Upstream
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Whitelist post arguments in XML-RPC 

Merges [40677] to the 4.6 branch.

Built from https://develop.svn.wordpress.org/branches/4.6@40679


git-svn-id: http://core.svn.wordpress.org/branches/4.6@40542 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Pascal Birchler 2017-05-16 08:19:35 +00:00
parent 43c3b11cee
commit 5c4b703f38
1 changed files with 24 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
wp-includes/class-wp-xmlrpc-server.php
View File

@ -1295,10 +1295,31 @@ class wp_xmlrpc_server extends IXR_Server {
* @return IXR_Error|string
*/
protected function _insert_post( $user, $content_struct ) {
$defaults = array( 'post_status' => 'draft', 'post_type' => 'post', 'post_author' => 0,
'post_password' => '', 'post_excerpt' => '', 'post_content' => '', 'post_title' => '' );
$defaults = array(
'post_status' => 'draft',
'post_type' => 'post',
'post_author' => null,
'post_password' => null,
'post_excerpt' => null,
'post_content' => null,
'post_title' => null,
'post_date' => null,
'post_date_gmt' => null,
'post_format' => null,
'post_name' => null,
'post_thumbnail' => null,
'post_parent' => null,
'ping_status' => null,
'comment_status' => null,
'custom_fields' => null,
'terms_names' => null,
'terms' => null,
'sticky' => null,
'enclosure' => null,
'ID' => null,
);
$post_data = wp_parse_args( $content_struct, $defaults );
$post_data = wp_parse_args( array_intersect_key( $content_struct, $defaults ), $defaults );
$post_type = get_post_type_object( $post_data['post_type'] );
if ( ! $post_type )
@ -1488,9 +1509,6 @@ class wp_xmlrpc_server extends IXR_Server {
$post_data['tax_input'] = $terms;
unset( $post_data['terms'], $post_data['terms_names'] );
} else {
// Do not allow direct submission of 'tax_input', clients must use 'terms' and/or 'terms_names'.
unset( $post_data['tax_input'], $post_data['post_category'], $post_data['tags_input'] );
}
if ( isset( $post_data['post_format'] ) ) {