Post Administration API.

 *

 * @package WordPress

 * @subpackage Administration

 */

/**

 * Rename $_POST data from form names to DB post columns.

 *

 * Manipulates $_POST directly.

 *

 * @package WordPress

 * @since 2.6.0

 *

 * @param bool $update Are we updating a pre-existing post?

 * @param array $post_data Array of post data. Defaults to the contents of $_POST.

 * @return object|bool WP_Error on failure, true on success.

 */

function _wp_translate_postdata( $update = false, $post_data = null ) {

	if ( empty($post_data) )

		$post_data = &$_POST;

	if ( $update )

		$post_data['ID'] = (int) $post_data['post_ID'];

	$ptype = get_post_type_object( $post_data['post_type'] );

	if ( $update && ! current_user_can( $ptype->cap->edit_post, $post_data['ID'] ) ) {

		if ( 'page' == $post_data['post_type'] )

			return new WP_Error( 'edit_others_pages', __( 'You are not allowed to edit pages as this user.' ) );

		else

			return new WP_Error( 'edit_others_posts', __( 'You are not allowed to edit posts as this user.' ) );

	} elseif ( ! $update && ! current_user_can( $ptype->cap->create_posts ) ) {

		if ( 'page' == $post_data['post_type'] )

			return new WP_Error( 'edit_others_pages', __( 'You are not allowed to create pages as this user.' ) );

		else

			return new WP_Error( 'edit_others_posts', __( 'You are not allowed to create posts as this user.' ) );

	}

	if ( isset( $post_data['content'] ) )

		$post_data['post_content'] = $post_data['content'];

	if ( isset( $post_data['excerpt'] ) )

		$post_data['post_excerpt'] = $post_data['excerpt'];

	if ( isset( $post_data['parent_id'] ) )

		$post_data['post_parent'] = (int) $post_data['parent_id'];

	if ( isset($post_data['trackback_url']) )

		$post_data['to_ping'] = $post_data['trackback_url'];

	if ( !isset($post_data['user_ID']) )

		$post_data['user_ID'] = $GLOBALS['user_ID'];

	if (!empty ( $post_data['post_author_override'] ) ) {

		$post_data['post_author'] = (int) $post_data['post_author_override'];

	} else {

		if (!empty ( $post_data['post_author'] ) ) {

			$post_data['post_author'] = (int) $post_data['post_author'];

		} else {

			$post_data['post_author'] = (int) $post_data['user_ID'];

		}

	}

	if ( ! $update && isset( $post_data['user_ID'] ) && ( $post_data['post_author'] != $post_data['user_ID'] )

		 && ! current_user_can( $ptype->cap->edit_others_posts ) ) {

		if ( 'page' == $post_data['post_type'] )

			return new WP_Error( 'edit_others_pages', __( 'You are not allowed to create pages as this user.' ) );

		else

			return new WP_Error( 'edit_others_posts', __( 'You are not allowed to create posts as this user.' ) );

	}

	// What to do based on which button they pressed

	if ( isset($post_data['saveasdraft']) && '' != $post_data['saveasdraft'] )

		$post_data['post_status'] = 'draft';

	if ( isset($post_data['saveasprivate']) && '' != $post_data['saveasprivate'] )

		$post_data['post_status'] = 'private';

	if ( isset($post_data['publish']) && ( '' != $post_data['publish'] ) && ( !isset($post_data['post_status']) || $post_data['post_status'] != 'private' ) )

		$post_data['post_status'] = 'publish';

	if ( isset($post_data['advanced']) && '' != $post_data['advanced'] )

		$post_data['post_status'] = 'draft';

	if ( isset($post_data['pending']) && '' != $post_data['pending'] )

		$post_data['post_status'] = 'pending';

	if ( isset( $post_data['ID'] ) )

		$post_id = $post_data['ID'];

	else

		$post_id = false;

	$previous_status = $post_id ? get_post_field( 'post_status', $post_id ) : false;

	// Posts 'submitted for approval' present are submitted to $_POST the same as if they were being published.

	// Change status from 'publish' to 'pending' if user lacks permissions to publish or to resave published posts.

	if ( isset($post_data['post_status']) && ('publish' == $post_data['post_status'] && !current_user_can( $ptype->cap->publish_posts )) )

		if ( $previous_status != 'publish' || !current_user_can( 'edit_post', $post_id ) )

			$post_data['post_status'] = 'pending';

	if ( ! isset($post_data['post_status']) )

		$post_data['post_status'] = $previous_status;

	if (!isset( $post_data['comment_status'] ))

		$post_data['comment_status'] = 'closed';

	if (!isset( $post_data['ping_status'] ))

		$post_data['ping_status'] = 'closed';

	foreach ( array('aa', 'mm', 'jj', 'hh', 'mn') as $timeunit ) {

		if ( !empty( $post_data['hidden_' . $timeunit] ) && $post_data['hidden_' . $timeunit] != $post_data[$timeunit] ) {

			$post_data['edit_date'] = '1';

			break;

		}

	}

	if ( !empty( $post_data['edit_date'] ) ) {

		$aa = $post_data['aa'];

		$mm = $post_data['mm'];

		$jj = $post_data['jj'];

		$hh = $post_data['hh'];

		$mn = $post_data['mn'];

		$ss = $post_data['ss'];

		$aa = ($aa <= 0 ) ? date('Y') : $aa;

		$mm = ($mm <= 0 ) ? date('n') : $mm;

		$jj = ($jj > 31 ) ? 31 : $jj;

		$jj = ($jj <= 0 ) ? date('j') : $jj;

		$hh = ($hh > 23 ) ? $hh -24 : $hh;

		$mn = ($mn > 59 ) ? $mn -60 : $mn;

		$ss = ($ss > 59 ) ? $ss -60 : $ss;

		$post_data['post_date'] = sprintf( "%04d-%02d-%02d %02d:%02d:%02d", $aa, $mm, $jj, $hh, $mn, $ss );

		$valid_date = wp_checkdate( $mm, $jj, $aa, $post_data['post_date'] );

		if ( !$valid_date ) {

			return new WP_Error( 'invalid_date', __( 'Whoops, the provided date is invalid.' ) );

		}

		$post_data['post_date_gmt'] = get_gmt_from_date( $post_data['post_date'] );

	}

	return $post_data;

}

/**

 * Update an existing post with values provided in $_POST.

 *

 * @since 1.5.0

 *

 * @param array $post_data Optional.

 * @return int Post ID.

 */

function edit_post( $post_data = null ) {

	if ( empty($post_data) )

		$post_data = &$_POST;

	// Clear out any data in internal vars.

	unset( $post_data['filter'] );

	$post_ID = (int) $post_data['post_ID'];

	$post = get_post( $post_ID );

	$post_data['post_type'] = $post->post_type;

	$post_data['post_mime_type'] = $post->post_mime_type;

	$ptype = get_post_type_object($post_data['post_type']);

	if ( !current_user_can( $ptype->cap->edit_post, $post_ID ) ) {

		if ( 'page' == $post_data['post_type'] )

			wp_die( __('You are not allowed to edit this page.' ));

		else

			wp_die( __('You are not allowed to edit this post.' ));

	}

	$post_data = _wp_translate_postdata( true, $post_data );

	if ( is_wp_error($post_data) )

		wp_die( $post_data->get_error_message() );

	if ( ( empty( $post_data['action'] ) || 'autosave' != $post_data['action'] ) && 'auto-draft' == $post_data['post_status'] ) {

		$post_data['post_status'] = 'draft';

	}

	if ( isset($post_data['visibility']) ) {

		switch ( $post_data['visibility'] ) {

			case 'public' :

				$post_data['post_password'] = '';

				break;

			case 'password' :

				unset( $post_data['sticky'] );

				break;

			case 'private' :

				$post_data['post_status'] = 'private';

				$post_data['post_password'] = '';

				unset( $post_data['sticky'] );

				break;

		}

	}

	// Post Formats

	if ( isset( $post_data['post_format'] ) ) {

		if ( current_theme_supports( 'post-formats', $post_data['post_format'] ) )

			set_post_format( $post_ID, $post_data['post_format'] );

		elseif ( '0' == $post_data['post_format'] )

			set_post_format( $post_ID, false );

	}

	// Meta Stuff

	if ( isset($post_data['meta']) && $post_data['meta'] ) {

		foreach ( $post_data['meta'] as $key => $value ) {

			if ( !$meta = get_post_meta_by_id( $key ) )

				continue;

			if ( $meta->post_id != $post_ID )

				continue;

			if ( is_protected_meta( $value['key'], 'post' ) || ! current_user_can( 'edit_post_meta', $post_ID, $value['key'] ) )

				continue;

			update_meta( $key, $value['key'], $value['value'] );

		}

	}

	if ( isset($post_data['deletemeta']) && $post_data['deletemeta'] ) {

		foreach ( $post_data['deletemeta'] as $key => $value ) {

			if ( !$meta = get_post_meta_by_id( $key ) )

				continue;

			if ( $meta->post_id != $post_ID )

				continue;

			if ( is_protected_meta( $meta->meta_key, 'post' ) || ! current_user_can( 'delete_post_meta', $post_ID, $meta->meta_key ) )

				continue;

			delete_meta( $key );

		}

	}

	// Attachment stuff

	if ( 'attachment' == $post_data['post_type'] ) {

		if ( isset( $post_data[ '_wp_attachment_image_alt' ] ) ) {

			$image_alt = get_post_meta( $post_ID, '_wp_attachment_image_alt', true );

			if ( $image_alt != stripslashes( $post_data['_wp_attachment_image_alt'] ) ) {

				$image_alt = wp_strip_all_tags( stripslashes( $post_data['_wp_attachment_image_alt'] ), true );

				// update_meta expects slashed

				update_post_meta( $post_ID, '_wp_attachment_image_alt', addslashes( $image_alt ) );

			}

		}

		$attachment_data = isset( $post_data['attachments'][ $post_ID ] ) ? $post_data['attachments'][ $post_ID ] : array();

		$post_data = apply_filters( 'attachment_fields_to_save', $post_data, $attachment_data );

	}

	add_meta( $post_ID );

	update_post_meta( $post_ID, '_edit_last', $GLOBALS['current_user']->ID );

	wp_update_post( $post_data );

	// Now that we have an ID we can fix any attachment anchor hrefs

	_fix_attachment_links( $post_ID );

	wp_set_post_lock( $post_ID );

	if ( current_user_can( $ptype->cap->edit_others_posts ) ) {

		if ( ! empty( $post_data['sticky'] ) )

			stick_post( $post_ID );

		else

			unstick_post( $post_ID );

	}

	return $post_ID;

}

/**

 * Process the post data for the bulk editing of posts.

 *

 * Updates all bulk edited posts/pages, adding (but not removing) tags and

 * categories. Skips pages when they would be their own parent or child.

 *

 * @since 2.7.0

 *

 * @param array $post_data Optional, the array of post data to process if not provided will use $_POST superglobal.

 * @return array

 */

function bulk_edit_posts( $post_data = null ) {

	global $wpdb;

	if ( empty($post_data) )

		$post_data = &$_POST;

	if ( isset($post_data['post_type']) )

		$ptype = get_post_type_object($post_data['post_type']);

	else

		$ptype = get_post_type_object('post');

	if ( !current_user_can( $ptype->cap->edit_posts ) ) {

		if ( 'page' == $ptype->name )

			wp_die( __('You are not allowed to edit pages.'));

		else

			wp_die( __('You are not allowed to edit posts.'));

	}

	if ( -1 == $post_data['_status'] ) {

		$post_data['post_status'] = null;

		unset($post_data['post_status']);

	} else {

		$post_data['post_status'] = $post_data['_status'];

	}

	unset($post_data['_status']);

	$post_IDs = array_map( 'intval', (array) $post_data['post'] );

	$reset = array( 'post_author', 'post_status', 'post_password', 'post_parent', 'page_template', 'comment_status', 'ping_status', 'keep_private', 'tax_input', 'post_category', 'sticky' );

	foreach ( $reset as $field ) {

		if ( isset($post_data[$field]) && ( '' == $post_data[$field] || -1 == $post_data[$field] ) )

			unset($post_data[$field]);

	}

	if ( isset($post_data['post_category']) ) {

		if ( is_array($post_data['post_category']) && ! empty($post_data['post_category']) )

			$new_cats = array_map( 'absint', $post_data['post_category'] );

		else

			unset($post_data['post_category']);

	}

	$tax_input = array();

	if ( isset($post_data['tax_input'])) {

		foreach ( $post_data['tax_input'] as $tax_name => $terms ) {

			if ( empty($terms) )

				continue;

			if ( is_taxonomy_hierarchical( $tax_name ) ) {

				$tax_input[ $tax_name ] = array_map( 'absint', $terms );

			} else {

				$comma = _x( ',', 'tag delimiter' );

				if ( ',' !== $comma )

					$terms = str_replace( $comma, ',', $terms );

				$tax_input[ $tax_name ] = explode( ',', trim( $terms, " \n\t\r\0\x0B," ) );

			}

		}

	}

	if ( isset($post_data['post_parent']) && ($parent = (int) $post_data['post_parent']) ) {

		$pages = $wpdb->get_results("SELECT ID, post_parent FROM $wpdb->posts WHERE post_type = 'page'");

		$children = array();

		for ( $i = 0; $i < 50 && $parent > 0; $i++ ) {

			$children[] = $parent;

			foreach ( $pages as $page ) {

				if ( $page->ID == $parent ) {

					$parent = $page->post_parent;

					break;

				}

			}

		}

	}

	if ( isset( $post_data['post_format'] ) ) {

		if ( '0' == $post_data['post_format'] )

			$post_data['post_format'] = false;

		// don't change the post format if it's not supported or not '0' (standard)

		elseif ( ! current_theme_supports( 'post-formats', $post_data['post_format'] ) )

			unset( $post_data['post_format'] );

	}

	$updated = $skipped = $locked = array();

	foreach ( $post_IDs as $post_ID ) {

		$post_type_object = get_post_type_object( get_post_type( $post_ID ) );

		if ( !isset( $post_type_object ) || ( isset($children) && in_array($post_ID, $children) ) || !current_user_can( $post_type_object->cap->edit_post, $post_ID ) ) {

			$skipped[] = $post_ID;

			continue;

		}

		if ( wp_check_post_lock( $post_ID ) ) {

			$locked[] = $post_ID;

			continue;

		}

		$post = get_post( $post_ID );

		$tax_names = get_object_taxonomies( $post );